Provided is a controller for configuring network devices at different network locations with rules that prevent different sets of clients from accessing specific network resources. The controller may receive a request with an identifier of a first resource from a particular network point of access. The controller may identify one or more network devices (e.g., wireless access point, router, switch, firewall, gateway, etc.) that are in the network path between the particular network point of access and the first resource. The controller may select a particular network device in the network path, may establish a connection to the particular network device, and may configure the particular network device with a rule that prevents access to the first resource from the particular network point of access, while permitting access to other resources from the particular network point of access.