I run rooted, so I can use AFWall to configure the Linux firewall. Using a VPN-based firewall works as well, but only if you don't want to use a real VPN at the same time (which I do).