Many users are familiar with the situation when a third-party device connects to your home network. Internet speed drops, and unfamiliar names like "Android-1234" or "Unknown Device" appear in the router's client list. This not only slows down performance but also poses a direct threat to the security of your personal data. In this situation, it's essential to take immediate action to restrict access.
Modern routers offer powerful connection management tools. You can not only change your password, which would force you to reconfigure all your devices, but also block specific intruders. This is done through filtering by MAC address — a unique identifier for the network card. The setup process doesn't require extensive programming knowledge, but it does require attention.
In this article, we'll walk you through a step-by-step guide for popular router models. You'll learn how to find an intruder in your client list and permanently block them from accessing your network. We'll also discuss the difference between blacklists and whitelists to help you choose the optimal security strategy.
Identifying the intruder and searching for the MAC address
Before setting up a block, you need to determine exactly which device you want to disable. Users often confuse their old smartphones or smart plugs with other people's connections. First, log in to your router's administrative panel, usually accessible at 192.168.0.1 or 192.168.1.1. Here, you'll need to enter your administrator username and password.
Find the section, which may be called "Status," "Network Map," "DHCP Server List," or "Client List." This menu displays all devices currently consuming bandwidth. Pay attention to the column labeled MAC address. This is a combination of six pairs of hexadecimal numbers (for example, A1:B2:C3:D4:E5:F6), which is programmed into the network adapter.
To avoid blocking your own TV or phone, check the addresses. You can find them in the device's settings. On Android, this is in the menu. Settings → About phone → General information, and on Windows via the command line ipconfig /allIf you see a device that you know doesn't belong to your family, write down its MAC address.
⚠️ Note: Some modern smartphones (iOS, Android) use "MAC address randomization" to enhance privacy. This means the device may present itself to the router with a different address each time it connects. In this case, simply blocking by MAC may be ineffective, and it's best to change your WiFi password.
Once you've gathered the information, proceed to setting up filtering rules. It's important to understand that you're working with the critical infrastructure of your home network, so it's best to make any changes from a device connected via cable to avoid losing connection during the setup process.
How MAC address filtering works
The access restriction mechanism is based on checking the unique identifier of the network card. The router compares the address of the connecting device with its internal list of rules. There are two main operating modes for this mechanism: "Blacklist" and "Whitelist."
In mode Blacklist You specify the addresses of devices that are blocked from access. All other devices whose addresses are not on the list can connect freely. This is the most convenient option for home use, when you simply need to "kick out" a neighbor without reconfiguring all your devices.
Mode Whitelist It works the other way around: only devices explicitly added to the allowed list are granted access. This is the highest level of security. Even if an attacker learns your password, they won't be able to connect because their MAC address isn't on the trusted list.
⚠️ Caution: Use extreme caution when using whitelist mode. If you accidentally fail to add your current device to the list or make a mistake in one digit of the MAC address, you will lose access to the router settings. In this case, the only solution is a hard reset using the reset button on the router.
The choice of mode depends on your goals. For a one-time blocking of an intruder, use Blacklist. If you want to create a highly secure network where no one else can penetrate, choose Whitelist, but prepare a list of all your devices in advance.
Setting up blocking on TP-Link routers
Router interfaces TP-Link The settings may differ depending on the firmware version (green or blue interface), but the logic remains the same. You need to find the "Wireless" section and the "Wireless MAC Filtering" subsection.
First, ensure the filtering feature is enabled. Then, select the default rule. To block a specific device, select "Deny the stations specified by any enabled entries to access." Then, click the "Add New" button.
In the window that opens, enter the MAC address of the intruder you saved earlier. Enter any value in the "Description" field, such as "Neighbor Phone," to help you remember who you blocked. Make sure the rule status is set to "Enabled."
☑️ Checking TP-Link settings
After saving the settings, the device will disconnect. If it attempts to connect again, the router will reject the request at the protocol level. Changes take effect immediately; a reboot is usually not required, but it can be useful for clearing the DHCP cache.
Restricting access on Asus and Keenetic devices
Routers Asus And Keenetic are renowned for their advanced security systems. On Asus, the relevant section is often called "Wireless MAC Filter" and is located in the "Wireless Network" menu. The interface here is more visual: you can often simply select a device from the list of connected clients and click "Deny."
U Keenetic The approach is even more flexible. In the "My Networks and WiFi" menu, there's a "Client List" tab. Find the desired device, click on it, and select "Block Internet Access" or "Block Device." The router will automatically create a filtering rule.
