To state the obvious:
A device based filter is needed if the device will access the web through an unfiltered connection.
An ISP (or at least router) based filter is needed if any unfiltered device will access that connection/router.
In many cases, both will be needed (be careful, though they are not always compatible).
No filter is 100% foolproof which is why it’s better to have no access where feasible, and one reason why nobody ever claimed that filters, or even lack of access, is a substitute for yiras shomayim and proper chinuch. They can be, however, an effective compliment.