Comment by JSR_FDED

Then you need a firewall update for each new user.

Whereas matching on user+ip is a one-time proxy install.