After blocking even more ip's and domains exept the ones from nanopool.
2018-01-02 05:05:16|# connected to: zec-eu1.nanopool.org:16666
2018-01-02 05:05:46|connect failed
What happens here is that the program secretly wants to connect to a dev fee pool waits 30 second for timeout and than shuts down