Block outgoing traffic if service not enabled
diff --git a/xos/synchronizers/vcpe/templates/before.rules.j2 b/xos/synchronizers/vcpe/templates/before.rules.j2
index e6f7d4a..cbe2fa7 100644
--- a/xos/synchronizers/vcpe/templates/before.rules.j2
+++ b/xos/synchronizers/vcpe/templates/before.rules.j2
@@ -37,6 +37,11 @@
:ufw-not-local - [0:0]
# End required lines
+# Customer service status
+{% if status != "enabled" %}
+-A FORWARD -o eth0 -j DROP
+{% endif %}
+
# allow all on loopback
-A ufw-before-input -i lo -j ACCEPT
-A ufw-before-output -o lo -j ACCEPT