i cant make a video.
just add it on trafic rules below.
protocol: any
sourcezone:(Your Wifi SSID)
destination zone: device
action: reject
SourceMac: (all my wifi users I put the mac address here)
note: if you do the config above the parental control will not work. but the benifits is any hacker in your wifi can scan open ports but it cannot send any commands on it, the dnsmasq openport 53,80,443 is afe now
and if you want to blocked arp-spoofing, denial of service attack or any attack that used ICMP just add this in trafic rules below.
protocol: ICMP
sourceZone:(Your wifi name or any interface name)
DestinationZone:Devices
Action:Reject
you can blocked icmp, tcp, udp in WAN just copy the config above and replace protocol to ANY
and its work fine.(Only for WAN)
Note: you can blocked all icmp by default in all of your interface example: WAN, GUESTWIFI,Openwrt Wifi etc