To a point. I completely revamped the off site backups when I ditched Veeam. Four (out of probably ten) VM’s were able to be backed up off-site successfully in PBS. I think I restored two of those because they were newer than what I had locally. The rest never made it off-site, probably due to the local PBS VM choking on disk write conflicts.

Second Protectli. They are solid little x86 boxes with no moving parts.

I have a firewall rule to dst-nat any outgoing DNS requests not coming from piHole back to the piHole server. That way all devices on the LAN are forced to use piHole for DNS and can’t bypass it. I don’t have an OPNSense firewall but I would think it should be able to do that as well.