How to route traffice to specific gateways for specific websites.

[grimelog]

I have four use cases I'm trying to solve for. There are three solutions, which I need. I've already figured out the two general rules needed, but cannot figure out how to handle the exceptions properly.

I'm using GEOIP to send traffic to different wireguard gateways. If the site is located in the US it goes out though a US server. If not the US it goes out over my preferred wireguard gateway. This works perfectly well. Where I run into trouble is getting the exceptions to route traffic reliably. There are a few sites I either do not want going out over a VPN, or to use a VPN running Socks5.

I tried using the FQDN. That works until the site refreshes their IP. It's an issue with a mismatch between the DNS on my OPNsense box, and what IP the URL currently resolves to.  I also tried using ASN; however, a large amount of sites use the same ASNs. Is there a reliable means of doing this?

Would running a local DNS, and refreshing the database before visiting those sites work? Is there a means of doing that with Unbound?