I tried this approach, but there is an issue. If I apply a firewall rule that looks like this: # |  Policy | Protocol |  Destination      | Port     | Comment 1 |  Allow  |     Any    | 192.168.0.0/16 | Any      | Allow Local Access 2 |  Deny  |     Any    |         Any           | Any      | Block Internet   The Issue is that, it works only I apply it after the tablets have already joined the network and haven't changed AP. As soon as the devices change AP or get disconnected from the network, they cannot connect back.   (The error message on android is: "Failed to obtain IP address" and I have tried to add our local dhcp server's address as the first rule, but it still doesn't work). ... View more