Why does iptables drop traffic on -P OUTPUT DROP?

Question

linux

In order for the Internet to work only if VPN is enabled in iptables, I prescribe the following commands:

iptables --flush
iptables --delete-chain
iptables -t nat --flush
iptables -t nat --delete-chain

iptables -P OUTPUT DROP

iptables -A INPUT -j ACCEPT -i lo
iptables -A OUTPUT -j ACCEPT -o lo

iptables -A OUTPUT -j ACCEPT -d 123.45.67.89 (VPN server)

iptables -A OUTPUT -j ACCEPT -o tun0

Then I save these rules with:
netfilter-persistent save
As a result, the output of the iptables -L command is:

[email protected]:~# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere            

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy DROP)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             123.45.67.89
ACCEPT     all  --  anywhere             anywhere

And the cat /etc/iptables/rules.v4 command gives the following:

[email protected]:~# cat /etc/iptables/rules.v4
# Generated by iptables-save v1.6.0 on Wed Apr 25 12:57:29 2018
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT DROP [0:0]
-A INPUT -i lo -j ACCEPT
-A OUTPUT -o lo -j ACCEPT
-A OUTPUT -d 123.45.67.89/32 -j ACCEPT
-A OUTPUT -o tun0 -j ACCEPT
COMMIT
# Completed on Wed Apr 25 12:57:29 2018
# Generated by iptables-save v1.6.0 on Wed Apr 25 12:57:29 2018
*nat
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [7:392]
:POSTROUTING ACCEPT [0:0]
COMMIT
# Completed on Wed Apr 25 12:57:29 2018

Everything should work and worked for a year, but today for some reason it stopped. The firewall started to let traffic to the Internet even if the VPN is turned off with such firewall rules.
All I did today was update virtualbox and add a new VPN server to network manager.
Either I don't see something point-blank, or I don't even know where to think... Does anyone have any ideas?
OS: Debian 9.4 x64

Answer 1

Solution:
Simple. Need. It was. Change. WiFi.
When connected to another router, the firewall began to block the Internet correctly. How is this possible?
Those. even if he blocked all OUTPUT and FORWARD in general, the Internet still functioned. It's like the firewall didn't work at all. But, as it turned out, all this only happens if you connect to a certain WIFI in a certain cafe. Nowhere else have I seen this.
How could the router affect the work of iptables (however, I'm not sure that it affected the work of iptables)?
Could it be some network-manager glitch in Debian?