Modern wireless networks require a comprehensive approach to data security, and setting a complex password is no longer the only precaution. MAC address filter This is a powerful tool that allows network administrators to strictly control which devices are allowed to connect to an access point. Unlike a password, which can theoretically be intercepted or brute-forced, this method is based on the unique physical identifier of the network card, creating an additional, virtually insurmountable barrier to unauthorized access.
Implementing such a security system is especially important for office networks or homes with a large number of devices, where it is important to prevent guests from accessing local resources. Media Access Control — This is a unique code assigned by the manufacturer to the network interface, and it's what we'll use as a digital pass. Setting this parameter up may seem complicated at first, but with the right approach, the process takes just a few minutes and significantly improves the overall cybersecurity of your infrastructure.
In this article, we'll detail the process, examine the differences between whitelist and blacklist modes, and answer frequently asked questions users have when working with router interfaces from different manufacturers. You'll learn how to find your device's identifiers and effectively apply this knowledge to protect your traffic from unauthorized access.
Operating principle and types of traffic filtering
The basis of security in this method is the uniqueness of each network adapter. MAC address The Media Access Control address (MAC) consists of 12 hexadecimal digits and is factory-programmed, although modern technology allows it to be modified programmatically. When a router receives a connection request, it checks this code against its internal database and decides whether to allow the data packet or block it. This occurs at the data link layer of the OSI model, making the check quick and efficient.
There are two main approaches to organizing such protection, each with its own use cases. The first option is Blacklist (blacklist), which contains the addresses of devices that are strictly prohibited from accessing, while all others can connect freely. This method is convenient if you know the "offender" for sure, such as a neighbor, and want to restrict their access without resetting passwords for all your devices.
The second, more reliable option is Whitelist (whitelist). In this mode, the router blocks all connections by default, allowing access only to devices whose addresses are included in the allowed list. Even if an attacker knows the Wi-Fi password, they won't be able to connect unless their device is manually added to the list by the administrator. This is the ideal choice for maximum protection, although it does require more time for the initial setup of each new gadget.
⚠️ Note: MAC address filtering does not encrypt transmitted data. For complete protection, be sure to use encryption protocols. WPA2 or WPA3 in conjunction with filtration.
Finding MAC addresses on various devices
Before setting up the router, you need to collect the IDs of all devices that need to access the network. On computers running Windows This can be done via the command line. Open the terminal and enter the command ipconfig /all and find the "Physical Address" line in the section for your wireless adapter. Write this information down, as you'll need it to enter into the filtering table.
For owners of smartphones based on Android or iOS, you also need to find this option in the settings. Typically, the path looks like this Settings → About phone → General information or Settings → General → AboutPlease note that modern operating systems often use a "private Wi-Fi address" feature to enhance privacy by generating a random address for each network. For filtering to work, you will need to either disable this feature for your home network or copy the specific randomized address your phone is currently using.
For game consoles and smart devices, the process may differ. The address is often displayed on the TV screen when attempting to connect to the network or in the "Network Status" section. If the device isn't connected yet, look for a sticker on the case or box, which often indicates Wireless MACAccuracy in data entry is critical, as one incorrect digit will prevent the device from connecting to the router.
Setting up filtering on TP-Link and ASUS routers
Modern router interfaces have similar logic, but differ in menu layout. On devices TP-Link with the new green shell you need to go to the section Wireless Mode → Wireless MAC FilteringHere, you need to activate the feature by selecting the "Allow" (for the whitelist) or "Deny" (for the blacklist) rule. After enabling the feature, click the "Add" button and enter the previously saved device data.
Equipment users ASUS find the required settings in the section Wireless Network → MAC FilterThe "Filtering Mode" tab allows you to switch between allowing and blocking. A unique feature of the ASUS interface is the ability to select a device from a list of already connected clients, greatly simplifying the process: no need to manually enter numbers; simply select the device from the drop-down list and click the "Add" button with the arrow.
