If all you’re after is the best porn filtering, you might look into a paid DNS filtering service. I’m paying cleanbrowsing.org $5/month and their filtering has been way better than anything I could get working locally in IPFire. The IPFire devs will tell you that a filtering DNS service is not compatible with IPFire, but it actually works fine for me and takes all the self-management headache away. It’s too easy to find ways around the proxy or find new porn sites that aren’t in Shalla’s blocklist which could make your job much harder as you’d have to manually block those as they slip through. Every review I read of porn filtering options indicated that cleanbrowsing.org had the best porn filtering of any DNS service, and after using them for a little over a week, I’d have to agree. Best, they do not block with an intercepted block page, they simply return a page not found error, which may be why it works so well with IPFire.