I want to forbid a device on my network from accessing the internet.
Computers still have to communicate with the device, and vice versa.
OpenWrt Attitude Adjustment 12.09
Add a firewall rule. In Luci web interface this is Network->Firewall->Traffic Rules->New Forward Rule. Match the forbidden computer, then set the Action at the end to REJECT.
You could actually match the MAC address directly. However I would suggest using a layer of indirection :). Match an IP address, and assign that IP address to the MAC of the computer in question.
To assign a fixed IP to the MAC address, in Luci web interface you can use Network->DHCP->Static Leases->Add
Note that if the device is malicious, it can still change it's MAC address very easily and bypass this. In that case you need to connect the device to a firewalled ethernet port. Basically, this is possible if you have working VLAN support on the switch the device is plugged in to. OpenWrt has VLAN support on the internal switches of some routers.