It adds processing delay most likely. I'll take a look to see if theres a way around it but like I say I've seen it with AWS also so may be par for the course.
Thanks's fo the feedback. CLI access and running custom scripts isn't something we're going to support. It would be a tech support nightmare!
We are considering adding country blocking in the future which may be something you are interested in.
The software (unless UPnP is being used) won't open any ports unless they are specified by the user (through the Settings page on the interface). The router's inbuilt firewall blocks any remaining incoming packets by default.