Hm.... I am not familiar with that device myself, and since I use opnsense for a while I forget most people do not use routers outside of the provided one.
But in a theoretical sense, this firewall rule should look something like this:
- origin of traffic is any IP that goes into port 53
- outgoing traffic has to go to pi hole on port 53
I was making a quick check, and yes, the DoH situation is a bit more dicey. From how I see it, the best way to make this work is to, at the firewall level, either block as much as possible any requests that look like DoH (and hope whatever was using that falls back to regular DNS calls) or setup a local DoH server to resolve those queries (although I am not sure if it is possible to fully redirect those). In that sense, pihole can't really do much against DoH on its own
EDIT: decided to look a bit further on the router level, and for pfsense at least this is one way to do this recipe for DNS block and redirect