The pf-blockerNG package on pfSense would be the next level up. Not as pretty as pinhole, but far more capable if you are willing to stick with it. And you don't have to use pfSense as your firewall/gateway if you don't want to - pfSense will work just find with only one interface as an application appliance purely for running pf-blockerNG to use as your internal DNS server.