zlacker

> DNAT (Destination Network Address Translation)

Yes! This is easy to do on OpenBSD as well, though it's called "redirect" instead of "DNAT":

    pass in quick on $int_if inet proto udp to any port 53 rdr-to $dns_server port 53
    pass in quick on $int_if inet proto tcp to any port 53 rdr-to $dns_server port 53

>>accrua+(OP)
I also redirect port 53 traffic, and in addition filter traffic to "well known" public DNS servers like 1.1.1.1, 8.8.8.8, 9.9.9.9 and many others (lists can be found on GitHub), but this is ineffective against ads and telemetry served from hardcoded IPs.

Overall, it's just easier not to connect "smart" devices to the Internet at all. I prefer to use a Linux HTPC instead of a smart TV for example. It is completely under my control and I am not restricted to apps approved by Apple or Google, asked to log into anything or to accept ever-changing terms and conditions.

>>accrua+(OP)
This config is surprisingly easy to read.