DNS is highlighted; its page is below.

DNS

Every device asks the firewall's unbound. It answers local names itself, forwards everything else through the VPN tunnel to a resolver that blocks ads, trackers and malware, and no device can use another DNS server.

What it does#

Local names. Every device and service has a name under .internal, and every name under apps.internal points at the cluster's ingress, so a new web app needs no DNS change.
Forwarding through the tunnel. Lookups leave encrypted, through the VPN, to a resolver with content blocking. That replaces a separate ad blocker.
No bypass. pf blocks DNS and DNS over TLS to any other server, and logs the attempt.
Browsers and phones told to behave. Two well-known signal names switch off Firefox's automatic DNS over HTTPS, and Apple's iCloud Private Relay, for every device on the network.

In the configuration#

/var/unbound/etc/unbound.conf

server:
	# every name under apps.internal goes to the cluster's ingress
	local-zone: "apps.internal." redirect
	local-data: "apps.internal. A 192.168.5.201"
	# signal names: no automatic DoH in Firefox, no Private Relay on Apple devices
	local-zone: "use-application-dns.net." always_nxdomain
	local-zone: "mask.icloud.com." always_nxdomain
	local-zone: "mask-h2.icloud.com." always_nxdomain
forward-zone:
	name: "."
	forward-addr: <VPN provider's blocking resolver, inside the tunnel>

The firewall's own lookups use the same resolver; the DHCP client is told never to touch resolv.conf.