Need an option - if it isn't there ...

[BenKenobi]

Really need an option to force firewall rules before NAT - I need to keep scumbags and scammers out but OpnSense lets them through - as I have found here NAT is applied before Firewall rules - I want an option not to - if I block a country I expect it blocked even from NAT traversal or I need to put a firewall on every internal box - this isn't efficient.

If I have missed something and there is a setting could somebody expose it please.