I bought a new DIR-628 and immediately updated to the latest firmware which I see might have been a mistake as I can't get Access Control Policies to work using MAC addresses and instead have to use IP addresses. This negates the use of DHCP and I have to assign static IP addresses for the machines against which I want the policy to run (daughter's machine).
Since I did not initially try this with the original FW, I can't say for sure it was due to 1.22.
To be fair, I also bought a new Linksys WRT400N which apparently displays the same issue though slightly different - if I create a policy for ONE machine, it apparently applies it to ALL machines. So, blocking my daughter also blocks me. I was using MAC addresses there too so perhaps I need to try by IP and see if it blocks her and allows me.
Two brand new routers that both display incorrect/unexpected behavior insofar as access control policies are concerned.
I finally got contacted by D-Link who had me check to see if I had MAC address filtering enabled and had the PC included in that list (I did) but did not address the MAC fails versus IP works issue.