Not a bad choice, IPcop started as a fork project from Smoothwall-UK (it has grown since) but I worry about accountability, since SW has a corporate product along with certifications for use in schools in the UK.
As an independent project, IPcop can raise flags, since funding comes from nowhere and there's none to report to for success or failure. I have used it before, but since 2004 I've seen stagnation periods on the project for periods of 6-9 months (possible shifts or disinterest at the helm?). Also worthy of note is that since 2004, it's been stuck at version 1.4 - I will surely try it again when version 2.0 reaches RC status.
------
Without knowing how many stations you are "trying to guide into healthy web usage".. It's hard to say any hardware platform will do (but more RAM is always better). However, to avoid employee animosity, there are some worthwhile pointers:
1) After installing the filter, watch the filter log frequently for the first week and white-list domains that are required for LOB. Some staff may accept the new prohibition and say nothing - they'll just start working shorter hours and take work home where they can get open access (while grumbling about the dictator they work for) :-)
2) There may also be staff willing to quit a job taking a position elsewhere, just "to have their freedom" (for the most-part for this lot, I'd even smile, open the door and wave goodbye..), but these may also hold some special keys to your success.
3) Even after you have watched the filter logs for a while, continue and make a way for users to get sites white-listed (drop-box, email, post-it notes, whatever..)
4) Your original post seemed to focus on IM and not general browsing; so in keeping with that, close all outbound ports except those that are required. Many IM clients will scan up and down port lists to find a way out, when they fail, they will resort to using the gateway-filter on port-80. But if your aim is to stop IM, then Google for IP-drop ranges related to MSN, LIVE, Yahoo, etc..)
5) If required, install another non-proxy'ed NIC and sub-net as some equipment will not operate through a proxy. Inline Proxy's are easy to detect, and some POS and card-swipe devices will not operate due to security concerns. (ask the vendor about port usage, you may be able to open specific ports..)
6) URL-filter uses the term "number of filter processes" - this is really the number of squidGuard redirector processes that listen to URL requests. This is a number to watch on filters with less RAM - too high, and the filter runs slow - too low and user frustration goes up as they watch half pages or timeouts. Today's web browsers pipeline requests and blast up to 6 requests (per domain) at a time - that's why big sites have several domains and sub-domains. If you have enough RAM for the filter, jump this number to 16 or more, but over time, make sure RAM usage never goes beyond 98%. (Linux likes to use all RAM for performance, but beyond that, the SWAP partition will slow things down)
Drop back and note any problems. (IPcop, Endian, IPfire, Smoothwall etc.. they're all quite similar and you'll find aficionados everywhere.) If you have more than a few users, the filter project can take many months to iron-out the creases. Get someone everyday to export the filter-log to see where user frustration may be. (especially if you use a big filter list like the huge one from www.urlblacklist.com )
If you want to see other firewall distro's, you could check here:
http://distrowatch.com/search.php?category=Firewall
