Protecting your home network from unauthorized access is a basic necessity in today's digital world. Even if you've set a strong Wi-Fi password, there's always the theoretical possibility of it being hacked or leaked to friends. This is where a security patch comes into play. MAC filtering, which is an additional, hardware-based layer of access control to your router. This method allows the network owner to independently determine which devices can connect to the internet and which will be blocked at the hardware level.
The essence of the technology is to check the unique identifier of the network card, known as Media Access ControlEvery network adapter, whether in a smartphone, laptop, or smart light bulb, has a unique address programmed by the manufacturer. When a router receives a connection request, it checks this address against its internal list and decides whether to allow the traffic or reject the connection. This is similar to accessing an office building with a security pass: a security guard (the router) checks the person entering (the MAC address) against the employee list (the database).
Unlike complex cryptographic encryption protocols, device-based access control doesn't require extensive networking knowledge. You don't need to be a system administrator to create a whitelist or blacklist. However, despite the simplicity of the concept, the setup process has its nuances, especially when it comes to mobile devices with randomization capabilities. Let's figure out how to turn your router into a reliable gatekeeper.
What is a MAC address and how does it work in a network?
The physical address of a device is a 48-bit identifier assigned to a network interface during manufacturing. It is written in hexadecimal format, for example, 00:1A:2B:3C:4D:5EIt's important to understand that this address is intended for use within the local network and is not routed over the global internet. When you connect to Wi-Fi, the router sees not only your device's name but also this unique code.
The filtering mechanism operates at Layer 2 of the OSI model (data link layer). This means that checking occurs even before a device is assigned an IP address or allowed to access the external network. If the address is not on the allowed list (or is on the blocked list), the router simply ignores association requests. MAC filter acts as a hard barrier, preventing data packets from unknown clients from passing through.
⚠️ Warning: The physical address can be programmatically changed (cloned). An attacker monitoring traffic can copy the address of an authorized device and connect in its stead. Therefore, this method is not a panacea and should be used in conjunction with WPA2/WPA3 encryption.
There are two main filtering modes, which fundamentally change the access logic. In "Allow List" mode, access is permitted only to those explicitly specified in the settings. Anyone else, even with the password, will be unable to connect. In "Deny List" mode, only specific addresses selected by you are blocked, while everyone else is allowed freely.
Preparation: Finding the MAC addresses of your devices
Before accessing your router settings, you need to create a list of trusted devices. If you forget the IP address of your laptop or phone, you risk locking yourself out and losing access to the control panel. Finding the IP address depends on your operating system, and the procedure is slightly different for each.
On Windows computers, the easiest way is to use the command prompt. Press the key combination Win + R, enter cmd and press Enter. In the window that opens, enter the command ipconfig /allFind your wireless LAN adapter and the "Physical Address" line in the list. These are the characters you'll need to rewrite.
Command for macOS and Linux
In the macOS terminal, enter ifconfig | grep ether, or in Linux, enter ip link show. Look for a line containing the word wlan or wifi; the address you're looking for will be listed next to it in the format XX:XX:XX:XX:XX:XX.
For mobile devices, the situation is a little more complicated, as interfaces are often hidden in deep menus. On Android, the path usually lies through Settings → About phone → Status or Settings → Wi-Fi → AdvancedOn iOS (iPhone/iPad) you need to go to Settings → General → About and find the "Wi-Fi Address" field.
Particular attention should be paid to modern smartphones. For privacy reasons, iOS and Android may use randomized MAC address for each new network. This means that your phone will appear as a new device to the router each time. For filtering to work, you must disable this feature in the settings of the specific Wi-Fi network on your phone by selecting "Use device address."
Login to the router control panel
Filtering is configured exclusively through the router's web interface. First, make sure your device is connected to the network you plan to protect. Open any browser and enter the gateway's IP address in the address bar. Most often, this is 192.168.0.1 or 192.168.1.1, however, the exact address may be indicated on a sticker on the bottom of the device.
