For filtering specific things squid will do it plus give you some caching to boot.  By specific things I mean you can use it to block certain domains or content types. There are blacklists out there for advertising domains and the like that you can plug and play. We’ve done this in the past with staff IPs which actually made a rather large difference in bandwidth and CPU/Mem since a lot of advertisements can be flash or heavier based.

For content filtering (porn, gambling, etc) an open-source option is Dansguardian which we offer to patrons here. Default install has some basic keywords defined which work fine and you can tweak as needed. We just use the default config as we offer both filtered and unfiltered to patrons so don’t care as much what gets through compared to those with requirements. Dansguardian can also put traffic out through squid to get cacheing as well. 2.8.x.x+ support user groups though I haven’t used that feature.

http://dansguardian.org/

Both of the above work as transparent proxies and you can either use a router level redirect (iptables, etc) or set it up in the browser as a proxy.

Eby