Rethink: dns + firewall + vpn