The system will ask for your login and password. If you've never changed the default settings, they'll also be listed on the sticker (often admin/admin). If the password was previously changed and lost, you'll need to reset the router to factory settings using the button. Reset, which will result in the loss of all current provider configurations.
| Router brand | Standard IP | Default login | Default password |
|---|---|---|---|
| TP-Link | 192.168.0.1 | admin | admin |
| Asus | 192.168.1.1 | admin | admin |
| D-Link | 192.168.0.1 | admin | (empty) |
| Keenetic | 192.168.1.1 | admin | indicated on the sticker |
| Tenda | 192.168.0.1 | admin | admin |
Interfaces from different manufacturers may look quite different, but the logic remains the same. Look for sections with names like "Wireless," "Wi-Fi Network," or "Network." Within these, there should be a tab called "MAC Filtering."
Setting up a whitelist (Allow List)
Whitelist mode is the most secure configuration option. In this mode, the router by default blocks connections from absolutely all devices except those you manually add to the rules table. This is ideal for situations where you need to strictly limit the number of users, such as in an office or if you have children at home.
To activate this mode, locate the filtering switch and select "Allow" or "Whitelist." Once enabled, all devices already on the network can be instantly disconnected if their addresses aren't included in the list. Therefore, it's crucial to first add the MAC address of the device you're configuring before enabling the filter.
The adding process is as follows: click the “Add” button, enter the previously copied address in the format XX:XX:XX:XX:XX:XX and give the device a descriptive name (for example, "Iphone_Dad" or "Smart_TV"). Some routers allow you to select the device from a list of already connected clients, making this process easier.
☑️ Setting up a whitelist
After saving the settings, the router may reboot the wireless module. If you've done everything correctly, your device will reconnect automatically. Any connection attempts from unregistered devices will be blocked, even if they enter the correct Wi-Fi password.
Setting up a blacklist (Deny List) and blocking guests
A blacklist works in reverse: everyone is allowed access except those on the "stop list." This method is convenient if you want to temporarily restrict access to a specific user, such as a noisy neighbor or a child who has exceeded the time limit. However, for ongoing protection, it is less effective, as new devices can connect freely.
To block a specific device, go to the filtering menu and select "Deny" or "Blacklist." Next, you'll need a table of connected clients. On routers TP-Link, Asus or Mikrotik It's usually listed as a wireless network. Find the unknown device by name or IP address, copy its MAC address, and add it to the blocking rules.
There's a caveat with guest networks. If you don't want to completely block a guest, but want to limit their access to your local files (printers, NAS storage), it's better to use the "Guest Network" feature rather than a MAC filter. The filter simply terminates the connection, preventing them from even obtaining an IP address.
⚠️ Warning: When blocking devices via a blacklist, smart gadgets (cameras, sockets) may try to reconnect indefinitely, creating an unnecessary load on the router's processor and cluttering the event logs.
The effectiveness of a blacklist is reduced if the intruder has the ability to change their network card's MAC address. On operating systems like Windows or Linux, this can be done in a couple of clicks. Therefore, if you notice a blocked neighbor is back online, they may have simply changed their MAC address.
Configuration features for different router models
Firmware interfaces vary, and finding the right option can be challenging. Let's look at several popular brands. In routers TP-Link (green interface) the path usually looks like this: Wireless → Wireless MAC FilteringClick "Add New," enter the address, and select "Enabled." Don't forget to click "Enable" in the main filtering menu.
Devices Asus Devices with the AsusWRT firmware have a more modern interface. Look for the "Wireless" section in the left menu, then the "MAC Address Filter" tab. Here, you can switch between "Accept" and "Reject" modes with a single click. Conveniently, Asus allows you to copy addresses directly from the client list by clicking the corresponding button next to the device.
Routers Keenetic (formerly Zyxel) offers the most flexible system. In the "My Networks and Wi-Fi" menu, there's a "Client List" section. There, you can click on a device and select "Deny" or "Always Allow." The system will automatically create the necessary rule. This is the most user-friendly interface for beginners.