Works alright  but no port rules  no wildcards and no global (pre-) filters are a huge PITA. A lot of services use server farms with dynamic host names  so I have to block the same service multiple times in multiple apps. For most modern smartphones the additional workload would not be an issue. You could give the user the option to enable it or not.
January 22 2017