AOSP has a pretty well functioning firewall, good enough that GrapheneOS implements and builds on it.

https://grapheneos.org/faq#firewall

Yeah there's no stats or traffic info, but until Android has a real way of using multiple VPN interfaces or exposes adding routes to users/apps, these VPN-based local tools are a no-go.