Pfsense comes to mind. All solutions will need to be trusted as a root CA, by all devices routed through them, to filter URL patterns. No CA trust needed to do DNS or TLS setup filtering, but those options can only filter the hostname.
Netgate 1100 is a good starting point device.
This also refers to the Squid and SquidGuard for URL/URI filtering, as the other commenter mentioned.
https://docs.netgate.com/pfsense/en/latest/recipes/http-clie...