Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I Have a network at home with a PFSense Software firewall. There are about 2 pcs and 3 laptops that connect to the internet through this firewall. I would like to use the Firewall rules to block internet access for one of these devices on the network. The one that I want to block does have a static IP address assigned, and I also know its MAC address. I just cant seem to be able to figure out how to create a rule that will effectively block internet access for that one device. But I still want that device to be able to access the network internally, such as network printers shared drives etc.

share|improve this question

migrated from Sep 15 '09 at 7:39

This question came from our site for computer enthusiasts and power users.

can you provide us a sample rule template ? – Revolter Sep 15 '09 at 4:30
up vote 5 down vote accepted

Add a LAN Firewall rule to block the IP of the guy by going to Firewall -> Rules -> LAN:

alt text

And be sure your rule is before the default "allow everyone" rule; since rules are processed top down, in order, until it finds one that matches.

share|improve this answer

Not a pfsense person, but the actual PF rules you need are as follows.

block in on <internal interface> from <static ip> to any
pass in on <internal interface> from <static ip> to <internal network>
pass out on <internal interface> from <static ip> to <internal network>
share|improve this answer

Go to the Firewall->Rules Page and click on the LAN-Tab. Add a new rule at the top with the following settings:

Action: Block
Protocol: Any
Source: Single Host or Alias | <IP-Adress>

Please keep in mind, that this will block a single IP-Adress. So if the IP of the Host is changed, it can access the Internet again.

share|improve this answer
Hi bico. I have tried this, but for some reason that host is still able to access the internet. I verified the IP did not change because it is assigned by Mac Address so it never changes. That is the reason I resorted to posting this question here. – 7wp Sep 15 '09 at 22:52

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.