How can I configure a router to limit a computer to local network and block its incoming or outgoing WAN access? What kind of settings I should look into?
I am using Tomato firmware.
Check the Parental Controls.
I'm not familiar with Tomato settings but many firmwares will let you control and/or meter the internet access using parental controls.
You should be able use the machines IP or MAC address to restrict its access.
I can block access completely or allow it on a schedule with my Asus router.
A simpler way is to use the Access Restriction menu, make a rule for specific Ethernet interface with disabled internet access.
Here's a video tutorial http://www.polarcloud.com/v/screst.htm