Is it possible for an application to allow wifi connections only on the local network?

Question

Computer networks

There is a computer that is an access point for several devices (phone, tablet, etc.). These devices are connected through this access point on the computer only to each other and do not have access to the Internet (something like a home wifi network).
The computer itself has access to the Internet via wifi through a router.

It is necessary to make sure that the application on the computer can only use wifi on the local network, that is, connect to other devices via wifi through an access point, which is the computer itself. In this case, the application should not have access to the Internet through the router.

There have been attempts to do this using a firewall, but when the application is denied access to the Internet, the firewall also denies the local wifi connection.

1) Are there ways to set up a network as described above?

2) Are there any firewalls that can allow an application to use local wifi, but at the same time deny access to the Internet? If yes, what are they?

Answer 1

The Linux firewall can limit traffic by process ID (the criterion only works in the OUTPUT chain and not for any traffic):

iptables -A OUTPUT -p TCP -m owner --pid-owner $PID -j REJECT --reject-with tcp-reset

More
The Linux kernel has the Namespace technology, which, in particular, allows you to isolate an application in a separate Network namespace and direct traffic from it to a specific interface.
Example: Isolate an application with an IP address from another VPN...

Answer 2

in the firewall you need to create a couple of rules - allow a range of local network rules and prohibit everything else