Both manufacturers allow you to create schedules. You can set up a rule to block access only during certain hours, such as at night or during school hours. This can be done through the "Parental Controls" or "Access Schedule" sections.
Features of ASUS AiMesh
If you have an AiMesh network with multiple routers, filtering rules apply to the entire system. Blocking the main router will automatically prevent the device from accessing any satellite node.
Don't forget to test the results after applying the settings. Try connecting from a locked device (if you have one handy)—the network should either not be visible or return a "Failed to connect" error.
Using parental controls as a blocking method
Users often don't need to delve into complex MAC filter settings. Modern routers offer a "Parental Control" feature that allows for more flexible access restrictions. You can simply select a device from the list and check the "Block internet access" box.
This method is convenient because it works at the IP addressing and DNS level, not just MAC filtering. This means that even if the user attempts to change the MAC address (which is possible on some PCs), the parental control rule linked to the device name or IP address may remain in effect.
Additionally, parental controls allow you to block access to specific categories of websites or limit online time. This is a great alternative to complete blocking if you simply want to limit the time your children or guests spend online.
| Function | MAC filtering | Parental control | Guest network |
|---|---|---|---|
| Target | Complete access block | Time and content control | Isolation of guests |
| Complexity | Average | Low | Low |
| Bypass | Changing the MAC address | Changing DNS/Time | Knowing the password |
| Flexibility | Low (on/off) | High (on schedule) | Average |
Using built-in security profiles is a modern approach. It allows you to manage access through the router manufacturer's mobile app, which is much more convenient than opening a browser and entering the gateway's IP address each time.
Creating a guest network as an alternative to blocking
Instead of constantly tracking and blocking other people's devices, many security experts recommend using Guest network (Guest Network) This is a feature that creates a separate access point with its own name and password.
The main advantage of a guest network is isolation. Devices connected to it are invisible to your main computers, NAS storage, printers, and smart home system. Even if a guest (or a virus on their device) attempts to attack the network, they will be isolated.
You can share your guest network password with all your friends and neighbors if you're feeling generous, while keeping your main, highly secure password secret. Guest network settings often include a timer: access is automatically disabled after a specified time.
This solution is ideal for situations where people come to you with multiple devices. You don't have to enter the password on each device on the main network, and you don't have to clean up your client list of dozens of temporary connections.
What to do if the device does not lock
Sometimes it happens that you've blacklisted an address, but the device continues to consume traffic. The first reason is an error in the address. Check every number and letter. The second, more likely cause is MAC address randomization on the client side.
Modern operating systems (iOS 14+, Android 10+, Windows 10/11) hide the real MAC address by default when scanning networks. They generate a random address for each new network. If you block one random address, the device will generate a new one after a minute and connect again.
In this case, the only reliable solution is to change the WiFi password. After changing the password, all devices will be disconnected. Reconnect yours. Other devices will be left behind, as they don't know the new security key.
⚠️ Note: Router interfaces may change after changing the password or updating firmware. If you don't see the menus described above, please refer to the official documentation for your model's manufacturer or the support website.
Also check if the feature is enabled WPSThis is a vulnerable protocol that allows connection without a password by pressing a button or guessing a PIN code. It is recommended to completely disable WPS in your wireless network settings for increased security.
Frequently Asked Questions (FAQ)
Is it possible to block a device if I don't know its MAC address?
Without a MAC address, targeted blocking is impossible, as it's a unique identifier. You must first go to the router's DHCP List, find the unknown device by model name or connection time, and copy its address from there.
Will rebooting the router clear the block?
No, MAC address filtering settings are stored in the router's non-volatile memory. The rules will remain in effect after a reboot or power surge. They will only be reset if you manually perform a factory reset.
Does enabling filtering affect internet speed for others?
Modern routers process filter tables in hardware and almost instantly. The load on the router's processor from a list of 10-50 addresses is negligible and will not affect speed or ping in games.
Is it better to hide the network name (SSID) or use filtering?
Hiding the SSID gives a false sense of security (the network is easily found with special scanners), while MAC address filtering or whitelisting provide real protection. It's better to use a complex WPA2/WPA3 password and whitelisting than simply hiding the network name.
Can a hacker bypass MAC address blocking?
Yes, an experienced user can clone the MAC address of an authorized device (for example, your phone) onto their laptop. Therefore, MAC filtering is a good barrier against neighbors, but it won't protect against a targeted attack by a professional. Combine methods.