I work for an ISP in the southeast USA as a field technician and it’s dirty work sometimes. Fixing rodent damage to fiber connection boxes for businesses, placing temporary cables when underground lines get cut, working in dusty equipment closets, etc.

It’s not bad or hard work most days.

An inbound only DNS forwarding rule would be pointless. All DNS queries should be originating from within the network.

EDIT

I think I see what you’re getting at. Assuming that the firewall is running on the NAS vs on the router.

The OP doesn’t specify, but I would assume the firewall rule would be on the router, as that makes the most sense to force all DNS requests on the network to go through the pihole.

I agree.

So the solution, OP, is to set the DNS settings on your NAS to your router’s internal IP so the firewall can redirect the traffic to your new port.

In a system rigged to support one party over another.