How to Restrict Device Access to Your Wi-Fi Router: A Complete Guide

Has your internet speed suddenly dropped, and are unknown devices appearing in your list of connected devices? Or do you want to restrict your children's internet access at night? Restricting access to your Wi-Fi router isn't just a security issue, but also a way to optimize your home network. In this article, we'll cover all the current methods, from the basics. MAC filtering to flexible rules parental controlWe'll also tell you how to block a device by IP or even by time.

It is important to understand that the restriction methods depend on the router model and firmware version. For example, on TP-Link Archer C6 MAC filter settings are in one menu, and on ASUS RT-AX88U — in another. We'll provide general instructions, but if your router has a non-standard interface, consult the official documentation. Also, keep in mind that some methods (such as time-based blocking) may conflict with smart home features if they are linked to a schedule.

1. MAC Filtering: How to Block Devices by Physical Address

MAC filtering — the most reliable way to restrict Wi-Fi access at the device hardware address level. Each gadget (smartphone, laptop, smart speaker) is assigned a unique MAC address, which can be added to the router's blacklist or whitelist. This method works even if the attacker knows your network password.

To set up filtering:

• 🔍 Find MAC address device you want to block. On Windows This can be done via the command line (ipconfig /all), on Android — in the Wi-Fi settings (section "Status" or "Network information"). iPhone path: Settings → Wi-Fi → ⓘ next to network → Wi-Fi Address.
• 🖥️ Go to your router's control panel (usually at 192.168.0.1 or 192.168.1.1). The default login and password are indicated on the device sticker.
• 🔒 Go to the section Wireless → MAC FilteringEnable the feature and add addresses to the blacklist (deny) or whitelist (allow).

When using blacklist All devices except blocked ones will be able to connect. Whitelist It works the other way around: only devices whose MAC addresses you've explicitly allowed will be able to connect. The second option is more secure, but requires manually adding each new device.

⚠️ Attention: MAC addresses can be spoofed, so this method isn't 100% secure. For maximum security, combine it with encryption. WPA3 and a complex password.

Find MAC addresses of all trusted devices

Write them to a text file (in case of router reset)

Enable MAC filtering in your router settings.

Add addresses to the black or white list

Save settings and reboot the router-->

2. IP address blocking: temporary and permanent restrictions

If you don't want to mess around with MAC addresses, you can restrict access by IP addressThis method is less secure (the IP address can be changed manually), but it's convenient for temporary blocking. For example, if a guest connects to your network and starts consuming all your traffic, you can quickly disconnect their device.

Instructions for most routers:

1. Open your router control panel and go to DHCP → Client ListAll connected devices with their IP and MAC addresses are displayed here.
2. Copy IP address device to be blocked.
3. Go to Security → Access Control or a similar section.
4. Add a blocking rule for the selected IP. In some routers (for example, Keenetic) this is done through Network Segments → Firewall Rules.

For the blocking to work, it must be enabled in the router settings. firewallPlease note that if the device receives a new IP address (for example, after a router reboot), the block will be removed. For permanent restrictions, it's best to combine this method with MAC filtering.

3. Parental control: time and content restrictions

If you need to not just block a device, but restrict its access to the Internet at certain hours (for example, at night) or to specific sites (social networks, games), use parental controlThis feature is available in almost all modern routers, including budget models. Tenda And Mercusys.

Setting up a router as an example ASUS RT-AX55:

• 🕒 Go to Administration → Parental Controls.
• 📱 Select a device from the list or add it manually by MAC/IP.
• ⏰ Set a schedule (for example, blocking from 11:00 PM to 7:00 AM).
• 🌐 If necessary, add blocking for specific websites or categories (gaming, adult, etc.).

On routers TP-Link the path may differ: Advanced → Parental Controls → Add RuleSome models (for example, Xiaomi Mi Router 4A) allow you to set up parental controls through a mobile app, which is more convenient for quick changes.

⚠️ Attention: Parental controls at the router level only block access to the internet, not to the local network. The device will still be able to share files with other devices on your network (for example, via SMB or DLNA).

MAC filtering

IP blocking

Parental control

I turn off Wi-Fi on the router

I do not restrict access-->

4. Disabling the device via a mobile app

Many modern routers (for example, Keenetic, Xiaomi, Huawei) support control via mobile apps. This is convenient if you need to quickly turn off someone else's device without accessing the web interface. For example, in the app Mi Wi-Fi Simply open the "Devices" tab, select the desired device and click "Block".

The advantages of this method:

• ⚡ Speed: block in 2 clicks.
• 📱 Convenience: no need to remember IP or MAC addresses.
• 🔄 Flexibility: You can unlock your device just as easily.

However, mobile apps also have their downsides:

• 🔌 The block is reset after rebooting the router (if not saved in the settings).
• 📵 Not all router models support such functions (for example, older ones D-Link or Zyxel).
• 🛡️ No deep customization (you can’t set a schedule or filter by sites).

If your router does not support the official app, you can use universal utilities like Fing (available for Android And iOS). It scans the network, shows all connected devices and allows you to block them through ARP spoofing (However, this will require root rights on Android or jailbreak on iPhone).

5. Hiding the SSID and other additional security measures

You can restrict access to Wi-Fi not only by blocking, but also network hidingIf you turn off the broadcast SSID, your network won't appear in the list of available networks, and only those who know the exact name (and password) will be able to connect to it. This doesn't protect against targeted attacks, but it reduces the risk of neighbors accidentally connecting.

