It can isolate applications into separate network namespace (i.e. no access to host services) with or without internet access and also load separate netfilter rules. No convenience arguments for port filtering though.