pfsense: how to block internet for one client

Question

I Have a network at home with a PFSense Software firewall. There are about 2 pcs and 3 laptops that connect to the internet through this firewall. I would like to use the Firewall rules to block internet access for one of these devices on the network. The one that I want to block does have a static IP address assigned, and I also know its MAC address. I just cant seem to be able to figure out how to create a rule that will effectively block internet access for that one device. But I still want that device to be able to access the network internally, such as network printers shared drives etc...

Answer 1

Add a LAN Firewall rule to block the IP of the guy by going to Firewall -> Rules -> LAN:

And be sure your rule is before the default "allow everyone" rule; since rules are processed top down, in order, until it finds one that matches.

Answer 2

Not a pfsense person, but the actual PF rules you need are as follows.

block in on <internal interface> from <static ip> to any
pass in on <internal interface> from <static ip> to <internal network>
pass out on <internal interface> from <static ip> to <internal network>

Answer 3

Go to the Firewall->Rules Page and click on the LAN-Tab. Add a new rule at the top with the following settings:

Action: Block
Protocol: Any
Source: Single Host or Alias | <IP-Adress>

Please keep in mind, that this will block a single IP-Adress. So if the IP of the Host is changed, it can access the Internet again.

Answer 4

have you found a resolution? I'd suggest checking if you installed the Squid package, by default it allows everyone on the LAN interface to access the web, regardless of firewall rules. A bit annoying actually