[jethro_tell]

So this has to assume that it's not a whitelisting setup and put a default allow. Which if you do outbound whitelisting, kinda fucks things up.

[AnthonyMouse]

Nothing prevents you from having explicit deny rules followed by explicit allow rules followed by default deny.

And if you're already doing outbound whitelisting (which is generally much more trouble than it's worth) then unless you put Facebook on the whitelist you don't need to do anything anyway.