I have at home an old computer with OpenSUSE 15.4 that shares the Internet.
Two network cards and a wifi card.
eth0 - looks at the Internet.
eth1 and wlan0 are combined into a bridge - br0 - and look into the home network. br0 has a static address 192.168.0.254.
All this is configured in the Wicked service.
Firewalld has masquerade enabled. hostapd distributes the Internet via wifi. dnsmasq assigns addresses to home devices.
How can I restrict access to some websites for some time for some home devices? IP and MAC are known for all home devices.
For example, I need to block access to youtube.com from Monday to Friday from 08:00 to 17:00 for a gadget.
Block direct access to internet, configure your clients to use proxy to access web sites, configure proxy to restrict access. E.g. squid supports. This works for reasonably small number of sites that need restriction.
Note that it is relatively easy to bypass using public proxies or VPN, so it depends on overall security of your clients. If users have administrative privileges, they can do quite a lot to bypass restrictions.