Restrict Access to wifi for certain devices

Please read this carefully and have another device with internet access, in case you are locking yourself out.

In OS X you will use the OpenBSD based tool pf which stands for "packet filter".

• Helpful man pages are man pfctl and man pf.conf

• You need sudo access.

Edit /etc/pf.conf to your desired needings:
An example pf.conf would be simple as this and look like this

## blocking rule
block out user guest

Now activate pfctl with sudo pfctl -e and load your config with
sudo pfctl -f /etc/pf.conf.

For checking the syntax of the config file you can use pfctl -nf /etc/pf.conf.
If you want to deactivate the firewall, pass the command pfctl -d.

Testing the new configuration is as simple as curl -I apple.stackexchange.com. The firewall should block this for you.

However, I'd be careful with restrictions. If you are losing your Mac or it gets stolen, the guest account is the only account which one will be has access too(hopefully) which in return should have access to the internet to track it down(if "Find My Mac" is enabled).

It seems there is no way to force a client ID at the router end, so you have to make do with setting it right on the client. I discovered that my Apple TV and Playstation has spaces in the names that prevented them from setting the ID properly. Taking the spaces out made them show up properly. However, some clients manage to register names correctly with spaces, so I guess it's down to the implementation of the IP stack on the client device rather than a server issue.

It's also worth noting that after updating settings or resetting the routers, it appears to show just MACs until it has time at some point doing a lookup against it to set the ID. I found no way of working out how long this is, seems to be random.

It's also worth noting that some devices that are able to use Wake On LAN over wifi and that are currently in a sleep state will register at a Physical layer, so the router is able to send the relevant command to wake it, and as such the MAC is shown, but no IP (and hence no active DHCP use to pull the ID) until the device wakes and pulls it's IP/registers it's client ID.

Finally, using an old version (5.6.1) of Airport Utility it is possible to view a DHCP lease list of all clients, not just active wireless connections. Sadly it doesn't work on Mavericks, but you can bodge it to make it work. Unfortunately, either it does not track the DHCP leases for the guest network, or the lease length (not configurable) is short so pretty much only actively connected guests are shown in this list.