Harden interior net filtering rules

[bowei]

We need to hardness the net filtering installed by default with Ateom to isolate Actors from the Node. For example, prevents access to instance metadata, Kubernetes node ports and the host network namespace.

[EItanya]

This will be easier with #110

[haiyanmeng]

/assign haiyanmeng