bwrap just works in rootless mode and doesn't tamper with your firewall.