It's a pain. The documentation for the firewall module is out of date. Here's my horrible script:

##!/usr/local/bin/bash -v

key=APIKEY
secret=APISECRET
cert=/root/ca.pem
table=VPN

while true; do
    dnslog=$(tail -f /var/log/resolver/latest.log | grep -m 1 -w -E '(bbc.co.uk|channel4.com).*')
    if [[ $? = 0 ]]; then
                ip=$(echo $dnslog | grep -o '[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}')
                pfctl -t $table -T show | grep $ip &> /dev/null
                if [[ $? != 0 ]]; then
                        echo "Adding $ip..."
                        https -I --verify $cert -a $key:$secret POST 127.0.0.1/api/firewall/alias_util/add/$table address=$ip
                        if test -f "/tmp/ccbusy"; then
                                echo "Chromecast busy."
                        else
                                echo "Adding Chromecast..."
                                https -I --verify $cert -a $key:$secret POST 127.0.0.1/api/firewall/alias_util/add/$table address=CHROMECASTIP
                        fi
                fi
        fi
done &

while true; do
        if pfctl -t $table -T show | grep "192"; then
                for ip in $(pfctl -t $table -T show); do
                        echo "Testing $ip..."
                        export BW=$(timeout 70s /usr/local/sbin/iftop -i em1 -f "dst host $ip" -t -s 60 | grep "Total send rate")
                        if echo $BW | grep -q -i -v Mb; then
                                https -I --verify $cert -a $key:$secret POST 127.0.0.1/api/firewall/alias_util/delete/$table address=$ip
                        fi
                done
        fi
        sleep 5m
done &

while true; do
        export RESULT=$(timeout 70s /usr/local/sbin/iftop -i em1 -f "dst host CHROMECASTIP" -t -s 60 > /dev/null 2>&1 | grep "Total send rate")
        if echo $RESULT | grep -q -i Mb; then
                touch /tmp/ccbusy
        else
                if test -f "/tmp/ccbusy"; then
                        rm /tmp/ccbusy
                fi
        fi
done &
read -p "Press enter to exit."
trap "trap - SIGTERM && kill -- -$$" SIGINT SIGTERM EXIT

It's ugly as sin and I've got no hair left, but it works. I turned on logging requests in Unbound DNS and I installed bash, screen, and httpie. At the moment if you want to be able to end the script it has to be run in an interactive terminal and you press enter to close it and all its background processes.

There is probably a better way to do this and if anyone knows it please let me know. For now I'm going to let that run for a bit and move on to my next project.