This runs a combination of both. Been using this for years and works like magic
I often see wireguard and adguard or pihole mentioned. There’s a service that provides a combination of wireguard and pihole in 1 docker compose file and has a web interface for wireguard clients (wgeasy) called wirehole. Been using our for 2 years or so, very happy with it.
In my opinion the most elegant solution for an ad blocking VPN.
Thanks, good to know about firewall.