little rant

Its a valid rant.

Yeh, exactly. “You have the ip to work with”

one.one.one.one isnt an http/ request, its a dns lookup.
If it was an http/s request to 1.1.1.1 then it could be blocked. Also, super cheap/easy to proxy

You have the destination IP to work with, thats it. Otherwise it just looks like any other HTTPS traffic.

I guess if you uplpaded your own root CA cert tgen you could man-in-the-middle for deeper packet inspection.
Or, i guess, try using eMudhra’s compromised private keys and hope the clients havent been updated yet