@petestav For a device with the forced VPN, the router only sees that it is connected to the VPN. The router does not know which websites the device is visiting through the VPN. For example, if you open Google on the device, the router does not see google.com, it only sees a visit to the VPN server. That’s because the traffic is tunneled through the VPN, and the VPN brings back google.com. For these devices, the router can only allow connection or disallow connection. As a result, you only need one calendar without domains list.
For devices not going through the VPN, you can configure allowed & blocked domains and set up domain specific calendars.
It is possible to mix these two types of devices in one profile and make it work, if you list the proper domains. But it’s easier to manage with two separate profiles, one for each type of device.