How to hide SSID:

1. Go to your router settings (usually 192.168.0.1).
2. Go to Wireless → Basic Settings.
3. Find the option Hide SSID or Enable SSID Broadcast and turn it off.
4. Save the settings and reboot the router.

Other useful measures:

• 🔐 Use WPA3 instead of the outdated one WPA2 or WEPThe latter can be hacked in minutes.
• 🔄 Change your Wi-Fi password regularly (every 3–6 months).
• 📡 Turn off WPS - This function can be hacked using brute force.
• 🛡️ Update your router firmware to the latest version (vulnerabilities are often patched in them).

⚠️ Attention: Hiding the SSID can cause connection issues for some devices (such as older printers or smart bulbs). If your device can't find the network, try temporarily enabling SSID broadcasting to configure it.

What to do if your router doesn't support WPA3?

If your router does not support WPA3, use WPA2-AES (Not TKIP!). Also turn on protection against dictionary attacks (if available in the settings) and set a complex password (at least 12 characters with numbers, letters and special characters).

6. Speed ​​Limiting: How to Throttle Someone Else's Device

If you don't want to completely block a device (for example, a guest's phone), but it's consuming too much data, you can limit its speed. This feature is called QoS (Quality of Service) or Bandwidth Control and is found in most mid-range and high-end routers.

Setting up an example TP-Link Archer C7:

1. Go to Advanced → QoS → QoS Settings.
2. Turn on the function and select the mode IP/MAC restriction.
3. Add a rule for the target device (specify its IP or MAC).
4. Set download limits (Download) and return (Upload), for example, 1 Mbit/s.
5. Save the settings and apply the changes.

On routers ASUS a similar function is called Adaptive QoS and is located in the section Local Area Network (LAN) → QoSHere you can not only limit the speed, but also prioritize traffic (for example, give maximum speed to Smart TV or a work laptop).

Please note that QoS only works for devices connected to your router. If a guest uses VPN or Tor, restrictions may not work. Also, some applications (for example, YouTube or Netflix) adapt to low speed, reducing video quality, but do not stop working.

7. Alternative methods: Guest Wi-Fi and VLANs

If you frequently need to provide Internet access to guests, but you don’t want to risk your main network, set up guest Wi-FiThis function creates a separate network with its own name (SSID) and a password, isolated from your main network. Guests will be able to access the internet, but won't be able to see your local devices (printers, NAS, smart home).

How to enable guest Wi-Fi on Keenetic:

1. Go to Wi-Fi Network → Guest Network.
2. Enable the option and set the network name (for example, Guest_WiFi).
3. Set a password (preferably different from the main network).
4. In the "Client Isolation" section, enable the option to prevent guests from seeing each other.
5. Limit the speed or time of the guest network if necessary.

For advanced users, there is another method of isolation - VLAN (Virtual LAN)This technology allows you to divide your network into multiple virtual segments. For example, you can create a separate VLAN for your smart home, another for work devices, and a third for guests. Setting up a VLAN is more complex and requires support from the router (e.g., MikroTik, Ubiquiti or advanced models ASUS).

Benefits of Guest Wi-Fi and VLAN:

• 🔒 Complete isolation from the main network.
• 🛡️ Data leak protection (guests won't see your shared folders or printers).
• 🔄 Flexible settings (you can limit the speed or operating time).

Frequently Asked Questions (FAQ)

Is it possible to block a device if I don't know its MAC or IP?

Yes, if the router supports blocking by device name. For example, in Xiaomi Mi Router or Keenetic The list of connected devices displays their names (for example, "iPhone_Ivan" or "Samsung-Galaxy-S21"). You can block a device directly from there, without knowing its MAC or IP address. You can also temporarily disable it. DHCP and manually assign an IP to the unwanted device and then block it.

Why does my locked device still connect to Wi-Fi?

Possible reasons:

• 🔄 The router did not save the settings (reboot it).
• 🔒 The device connects via a different MAC (spoofing).
• 📡 The network is turned on WPS or an outdated protocol WEP.
• 🔌 The lock was reset after the firmware update.

Check your settings again and update your router firmware. If the problem persists, reset the router to factory settings and reconfigure the blocking feature.

How to limit Wi-Fi access by time without parental controls?

If your router does not support parental controls, you can use:

1. Wi-Fi Schedule: some routers (for example, TP-Link) allow you to turn off the network by time (Wireless Mode → Schedule).
2. Scripts on the router: on firmware like OpenWRT or DD-WRT You can write a script that will turn off Wi-Fi at a specified time.
3. Smart sockets: physically turn off the router on a schedule via a smart plug (for example, Xiaomi Mi Smart Plug).

Is it possible to block a device at the provider level?

No, the provider does not provide such services for home users. Device blocking is only performed at the router level. However, some providers (for example, Rostelecom or Beeline) offer parental control at the tariff level, which blocks access to specific websites, but not to specific devices on your network.

What should I do if my neighbor hacked my Wi-Fi and changed my router settings?

If you suspect that someone has gained access to your router's control panel:

1. 🔌 Reset your router to factory settings (button Reset on the back panel, hold for 10-15 seconds).
2. 🔐 Change your login and password to enter the control panel (do not use the standard ones) admin/admin).
3. 🛡️ Update the firmware router to the latest version.
4. 📡 Change your Wi-Fi network name (SSID) and password into complex ones.
5. 🔒 Disable remote access to the router (optional) Remote Management).

After the reset, reconfigure your router using the instructions in this article.