Maybe a "proxy.pac" file or "wpad.dat" would be an option. (create one in the usr/local/www folder and make a symb-link for the other)
There are topics on how to serve this pac-file via extra http-service on port 80 in combination with DHCP and have the pfsense GUI run on https.
How successful it will be that depends on how you roll out DCHP (additional option 252, text, location of proxy.pac) and if users are allowed to change their internet settings regarding proxy settings.
You filter https or facebook requests to be redirected to a "denied page".
Example "proxy.pac"
function FindProxyForURL(url, host) {
url = url.toLowerCase();
host = host.toLowerCase();
isHttp = (url.substring(0,5) == "http:");
isHttps = (url.substring(0,6) == "https:")
// If the requested website is hosted within the internal network, send direct.
if (isPlainHostName(host) ||
shExpMatch(host, "*.home") ||
shExpMatch(host, "*.local") ||
isInNet(dnsResolve(host), "10.0.0.0", "255.0.0.0") ||
isInNet(dnsResolve(host), "172.16.0.0", "255.240.0.0") ||
isInNet(dnsResolve(host), "192.168.0.0", "255.255.0.0") ||
isInNet(dnsResolve(host), "127.0.0.0", "255.255.255.0"))
{ return "DIRECT"; }
// Forward non-http(s) and some hosts to forward proxy (or DIRECT (or access denied page?))
if((!isHttp && !isHttps) // Skip all non http(s)
|| dnsDomainIs(host, "microsoft.com")
|| dnsDomainIs(host, "windowsupdate.com")
|| dnsDomainIs(host, "eset.com")
|| dnsDomainIs(host, "mcafee.com") // McAfee
|| dnsDomainIs(host, "siteadvisor.com") // McAfee
|| dnsDomainIs(host, "hackerwatch.com") // McAfee
|| dnsDomainIs(host, "hackerwatch.org") // McAfee
|| dnsDomainIs(host, "avg.com")
|| dnsDomainIs(host, "grisoft.cz")
|| dnsDomainIs(host, "avgfree.com")
|| dnsDomainIs(host, "avg.cz")
|| dnsDomainIs(host, "symantecliveupdate.com")
|| dnsDomainIs(host, "thawte.com"))
{ return "DIRECT"; }
if (isHttps)
// Skip HTTPS (or return access denied page?)
{ return "DIRECT"; }
// Otherwise, go through our proxy or if it fails, through bypass
return "PROXY 192.168.0.1:3128; DIRECT";
}
Or you could try a squidguard filter with a redirect page, maybe add a "proxy-list" and "VPN-service-list" to the block list there so users won't be able to use or search for anonimous-proxy or VPN's to circumvent the restrictions.
