Blocking all external traffic and allowing only internal traffic through we are trying to use Android tablets in a production environment however we only want the users to be able to connect to internal ip addresses and block all external to lock them out of doing things they should not, we cant achieve this via the network or routers it needs to be be on the tablet that's blocking the external traffic, how can we achieve this ?
What Dan Hulme said is possibly the best advise for a solution IMO. Anyhow, if you can afford to root the device, then go ahead and do it, and install SuperSU, Busybox and AFwall+. AFwall+ is a firewall which requires some binaries available via former app.


Launch SuperSU and create a PIN/password in the Settings. This might require Pro version. -- this is a superuser application. It must be protected from any unauthorized access because it grants root access to apps.
Launch Busybox and follow the instructions there to install the binaries.
Launch AFwall+, and:

Tap three vertical dots next to lens icon and choose Enable Firewall.
In the same section go to Set password and select a password for your firewall.
In the same section go to Preferences and check Device Admin to make AFwall+ your device's administrator -- this will prevent a user from disabling or force-stopping the app. Fiddle with other settings which would meet your disabling external network access requirement.
Install Applock and disable Install/Uninstall, Settings, Play Store, etc. that you think users shouldn't access.
Use a launcher like Smart Launcher which allows hiding app icon.
You can use Helium to make and restore app backups along all other devices.



The instructions should be enough to keep normal users at bay. There are workaround for every step here if the user is bit clever so I suggest to install a tracking program to keep an eye on suspects. :)