Manual Restrictions

Restrictions

Location: Firewall → Restrictions

Time- and device-based access control: block (or specifically allow) internet access for chosen devices, at chosen times, to chosen destinations. The page has two matching panels — Access Restrictions (things you block) and Exceptions / White List (things you specifically allow, overriding a restriction rule that would otherwise apply).

Who a rule applies to

Every rule (restriction or exception) starts the same way:

• IP Family — IPv4, IPv6, or both.
• Rule Applies To — All Hosts, All Hosts Except (a list), Only The Following Hosts (a list), or Device Group — this last option targets a group you named on the DHCP / Known Devices page, so you can manage group membership in one place and reuse it here. Host lists accept an IP, an IP range, or a MAC address.

Schedule

Rules can run All Day/Every Day, or on a schedule that repeats Daily or Weekly. Daily schedules use an "Hours Active" field (e.g. 00:30-13:15, 14:00-15:00); weekly schedules combine day checkboxes with a "Days And Hours Active" field (e.g. Mon 00:30 - Thu 13:15, Fri 14:00 - Fri 15:00) for schedules that don't fit neatly into simple per-day hours.

What gets restricted (or permitted)

Either block/allow all network access outright, or get granular with any combination of:

• Remote IP(s) / Remote Port(s) / Local Port(s)
• Transport Protocol — Block All / Block TCP / Block UDP
• Application Protocol — a built-in list covering common protocols: BitTorrent, DNS, FTP, HTTP (and HTTP Audio/Video separately), IMAP/POP3/SMTP, IRC, Jabber, Skype (calls and to-Skype separately), SSH, SSL, VNC, VoIP Audio, and more.
• Website URL(s) — with a match-type selector: full URL exact match, full URL contains, full URL regex, domain exact match, domain contains, or domain regex.

Each of these (remote IP, remote port, local port, application protocol, URL) has its own three-way mode: Block All / Block Only (a list) / Block All Except (a list) — on the Exceptions side these read as Permit All / Permit Only / Permit All Except instead, but work the same way.

How restrictions and exceptions interact

Exceptions act as a whitelist layer evaluated against your restriction rules — traffic or hosts matched by an exception bypass the restriction that would otherwise block them. This is how you do things like "block social media for the kids' devices all week, except allow it 6-8pm on weekends": one restriction rule for the broad block, one exception rule narrowing out the permitted window.

Practical example: block internet for a device group overnight

1. On DHCP / Known Devices, tag the relevant devices with Group kids.
2. Add a new Restriction: Rule Applies To → Device Group → kids.
3. Schedule: Weekly, Days Active = every day, Hours Active = 22:00-07:00.
4. Restricted Resources: All Network Access.
5. Save. Any device tagged kids loses internet access during those hours automatically, with no per-device rules to maintain as you add or remove devices from the group.

See also

• DHCP / Known Devices — where Device Groups are defined
• Quotas — the other feature that can target a Device Group