Capture HTTPS browser traffic and redirect to proxy

yes, and be aware Zyxell runs under Amazons zone 34.0.0.0, so this portal is so corrupt as all comanys from Microsoft to twitter uses Amazons SSL zone as VPN link, the Zyxell is by that also a risk , as the portal reads the .conf without problem, so can any inside this zone reach the router, like Cisco,Netgear also does,

use the DMZ not for DNS ,place a proxy server running a non relation with the certificate that encrypts the domain, isn't cheap, but an domain level A by Dynu together with an SSL crupto , that put's the ISP on the WAN and any user no way to detect the KEY, a part you store in the router , the private on a proxy like Syno has for mailserver aswell for port 80 and 443 , and browsers come automaitcly in this wpad , nice is that the credentials are based on the users off the mailserver, so the SSL key isn't exchanged as the browser simply validates user, the traffic is hidden aswell the SSL crypto, every user on the LAN will not pass the gateway but the outside proxy , on the zyxell itself you make the LAN to WAN deny , and put LAN to DMZ the 2 ports mapping tcp 80 and 443, the proxy goes on his way through apppatrol, and policys , traffic will drop , and use vlan's , that's my best advice I have till know, cheers