The simple answer is that it works as you suspected by performing a MITM attack on you (after all, your traffic flows through it), which permits the firewall to

The simple answer is that it works as you suspected by performing a MITM attack on you (after all, your traffic flows through it), which permits the firewall to snoop on your traffic and perform various analyses. As others have said, the SNI is not encrypted, so it can do basic category blocking even if your browser doesn't trust the certificate you saw. If it was a school-issued device, the certificate would have been preinstalled as a trusted certificate in the device's root store. Your options are limited - why not try and see if you can find a gap in the rules via a tunnel or VPN from your device? You could try commercial offerings like Proton, or setup your own OpenVPN, Wireguard, or even try an SSH tunnel. Modern next-gen firewalls (NGFWs) like Fortinet are going to able to detect and block (if configured) many of these techniques, but you never know what's actually configured until you try.