I’ve had the raspberry-pi connected to the router for a while now. It has a reserved IP address on the local network (configurable via a router). Crucially a service called Pi-hole is installed on it.

Every device on the local network is configured to use the custom DNS - with a previously mentioned reserved IP address. This way, Pi-hole can filter every DNS lookup and block those from responding if they match an entry in a black-list.

The ordinary black-list is excellent, but you want a bit more protection for the kids’ devices. One thing you can do is to set the upstream DNS service on Pi-hole to point to one of the “family” DNS, like 1.1.1.3 provided by Cloudflare. Then add more domains to the black-list. I chose the list from StevenBlack’s Github account github.com/StevenBlack/hosts/tree/master/alternates/fakenews-gambling-porn-social.