

Can still be messed with by the Isp
Not as easily though. It’s like regular HTTPS - if anyone, including the ISP, tries a MitM (man in the middle) attack, you’ll get a security error because the certificate won’t be trusted. The only real way for a MitM attack to be successful is installing a custom root certificate on the client system.
Like you mentioned, IP blocking is harder to bypass, but that’s unrelated to DNS blocking. IP blocking is harder to do if the site uses a CDN like CloudFront, BunnyCDN, Cloudflare, etc though, since a large number of sites use the same IPs.



Unraid is pretty beginner-friendly, so it’s what I’d recommend too.
I use it too. I have over 20 years experience running Debian servers and can write a docker-compose.yml file and Nginx config from scratch, but sometimes it’s nice to have a decent web UI that mostly “just works”.