I am certainly curious to follow your development regarding this and also happy to help testing and providing feedback.
Hi.
Why not use a proxy like tinyproxy, you configure a wifi only for kids and setup for block no proxyed connections, after that you create the rules for what sites, url or regex you like.
This way you can use the full potential of DNS filtering and you block access for direct ip.
I personally like to use a whitelist approach. more easy to control.
I use this for some coworkers to use only WhatsApp, and QOS to control the bandwidth.
When you face a hard task first think, "KISS - Keep It Simple Stu***"
Unfortunately proxy is mostly limited to HTTP/HTTPS traffic and not supported for many other protocols including the ones used for streaming and peering based on UDP/RTSP/etc.
Yes, i know but if they don't are whitelisted the can't be reached. like i said block all noproxyed connection, and configure only the ports you trust.
For the android cellphones you can use the "AUG Launcher", Wireguard and DNS66.
With AUG Launcher you block the configuration Section and limit the list of program they can access and with Wireguard or DNS66 force the DNS usage and if need you pass all traffic to your router for more filtering.