Routing information! Basically set up the DHCP for their device as an assigned IP address by the MAC address and then set their Gateway (Default Route) to some bogus IP like 127.0.0.1 and then force it to update. Bam! Unless they're now how to TCP/IP, and most non-nerdy children won't be able to go anywhere outside of the sub-net mask.
I routinely just remotely lock the tablets of my small children instead of pry them away - less drama that way...
wouldn't work with an older child though as they'd know what I'm doing
that said, when the time comes, I'll probably still have the same type of openwrt router and will just put some rule in there...
No rules needed! Just push down bad routing information to their machine via DHCP!
If Machiavelli were a hacker, he'd have worked for the CSSG. -- Phil Lapsley