Kernel module for web filtering2

We are looking to do web filtering by URL, have already written a proxy server to do the filtering. We need to run the filter locally, therefore traffic must be allowed for the proxy server but disallowed for everything else on specified ports. We propose a kernel module to block traffic on a per application basis, with the ability to block all traffic except from the proxy server. It must not be possible to bypass this as an unprivilidged user, and it must be possible to enable or disable the block on specific ports from userspace. Other implementation ideas welcomed, ipfw seems to be too buggy (lock reversal with uid matching). Full source to be provided, with IPR ownership transferred to us. This is a small module of a much larger project, we may be interested in contracting for further work based on the outcome of this module.