Does OPNsense have any features or plugins that would block outbound connections to China? In case I use compromised devices that want to phone home.
Yeah, search for GeoIP. You'd create an alias with countries you want to block, then use that alias in a firewall rule. Prior to that you'll need to set up an account (free) with maxmind.
See here: https://docs.opnsense.org/manual/how-tos/maxmind_geo_ip.html
Aliases: https://docs.opnsense.org/manual/aliases.html
CDN's are eroding the value of GeoIP and you may be better off internally segregating the devices you don't control - like IoT - with separate VLAN and stricter firewall rules.
Bart...