Many router owners are familiar with the situation when a third-party device connects to their wireless network. Slow internet speeds, lag in online games, or simply a desire to protect your data require immediate attention to your equipment settings. However, the standard advice—change your Wi-Fi password—has one significant drawback: you'll have to reconfigure the connection on all your personal devices, from smartphones to smart TVs.
Fortunately, modern routers TP-Link are equipped with more flexible access management tools that allow for targeted actions. Instead of globally changing the security key, you can use the filtering feature. MAC addressesThis method allows you to create a "blacklist" of devices that will be denied network access, or, conversely, a "whitelist" where only selected devices are allowed access. This solution is ideal for situations where you need to quickly disable an intruder without disrupting your own devices.
In this article, we will examine in detail the algorithm of actions for different versions of the web interface. TP-LinkYou'll learn how to find the MAC address of someone else's device, where exactly in the router menu the necessary switches are located, and what nuances should be taken into account when setting up Wireless MAC FilteringProper use of these tools will transform your router into an impenetrable fortress without the hassle of reconnecting devices.
Identifying an uninvited guest on the network
Before you begin blocking, you need to determine exactly which device is consuming your traffic. Your router's administrative panel displays a list of all active clients currently connected. If you see a device with an unfamiliar name or simply a suspicious identifier, the first step is to note its unique network address. MAC address (Media Access Control) is the digital fingerprint we will use for filtering.
Access the router's web interface by entering the address in your browser. 192.168.0.1 or tplinkwifi.netDepending on the model and firmware version, the information you are looking for may be located in the following sections: Status, DHCP Server List or Wireless StatisticsNew interfaces with a blue header often have a separate tab. Clients or the network map icon on the home screen. Find the device you want to block in the list and copy its MAC address, which usually looks like a combination of six pairs of characters, for example, A4:5E:60:C2:11:BB.
It's important to understand the difference between a dynamic IP address, which the router assigns to a device temporarily, and a static MAC address, which is permanently hardcoded into the network card. IP address blocking is ineffective, as the intruder will receive a new address upon reconnection. Filtering by MAC address ensures that a specific physical device cannot gain access even if it tries to change its network name.
Setting up filtering in the new TP-Link interface
Owners of modern routers TP-Link (Archer series, series with a blue interface) have access to an advanced settings menu. The logic here is based on the Blacklist or Whitelist principle. For quickly blocking a specific user, it's most convenient to use the Blacklist mode, which by default allows access to everyone except those on the exception list.
To get started, go to the menu Advanced (Advanced settings) and select the item Wireless (Wireless mode). In the side menu, find the section Wireless MAC FilteringHere you will need to activate the filtering function itself by setting the switch to the position EnableNext, you need to select a filtering rule. To block a specific device, select the option Blacklist (or the phrase "Deny the stations specified... to access"). This will allow all devices to connect freely, except those whose addresses you specify.
After selecting the mode, press the button Add (Add). In the window that opens, in the field MAC Address Enter the previously copied address of the offender. Field Description You can fill in any field you like, for example, "Unwanted Guest" or a phone model, to avoid confusion in the future. Save the settings by clicking the button. OK or SaveFrom this point on, the device with the specified address will lose the connection and will not be able to reconnect, even with the correct Wi-Fi password.
Instructions for the classic green interface
If your router TP-Link has an outdated but reliable green interface (often found in models of the series TL-WR), the setup procedure will be slightly different visually, but the essence will remain the same. In such routers, the filtering menu is also located in the Wireless, but it requires a more careful approach to the order of actions, since there is no division into “black” and “white” lists in the usual sense – a system of rules operates here.
Go to the menu Wireless MAC Filtering. The first step is to make sure that the function is turned off (status Disabled) to easily set up the rules. Click the button Add New...In the field MAC Address Enter the address of the device you want to block. In the field Description Please enter a comment in the drop-down list. Privilege (Privileges) select Disabled (Forbidden). This is the key point: you create a rule that explicitly denies access to this MAC address.
After adding the rule, return to the main filtering window. Here, you need to select the radio button Deny the stations specified by any enabled entries in the list to access (Deny access to stations specified in the enabled list entries). Only after selecting this mode, press the button Enable to activate the filtering function. If you select the opposite option, you'll block everyone except the specified device, resulting in loss of access for your devices.
What to do if the Save button is grayed out?
Sometimes in older firmware versions the save button won't click if no rules are selected. Make sure the checkbox is checked. Enable in the Status column for the created rule is set, and only after that try to save the configuration of the entire page.
