I should add that what makes it work so nicely with pihole is you can use regular expressions for the DNS allow/block lists. So the kids group has a deny rule of `.*` and those few explicit allowed sites I mentioned.