going back to opendns, this works well for a cheap solution, the only negative thing about it is the latency it introduces to browsing the web, its not as fast as using xtras dns servers.  I have set this up at a school boarding hostel, locked the dns servers to open dns's servers in kerio winroute (their proxy server), and then configured opendns to block access to proxy sites, porn, etc etc. It works well and so far in the year its been running no one has bypassed it.
Ive also added opendns.org to the routers url block list, so instead of an opendns block message they get a generic block from the router, thus not giving away how they are being blocked.