Messages

The other way to do this is to use a deny all rule then whitelist the devices that you need to access the Internet.  This gets away from the changing mac address that mobile devices use to  "protect your privacy".

Of course if he learns to spoof an mac address with a whitelisted device!