After making all changes on both types of equipment, be sure to press the button Save or ApplySome models may require a reboot to apply the new security rules. Make sure the computer or phone you're using to configure the router is already whitelisted if you've selected strict mode, otherwise you'll lose access to the router control panel.
Example of sequence of actions:1. Wireless -> Wireless MAC Filtering
2. Enable
3. Allow / Deny
4. Add New
5. Save
Access control on Keenetic and MikroTik routers
Equipment Keenetic offers the most intuitive interface for access control. In the web configurator, go to the menu My Networks and Wi-Fi → Wi-Fi Client ListAll devices are displayed here. To create a whitelist, simply toggle the "Access" slider to "Always" for trusted devices and activate the "Client Filter" global toggle, selecting "Allow only devices from the list."
Setting up MikroTik Requires more in-depth knowledge, as this is professional-grade equipment. Filtering is done through the menu. Wireless -> Access List. Here a rule is created where in the field MAC Address the address is entered and in the Action (Action) is selected accept (accept).
For corporate networks based on MikroTik A RADIUS server is also convenient for centralized access control, but for home use, a static list is sufficient. Keep in mind that changing settings on professional equipment can temporarily disrupt the connection, so it's best to perform the work locally, via a LAN cable, to avoid losing access to the configuration.
What to do if you've blocked yourself?
If you enabled the whitelist and forgot to add your computer, connect to the router via a LAN cable (it is often not filtered) or perform a reset by pressing the button on the case for 10-15 seconds.
Security Mode Comparison Table
To help you choose a protection strategy, we've prepared a comparison chart. It will help you weigh the pros and cons of different filtering types depending on your needs and technical skill level.
| Parameter | Blacklist | Whitelist | Without filtration |
|---|---|---|---|
| Operating principle | Blocks only selected devices | Blocks all but selected ones | Access is open to anyone who knows the password. |
| Security level | Low / Medium | High | It depends only on the complexity of the password. |
| Ease of use | High (does not require setting up new devices) | Low (need to add each new device) | Maximum |
| Risk of error | Minimum | High (can block yourself) | Absent |
Possible problems and solutions
One common issue is the inability to connect a new device even after whitelisting it. This is often caused by a typo or mixed case (AF), although most routers are case-insensitive. It's also worth checking whether MAC address randomization is enabled on the device itself, causing the router to see a new "unknown" device each time.
Another common scenario is losing access to the router's admin panel after enabling strict filtering. If you didn't add your PC to the list before activating the rule, the network will be disconnected. In this case, the only solution is a physical cable connection (if the LAN ports aren't filtered) or a full reset of the device to factory settings using the button. Reset.
Sometimes users encounter a device showing as "Blocked" in the client list, but traffic still passes. This may indicate that the filtering rule isn't applied to the correct interface (for example, only to the guest network) or that there's a higher-priority rule allowing access in the router's priority system. In such cases, it's recommended to double-check the rule order and SSID binding.
⚠️ Note: Interfaces and menu names may vary depending on your router's firmware version. Always consult the manufacturer's official documentation for your specific router model.
Frequently Asked Questions (FAQ)
Is it possible to bypass MAC address filtering?
Yes, a skilled attacker can intercept the MAC address of an authorized device and clone it onto their own hardware. However, when combined with a complex password and WPA3 encryption, this becomes an extremely difficult task, requiring close proximity to the network and time.
Does enabling filtering affect internet speed?
No, MAC address checking occurs at the connection establishment level. Once a device has connected, filtering has no impact on data transfer speed or ping, as checking is no longer required for each packet.
What should I do if I sold a phone that was on the whitelist?
You should go to your router settings and remove the entry for the sold device from the list of allowed devices. This will not only free up space in the table (if there's a limit), but also prevent potential conflicts if the new owner resets the phone to factory settings and tries to use the same ID (although this is unlikely).
How many devices can be added to the list?
The limit depends on the router model and its memory capacity. Home models typically support 16 to 64 addresses, while business-class equipment can accommodate hundreds of addresses. For a typical home, this is more than enough.