it took me 3 years to figure out(as one of my kids kept finding ways to bypass it, who was a game addict, that forced me to improve the design), it's a combination of different approaches to make the whole thing work at low cost, my kids said it is much more 'clean' comparing to their school wifi network, where they can bypass easily with some free VPN software and proxy server, and kids exchange their findings, so campus-network to them is pretty much fully open.