I created a few raw firewall rules with Content set to a domain name (Firewall -> Raw -> Advanced -> Content). For example:

Initially I thought that it was using DNS to figure out what IP the content has. However, I just realized that I did not configure any DNS resolvers on this router.


How does Firewall -> Raw -> Advanced -> Content work?

(the old) firewall manual says:

content (string; Default: ) Match packets that contain specified text

So it really only matches packets which contain set string in full. Not even connection but only packet. So basically this may match one of initial packets where client includes server name in SNI ... that one was not encrypted up to TLSv1.2, in TLSv1.3 it's encrypted so this rule won't be able to block such connection attempts any more. Another possibility for not matching is if this string somehow gets split into two packets (e.g. because of low MTU).

So in essence, this matching property may or may not work as desired.