I am trying to set up pfBlockerNG so that site blocking (DNSBL / IP blocking) is applied only to devices connected to a specific Wi-Fi Access Point (or Wi-Fi subnet/VLAN), without affecting the rest of the LAN network.

Questions:

What is the best way to restrict pfBlockerNG DNSBL/IP blocking exclusively to the Wi-Fi interface or subnet?

Is it better to use pfBlockerNG Python Mode Group Policy, or should I control DNS access using custom firewall rules / custom DNS servers per interface?

Any guidance or step-by-step instructions would be greatly appreciated!

Thanks!