Right, but I think this could be used at like a school to control what IPs are accessed on the network for even an untrusted device. So students couldn't bypass DNS blocks via VPN.