@michmoor I have not had time to test lately - but if unbound uses a shared cache you can not do this. Now it might be possible with views to do something like this - but last I checked you could not specific do view forwarders, and I don't think it creates a different cache per view.
Now pretty sure bind can do this, as it creates different caches if not mistaken per view.
If you want to to do something like this your local dns has to create separate caches, or you run into a problem with unfiltered looking up host.xyz.com and it getting locally cached, and then filtered client asking for host.xyz.com and get returned the cached value vs it looking up via some filtering forwarded dns that would return blocked.
And the reverse happening where blocked gets cached, and then someone that is suppose to be unfiltered getting back the blocked cache.
The most reliable way to do this would be to use 2 different dns, that both have same local data.. Where ns1 you run is unfiltered and ns2 you run is filtered. And you point your clients to the specific ns depending if you want them filtered or not filtered.
Now you might be able to do something new in unbound there has been some changes of late and they did add rpz policies, etc. . I just do not have any need or desire to do this currently.. And of the mindset if worth filtering - worth filtering for all. So haven't played with if this is now possible in an easy to do way.
edit: Looks like steve mentioned using unbound and dnsmasq on pfsense - yeah that could work for sure.
