I followed this blog to get the firewall dynamic firewall in place: https://labzilla.io/blog/force-dns-pihole https://labzilla.io/blog/force-dns-pihole Like yo

I followed this blog to get the firewall dynamic firewall in place: https://labzilla.io/blog/force-dns-pihole https://labzilla.io/blog/force-dns-pihole Like you said, you cannot just block 443, the dynamic firewall uses a public list, which contains all the public DNS known to man ( the last bit was just to sound a little dramatic haha ) So OPNSense will block anything within that list in both 443 and 853. So my Samsung QLED TV can no longer use Google:443 for DNS resolution. OPNSense blocks it and redirect it to PiHole, a NAT is also required to avoid devices getting mad. I didn't pay a kidney for that smartTV back in 2019 to make it dumb, when it is on, PiHole logs goes brrrrrrrr It is also one of the reason why my whole network was going down, it was making too much request exhausting PiHole 150 concurrent DNS requests, there is a flag to increase that and no more issues. Google:443: DNS request only, not actual 443 request gets blocked Cloudflare:443: DNS request only, no actual 443 request gets blocked etc etc Read that blog I shared to understand it. If I run a dig google.com @8.8.8.8, PiHole terminal shows the request If I run 8.8.8.8:443 on the browser, OPNSense firewall log shows access denied, the same msg when my TV turns on or my Home Assistant goes on. DoT on 853 is simple to block on its own, no much secret there.