There's a reason this won't work: It requires the router to hijack a http (tcp) connection. By the time we know where a http connection is going we've already seen a few packets (syn/ack). You'd need to redirect the connection in progress which is really ugly.
The web filtering in access restrictions is useful... but the way I'm doing it has distinct disadvantages. Filtering by controling DNS is better because it allows you to redirect someone easily (just give them the wrong IP). It will also work a lot better if the connection is a https connection (right now, the current implementation does not filter those). I implemented it the way I did, by matching the content of http request packets, since that is the way both DD-WRT and Tomato do it, but now that I've had some experience with this feature I think blocking by DNS would be better.
It may be possible to redo the way I'm filtering websites by re-writing DNS rules, though this means you can only match domain and not the path (though 99% of the time we just care about the domain anyway...). However, this would allow an error message as you suggest. Also note that using DNS filtering like this will only work for filtering web sites -- if you match by IP/ layer 7 etc this won't work and you'll still just get a blank error page in your browser.
Finally, don't expect this any time soon. Doing this by matching DNS queries instead of http queries requires yet another new iptables module (that would make
four new modules, unique to Gargoyle), not to mention some reworking of the access restrictions. Let's just say it's on my to-do list (which is quickly approaching the length of my arm...)
However.... I just finished implementing a feature much like what you're requesting for the bandwidth quotas. It's easier for the quotas, because it can get away with redirecting only new http connections after the quota is reached -- it doesn't have to redirect connections that are already established. In the latest SVN version (no firmware uploaded yet), if you reach your bandwidth quota and try to connect via http/https, instead of the connection just dying it redirects you to the login/quota usage page on the router. That way, there's no doubt about why you're not seeing the page you want
).
