Discovering an unfamiliar device in the list of connected clients on your home network is always alarming. It could not only be a neighbor stealing your bandwidth, but also a potential threat to the security of your personal data stored on computers and smartphones. Modern routers have powerful tools for protecting the network perimeter, allowing you to instantly shut down uninvited guests.
In this guide, we'll cover proven methods for blocking access, from simply changing your password to fine-tuning MAC address filtering. You'll learn how to identify your devices in the connection list and take drastic measures to restrict access to them. Wi-Fi networks to regain full control over the Internet channel.
⚠️ Attention: Router admin panel interfaces are constantly being updated. The layout of menu items may vary depending on the firmware version. TP-Link, Asus or MikroTikIf you don't find an exact match, look for sections with similar names related to wireless or security.
Analysis of connected devices and search for violators
Before resorting to drastic measures, you need to accurately identify who exactly is consuming your traffic. Go to your router's web interface and find the section often called Status, Network map or DHCP Client ListThis displays a complete list of all devices currently receiving an IP address from your router.
Please review the list carefully. Manufacturers often indicate the brand of the device in the field. Device Name or Client NameHowever, if you see abbreviations like HUAWEI, XIAOMI or APPLE, and you don't have devices of these brands—this is cause for concern. Sometimes names can be hidden or replaced with generic names, so it's worth checking the MAC addresses.
For precise identification, use the function Ping Or simply disable Wi-Fi on your devices one by one, watching the lines disappear from the client list. This will help you figure out which device is the "unwanted" one. If you detect an intruder, don't panic, but proceed to the next blocking steps.
Method for changing password and encryption type
The fastest and most effective way to banish all intruders is to change your wireless network access key. Changing the password will disconnect all devices, including your own, and require a new code to reconnect. This is guaranteed to disconnect all intruders.
Go to the section Wireless → Wireless Security (or similar). Make sure the encryption mode is selected WPA2-PSK or the newest WPA3Avoid using outdated protocols. WEP, which can be hacked in a matter of minutes even by beginners using automated scripts.
After changing your password, be sure to update the data on all your smartphones, TVs, and laptops. This method takes time to reconfigure all your devices, but it provides a 100% guarantee of clearing your network of unwanted clients immediately.
Setting up MAC address filtering
A more advanced control method is filtering by unique network card identifiers - MAC addressesEach device has an immutable factory code that is transmitted upon connection. The router can either deny access to specified addresses (Blacklist) or, conversely, allow only approved addresses (Whitelist).
To configure, find the section Wireless MAC FilteringFirst, you need to find out the MAC address of the intruder from the client list (it looks like a sequence of characters like A1:B2:C3:D4:E5:F6). Add this address to the rules list and select the action Deny (Prohibit) or Block.
⚠️ Attention: A MAC address can be spoofed (cloned) on a computer with administrator rights. For a home network, MAC address protection is quite effective against ordinary neighbors, but it won't protect against a skilled hacker.Whitelist mode (Allow) is the most restrictive. In this mode, the router ignores connection requests from all devices whose MAC addresses aren't in the allowed address table. This is the most secure method, but it creates complications when guests arrive, who need to manually grant access.
Using the Guest Network for Visitors
If you need to share your internet connection with friends or family, but don't want to give them access to your main network where your printers, NAS storage, and personal files are located, use the Guest network (Guest Network) This is an isolated Wi-Fi segment.
Guest network settings are usually found in the menu
Guest NetworkYou can set a separate name (SSID) and password. The main advantage is the ability to set a timer or speed limit, as well as block access to local resources.☑️ Setting up a secure guest network
Completed: 0 / 4Enable the option AP Isolation or Client Isolation in the guest profile settings. This will prevent data exchange between devices connected to the guest Wi-Fi, improving overall security and preventing the spread of viruses within the network.
Speed and access time limitation
A complete block isn't always necessary. Sometimes you just need to limit the bandwidth of a specific device that's downloading torrents and sluggishly slowing down the entire internet. QoS (Quality of Service) or Bandwidth Control Allows you to set priorities and limits.
In the section
Bandwidth ControlCreate a rule for a specific IP or MAC address. You can strictly limit incoming and outgoing speeds, for example, to 1 Mbps. This is sufficient for instant messaging, but will make full 4K video viewing impossible.
Restriction parameter Description of action Efficiency Complete blocking The device cannot connect High Speed limit A significant drop in internet speed Average Access schedule Access only during certain hours High Guest area Isolation from the local network Average Also many routers such as Keenetic or Asus, have a built-in module Parental controlThere you can set a schedule: for example, block Wi-Fi access for certain devices from 11:00 PM to 7:00 AM or limit the time of use per day.
Additional network security measures
For increased security, please disable this feature. WPS (Wi-Fi Protected Setup). Despite the convenience of push-button connection, this protocol has critical vulnerabilities that allow password recovery within hours by brute-forcing the PIN code.
Why is WPS dangerous?
The WPS protocol uses an 8-digit PIN. Due to a flaw in the algorithm's implementation, trying all possible combinations takes only a few hours on a regular laptop, not years. Disabling WPS closes this loophole.
Hide your network name (Hide SSID). The router will stop broadcasting the network name. It won't appear in your neighbors' list of available Wi-Fi networks. To connect, you'll have to manually enter the network name on new devices.
Update regularly firmware Router manufacturers are patching security holes that could allow attackers to gain administrative access to settings and override your restrictions.
Frequently Asked Questions (FAQ)
Can a blocked user reconnect?
If you've changed your password, it won't connect without the new key. If you used MAC filtering, a user could theoretically spoof (clone) the MAC address of your authorized device, but this requires specialized knowledge and administrator rights on their device.
Does the number of blocked devices affect the router speed?
The mere fact that a device is on the "Blacklist" doesn't affect speed. However, if the device is constantly trying to connect (a packet storm), this can put minimal strain on the router's processor, but in modern models, this isn't noticeable.
What should I do if I blocked myself?
If you've configured a MAC address whitelist and haven't added your phone to it, you'll lose Wi-Fi access. In this case, the only solution is to reset the router to factory settings (press the "Reset" button).
Reseton the case) or connecting via LAN cable to correct the settings.Does access restriction work if the router is rebooted?
Yes, all settings, including block and filter lists, are saved in the router's non-volatile memory. The rules will take effect automatically after a reboot.