Under IP > DHCP Server > Leases for a particular client you can check a "Block" option to block access.
It used to be that if I wanted to block internet access for a particular device, I would check that box. Now it doesn't seem to do anything. The only way to block internet access was to create a Firewall rule to drop all packages.

so what was quastion ?

The question is: what is the point of the "Block" option.

The purpose is to create an item on a kind of "MAC address blacklist". If you create a static lease for that MAC address (or client-id) with block-access=yes, DHCP requests from this client will be rejected. If you do that after the client has already received a normal lease, the client's IP address will remain valid until the next renewal attempt from the client (which should come after 1/2 of the lease time expires), and the client will get a reject on the renewal attempt.

Thanks! That makes sense, since it would take a while for the "block" to take effect. I never understood why.