I run squid on a linix box. That will let you ban sites at will. You can even set levels of access, for example, facebook.com will work for you, but not the kiddies.
I also run bind for a DNS resolver, simply because my provider's DNS is slow.
This and a decent iptables firewall and you're good to go.
ARS