A disadvantage of a firewall based on a local VPN is that not all traffic types can be handled, because the (Android) Linux kernel does not allow forwarding all traffic types over a socket based connection. An example is IPsec, which is being used for IP calling by some manufacturers. A partial (not for IPsec) solution to this would be to use a remote VPN server to forward traffic, but this is privacy wise not acceptable for a lot of people and would come with additional complexity and probably also with extra battery usage. In practice handling TCP and UDP traffic appears to be sufficient for 99,9% of the NetGuard users. Since Android 5 it is possible to exclude applications from being routed into the VPN (the VPN implementing application decides if this is mandatory or optional), which can be used to address problems arising from not being able to forward all traffic. Another option is to exclude address (ranges), which NetGuard uses to 'fix' IP calling for some manufacturers.