Ask HN: Setting up “Ask to Connect” mode firewall at router level?

Instead of allowing all connections to/from my computers by default I rather operate on a blacklist-all-by-default and whitelist-as-needed basis.

On Windows theres at least 2 ways to do it. using "simple-wall"(free) and "Glasswire"(paid). however, doing the filtering on the computer itself seems sub-optimal. there could be flaws in the filter implementation and connections could sneak through the cracks. I assume a better way to do the filtering would be using a piece of middleware in between the computer and router, or, at the router itself. This could be made intuitive to use with a touch screen tablet interface next to the computer keyboard. When a connection attempt is made to a new IP, there would be buttons for Allow or Block.

When you're operating on a whitelist basis in this way, the chances of a rogue executable being able to exfiltrate your data drops considerably. So please, can someone explain how I can set this up or advise me the best DIY solution? Searching for terms like "ask to connect" + "dd-wrt" yields no results.