Iptables rule to unblock internet acess, and block it again 3600 seconds later

I do this, from my son's terminal, to sometimes give him internet access (disabled by default):

./unblockinternet.sh

<enter password>

with this script:

su -c "iptables -D OUTPUT -m owner --uid-owner son -j REJECT"

How to make that it automatically blocks networking again, say, 1 hour after? (It already blocks it again for user son after a reboot, but I also want to block it after 3600 seconds)

More precisely, how to add a timer to do su -c "iptables -A OUTPUT -m owner --uid-owner son -j REJECT" 3600 seconds later, without having to enter password at this time? Obviously I won't be precisely on his terminal 3600 seconds later exactly.