Is it possible to restrict individual devices connected to a home router from communicating outside the local network?

Question

I have a device which I don't want to have any communication with the outside world sans any initial updates/etc (say, an IoT device that would otherwise phone home). I would still like to be able to communicate with it from local devices on my home network (e.g. mobile phone / desktop) which do have access to the outside world. Assume that anything that it connects to (e.g. a mobile app on the phone) is already locked down / safe -- I am scoping this question to just the target device itself. What would be the minimum configuration required to do this?

Traditionally most concerns of this nature are out of concern for compromised devices, so higher risk devices might be put on a separate VLAN. My concerns are strictly privacy related, and communication between devices on the same network is desired for convenience.

Answer 1

After you allow the device to update itself, then you can do the following:

• assign to it a static private IP so that the network configuration is easier. If the device gets assigned a new local (private) IP every time it connects to the network then the configuration needs to be adjusted, which may be annoying
• configure your router firewall to block this IP from connecting to the outside world, but allow it to connect to the rest of the private IPs of the network

In case that your home router does not have this capability (firewall), then you could add an intermediate box between your devide and your router that will do the blocking. So the network setup will look something like this:

  -------- printer
 |
 |  -------- laptop
 | |
router
   |
    ---- firewall ---- IoT device

The intermediate device (firewall) will block any connection attempt made by your device to the internet, but will allow all traffic inside your LAN.

Answer 2

Configure the firewall on the router in a way that it can only connect to private IP addresses and not the public internet. Or use a DNS filter.

Answer 3

Most SOHO routers have controls to do this, sometimes they're buried as parental controls. In every case I've seen, the device MAC address is used to block it from internet access.