I was able to backport the REDIRECT target from iptables 1.4.19. Testing seemed to work properly for me - when setting the router to Cleanbrowsing, resolving an adult site returned the IP for Cleanbrowsing's block page even when having nslookup set to use an open resolver like Cloudflare.Your reply reminded me to check this since I had just swapped routers yesterday, and sure enough, the DNSFILTER chain was incomplete, as originally reported. This was on a cold boot while also waiting for the cable modem to initialize (on Comcast/Xfinity).
I’ve seen other router platforms recommend using loopback IPs for the redirect, but that doesn’t seem to work on our Linux in some quick tests.