Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to forbid a device on my network from accessing the internet.
Computers still have to communicate with the device, and vice versa.

OpenWRT version: OpenWrt Attitude Adjustment 12.09

share|improve this question
Feel free to edit the title if you know better wording, or ask for clarification. – Shiki Jun 13 '13 at 17:18
up vote 1 down vote accepted

Add a firewall rule. In Luci web interface this is Network->Firewall->Traffic Rules->New Forward Rule. Match the forbidden computer, then set the Action at the end to REJECT.

You could actually match the MAC address directly. However I would suggest using a layer of indirection :). Match an IP address, and assign that IP address to the MAC of the computer in question.

To assign a fixed IP to the MAC address, in Luci web interface you can use Network->DHCP->Static Leases->Add

Note that if the device is malicious, it can still change it's MAC address very easily and bypass this. In that case you need to connect the device to a firewalled ethernet port. Basically, this is possible if you have working VLAN support on the switch the device is plugged in to. OpenWrt has VLAN support on the internal switches of some routers.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.