Click Isolate on a device and it has no internet for 10 minutes, or for the time you choose. Use it for a child's tablet at homework time, a TV that should stop streaming, or a computer that behaves strangely. The device keeps working on your own network: it keeps its address, reaches printers, file shares and other local devices, and the firewall itself. When the time is up, the internet comes back by itself.

Isolating is not a configuration change: it needs no commit, does not touch pending changes, and works at once. Every isolation is written to the audit log with who did it and why. Superuser, administrator and operator accounts can isolate devices; auditors and read-only accounts see the list.

At a glance:

What	Where
Isolate a device, or extend its isolation	Network › DHCP server › Leases › Isolate (or Extend)
See who is isolated, time left, end early	Network › DHCP server › Isolated devices › End now
The same on the command line	`isolate`, `show isolated`, `release`

Step 1: Isolate a device

Open Network › DHCP server and scroll to Leases. Every device that got its address from the firewall is listed, with an Isolate button.

The leases: kids-tablet is isolated (no internet, 27 minutes left); the others have an Isolate button

Press Isolate on the device. Choose 5, 10, 30 or 60 minutes, or type any number of minutes up to 1,440 (24 hours). The default is 10 minutes. A reason is optional and shows in the list and the audit log. Press Isolate for … min.

The Isolate panel: 30 minutes, reason "bedtime"

Within a second the device has no internet. Its lease shows no internet and the time left, and its button becomes Extend: isolating it again sets a new end time, counted from now.

Step 2: Watch it and end it early

Isolated devices, above the leases, lists every device without internet: the device, its MAC address, until when, the time left, who isolated it and why. End now gives the internet back at once. Recent shows the isolations of the last 30 days.

Isolated devices: kids-tablet, 25 minutes left, End now

On the command line

The same works over SSH or on the console (see the Command line guide):

isolate 192.168.2.62 minutes 30 reason "homework"
show isolated
release 3c:2a:f4:11:22:33

isolate takes the device's address (the firewall looks up its MAC) or its MAC address.

What exactly happens

The device is identified by its MAC address, so all its IPv4 and IPv6 addresses are covered, also when they change.
Blocked: everything the device sends out to the internet: through the internet ports, and through VPN tunnels the firewall keeps to providers (NordVPN, IPVanish and the like). Connections it already had stop too. Requests the firewall would redirect to itself on the way out (DNS to an outside server, the transparent web proxy) are dropped as well.
Not blocked: your local networks (LAN, Wi-Fi, other internal zones), and the firewall itself: DHCP, DNS answered by the firewall, the web console.
The time runs in the firewall's kernel: the isolation ends on time even during an update. A commit, a restart or an update keeps running isolations with the time they have left.
The firewall refuses to isolate itself and its failover partner. You can isolate the device you are using: it loses only the internet, not the console.

Limits

Failover pair: isolations are kept on the firewall where you made them. If the other firewall takes over, the device has internet again. Isolations last minutes, so this rarely matters.
Relaying devices: a device can still reach the internet through another device on your network that relays for it (a proxy or VPN server on the LAN), because the firewall only sees local traffic between the two.
For every night or a fixed time, use a schedule instead: see the guide "Block YouTube or the internet for chosen devices on a schedule".