One feature that I make use of on ubiquiti edgerouters is to periodically download ip based block lists from firehol and install them as ipsets that are referenced by netfilter based rules. As long as they don’t affect established connections, they don’t affect offloading. I see that the route10 is debian based and does have netfilter support. Can I do the same on the route10 as long as I insert the rules in post-cfg.sh? Likewise can I install a crontab to periodically update the ipsets?