Instead of “chain=ouput”, should be “chain=output”.
3. Consequently to the previous clause:
The chain to which the firewall rule should be added is “forward”, not “output”.
Do you agree?
In newer versions you can put hostname directly in address list and system will resolve it automatically (and refresh it when its ttl expires). So it’s easier and script is not needed. But if for some reason you like script better, you can keep using it.
The right chain depends on what you’re trying to do. Output is not necessarily incorrect, even though forward is probably more likely.