Using the Tether mobile app
For users who prefer to manage their network from their smartphone, the company TP-Link developed an application TetherIt's available for iOS and Android and allows you to configure basic security settings without opening a browser or entering IP addresses. This is especially convenient if you're away from home but want to remotely check who's connected to the network or quickly block a device.
After logging into the app (using your router login and password), go to the main screen, which displays a diagram of your network. Click on the section Clients (Clients). You'll see a list of all connected devices. Find a suspicious device—the app often automatically detects the device type (e.g., iPhone, PC, Camera) and displays the amount of data transferred, which helps identify the "heavyweights." Click on the device name.
The device properties menu that opens often has a switch Block (Block) or the lock icon. Activating this feature instantly adds the device's MAC address to the router's blacklist. Important: Blocking via the Tether app only works if the router is linked to your TP-Link ID and has access to the manufacturer's cloud services. If there is no internet connection on the router, cloud management will not work, and you will have to use the local web interface.
| Parameter | Web interface (Browser) | Tether app | Local Menu (Buttons) |
|---|---|---|---|
| Availability | Only within Wi-Fi/LAN network | From anywhere in the world (via the cloud) | Only physically at the router |
| Blocking speed | Instantly | Depends on the internet speed | Instantly |
| Detailing | Full (all settings) | Basic (clients only) | Absent |
| Complexity | Average | Low | High |
Whitelist mode for maximum protection
There is a more radical, but also more reliable method of protection - using the "Whitelist". In this mode, the router TP-Link By default, it denies connections to ANY device except those whose MAC addresses are explicitly allowed. This ensures that even if someone learns your Wi-Fi password, they still won't be able to connect, as their "digital passport" isn't authorized by the administrator.
To implement this method in the settings Wireless MAC Filtering select mode Whitelist (or "Allow the stations specified... to access"). After this, you'll need to manually enter the MAC addresses of all your trusted devices: smartphones, laptops, tablets, smart speakers, and TVs. Be careful: if you make a mistake in one digit of your phone's address, you'll lose access to your router's Wi-Fi settings and will have to connect via cable or perform a factory reset.
☑️ Preparing for Whitelist Mode
This method is ideal for offices or apartments where the device set-up is constant. It creates a "digital lock" where the key is not only knowledge of the password but also the presence of authorized equipment. However, if you frequently have guests and need to grant them access, this mode will become inconvenient, as you'll have to go into the settings each time to add new MAC addresses.
Common mistakes and troubleshooting
Despite the simplicity of the procedure, users often encounter situations where blocking doesn't work. One common cause is the device's "MAC Address Randomization" feature. Modern versions of iOS and Android hide the real MAC address by default, generating a random set of characters for each new network. If you block one random address, the device may simply generate a new one and reconnect.
To avoid this, you should either disable the Wi-Fi privacy feature on the device itself (if it's your personal device) or be prepared to promptly update the blacklist. Caching of settings on the connecting device itself can also be a problem. After making changes to the router TP-LinkOn your phone or laptop, you need to click "Forget network" and reconnect for the filtering rules to apply correctly.
⚠️ Attention: Router interfaces are regularly updated by the manufacturer. The layout of menu items may vary slightly depending on the firmware version. If you don't find an exact match, look for synonyms (Filtering, Access Control, MAC Address) in the Wireless or Advanced sections.
Another possible mistake is enabling the Guest Network. MAC address filtering is often applied only to the main network. If you've blocked a device from the main network but have a Guest Network enabled with the same password (or without one), an intruder could switch to it. Check your Guest Network settings and, if necessary, disable it or apply similar restrictions.
FAQ: Frequently Asked Questions
Will a blocked user be able to connect again if he knows the password?
No, it won't. The MAC address filtering mechanism operates at a lower level than password checking. Router TP-Link Verifies the device's physical address before the security key request. If the address is blacklisted, the connection will be terminated immediately, regardless of whether the password entered is correct.
Do I need to reboot my router after setting up filtering?
In most cases, modern routers TP-Link Filtering settings are applied instantly. However, if you notice that the device continues to appear in the client list, it is recommended to reboot the router via the menu. System Tools -> Rebootto clear the DHCP cache and ARP table.
Is it possible to lock a device if it is not currently connected to the network?
Yes, you can. You just need to know its MAC address. You can manually add a new rule to the filter list by entering the address manually in the field. MAC AddressThe rule will be saved in the router's memory and will take effect the next time the device attempts to connect.
What should I do if I blocked myself and lost access to settings?
If you are using the "Whitelist" mode and have not added your device, or have accidentally added your MAC to the "Blacklist", the only way out is to connect to the router via an Ethernet cable (a wired network is usually not filtered by Wi-Fi rules) or perform a full reset using the Reset button on the device.