And this is why I'm going to route all my kids traffic through an offshore VPN by default and whitelist low latency stuff.
One that goes through the ISP and one that goes out over a proxy.
I haven't found a solution just yet. I guess a raspberry pi with iptables and routing based on device ID could do the trick too.
I run two tinyproxy instances on my home server and I point all browser traffic to the first instance. The first instance run with the default routing table on port 8888 and has entries like upstream localhost:8889 ".somesite.com" the second instance, which run on port 8889 is run with the vpn as default route (I use setfib under FreeBSD).
With this setup, traffic goes by default directly on the net, but the tinyproxy config file can be used to redirect some traffic through the VPN.
Of course, you can do it the other way around to have traffic by default on the VPN and direct some traffic.
If you want to route all traffic to a vpn for a specific machine, you can use pf rules to forward an ip through another routing table.
There are a couple of other things on my todo list still. Such as easier switching of VPN node (current method is to ssh in and restart OpenVPN with a new config...) and ad blocking.
Hope this can help you although it's still a bit immature and quite hacky IMO
I considers using a raspberry pi, but I'm not sure the range is ideal.