pf payload filtering

Hi, Can anyone tell me if PF can be by-passed by an outsider(intruder)? I have an IP address that has already been in my ip.blocked table for two days and still its scans reach the web platform of the site where it is blocked by a firewall add-on/plugin at application level. Any help is welcome.

Hello everybody, Is it possible to filter outgoing DNS requests according to their content? e.g: to deny access to the website: "the-bad-site.com" (as an example) If yes, is it possible to show me how? Furthermore, is it even possible to filter packets according to their payload using only...