I've used IPCop, a Linux firewall distro, and DansGuardian for a while and it worked great. I install it off the modem and before the router or switch. This way ALL traffic regardless of whether it is from a laptop or a desktop, is filtered.

IPCop uses a web interface (internal only) to configure and includes a set of pages for configuring DansGuardian, making it very easy to use.

Setting it up this way, it doesn't rely on the individual operating systems to filter, easily bypassed with a LiveUSB or LiveCD, and will cover people bringing in their own devices.

Highly recommend it.