Some notes...
The first network request must be http on port 80. If someone checks e-mail first, or goes to the bank on https, "The Internet is broken."
DNS must resolve inside the network, on on the m0n0wall. If they set up openDNS on there system, "The internet is broken."
Any web proxy must be inside the network, or you must authenticate first. If the proxy is set up before authentication, "The internet is broken."
Pass though mac still must abide by these rules. If you need someone to use another protocol before 80, you must give them a static IP (wich can be done in m0n0wall's dhcp server) and use "pass through IP address" instead of pass throug mac. Or else, "the internet...