At first I was going to say there is ATI.
Then I realized I hadn't heard about ATI in a while and looked up what happened to it.
Then I realized... I'm old.
He dug himself into a corner when they called his bluff. Now he has to fix things without appearing as weak as he is. And this "reset" is him backtracking.
Set up an internal dns server that will resolve your specific host name to an internal ip and forward everything else.
If you just want a specific site, you can use bind and response policy zones. The advantage of this is that you can now configure your dns server to take advantage of block lists on the internet and block malware/ads/tracking domains.
From a networking standpoint, you can configure qos tagging for a specific application and use that dscp variable as a flag for pbr. Then set your next hop via respective tunnel.
Pfsense has an openvpn server and client built in. Also if you are using site-to-site ipsec vpns it can be useful. I think it will also use the extensions if you run a web proxy to inspect tls traffic. If you just use it for a nat gateway, then you don't need aes-ni or even most of the features Pfsense provides.
Uhm... Space balls?