So, I have some experience with this. I used it for my parents who wanted to restrict what kind of content my (then child-age) brother had access to.
Here's a big idea you're going to have to contend with: Where there's a will, there's a way. If he *really* wants to look at porn, he's going to. Period. There are *always* going to be proxies, anonymizers, tunnels, VPNs, etc., that will redirect his traffic if he's so inclined. Does he have an iPhone? Or cell-connected tablet or computer? Does he have a computer in his room? Or some other "private" space? Absolutely nothing will beat having the device(s) he's going to use in a public place under your direct supervision. I speak from experience. Trust me.
All that said -- OpenDNS was my tool of choice for doing so. As mentioned higher up, I have a router in place btw. the modem and computer. I changed the DNS entries on the router to 208.67.222.222 & 208.67.220.220. I registered a free account with OpenDNS, downloaded their "updater" and installed it on the family computers, and sync'd everything. I then went through the filters OpenDNS provides and selected the things I wanted to block:
* Fraud
* Gambling
* Portals
* Parked Domains
* Proxy/Anonymizer
* Web Spam
* Adware
* Lingerie/Bikini
*P2P/File Sharing
* Adult Themes
* Hate/Discrimination
* Tasteless
* Nudity
* Pornography
(I know, I know... if you exclude these categories, what's left?! These were my parents pics.)
Even with what I felt was an all-encompassing filter list, there were still things that got through. There were also sites that were incorrectly categorized and blocked. In those cases, I whitelisted/blacklisted as needed. It wasn't perfect, but it worked well-enough to where my little brother had to try harder & smarter to view blocked content. Ultimately, I think he ended up watching porn at a friend's house. Once he got a smartphone, the effort was wasted since LTE gives him whatever he wants and there's very little I can do about it (without a lot of cost/time/hands-on involved).
Hope this helps.