@thedarktangent right, RPZ is like a DNS firewall. Intercepts requests and uses a policy to return customized results (blocked or rewritten responses). No layer 3 protection inherent to it. If you can connect to the IP and send eg host header, you’ll bypass the RPZ bc you’re not resolving its name