this is as broken as the bwrap sandboxing: it can see the current connection, but can't adjust it. i believe this is because of faulty NetworkManager sandboxing (e.g. nmcli has similar issues)
this follows my explicit whitelisting elsewhere