[markw10]

I have an Airport Extreme Base Station and am wondering if there's a way I can block certain devices such as a Mac from connecting to this router or using the internet? It's okay if I simply block them from the router but would like the option for it to connect to the router such as using the printer but I want to block the internet. Is this possible?

Thanks

[abbaZaba]

so you want it to have access to local bonjour services (printing, file sharing over the LAN) but no outside Internet capabilities?

[P]

You can block it completely, if you like - just set up MAC filtering (that's MAC for Media Access Control) in the settings, the Access tab. Not sure if you can block just Internet access.

[markw10]

As abbaZaba mentioned I'd like to have it access local service such as printing, file sharing, etc. but no internet capabilities, is this possible?

As for the second response, where is MAC filtering set up. I don't see such an option in the Airport Utility but would this be on the actual computer that I am attempting to block?

[Waragainstsleep]

MAC filtering is also known as Access Control. On mine if you go into manual setup, its the far right tab under "Airport". It may vary a bit from version to version.

Filtering by MAC address will block the machine from joining the wireless network entirely which means no network printing. You might be able to do what you want using some kind of DNS filtering. Have a look at Open DNS and see what can be done with their parental controls.

If that won't cut it, you could look at some kind of web filter product. Some firewalls have this feature but beyond that I wouldn't know how its usually done. Kerio Control has it but thats a pricey box just to block internet for one user.

How savvy is the user of the machine in question? You could dead-end the DNS on the router and set yours up manually with a working DNS server. Easy to bypass for those who know how though.

[abbaZaba]

Could he just enter bogus addresses (127.0.0.1) for the DNS on the specific machine? that way any outside internet addresses would never resolve and he could still use the local network just fine

[Waragainstsleep]

Originally Posted by abbaZaba 

Could he just enter bogus addresses (127.0.0.1) for the DNS on the specific machine? that way any outside internet addresses would never resolve and he could still use the local network just fine

Thats what I meant by dead-ending. Easy to fix for a savvy networker though.

Its worth checking what options you have on your modem. BT Home hubs in the UK have the ability to block the internet at certain times. I assume this could be set to block all the time or just to allow 1 minute at 4am for basically the same result.