config.gateway.json exempting group from DNAT

{
       "service": {
                "nat": {
                        "rule": {
                               "1": {
                                       "description": "Redirect Non-Exempt Outbound DNS to USG",
                                       "destination": {
                                               "port": "53",
                                               "address": "!YOUR_PIHOLE_IP"
                                       },
                                       "source": {
                                               "group": {
                                                       "address-group": "!GROUP_YOUR_PIHOLE_IP_AND_CHROMEBOOK"
                                               }
                                       },
                                       "inside-address": {
                                               "address": "YOUR_PIHOLE_IP"
                                       },
                                       "inbound-interface": "eth1",
                                       "protocol": "tcp_udp",
                                       "type": "destination",
                                       "log": "enable"
                               },
                               "5002": {
                                       "description": "Masquerade Inbound DNS for Pihole",
                                       "destination": {
                                               "address": "YOUR_PIHOLE_IP",
                                               "port": "53"
                                       },
                                       "outbound-interface": "eth1",
                                       "protocol": "tcp_udp",
                                       "type": "masquerade"
                               }
                       }
               }
       }
}