The advantage over vanilla restrictive firewalls is ability to come from many different IPs without cluttering logs. In an enterprise setting, this is probably

The advantage over vanilla restrictive firewalls is ability to come from many different IPs without cluttering logs. In an enterprise setting, this is probably not helpful. At home or for private servers, this is a nice feature. (Also at home, it helps reduce stupid ISP imposed rules on not hosting ssh... their scanners just assume "no server here" but I can still get to my home network)