Many home network users are familiar with the situation when your internet connection suddenly slows down and unfamiliar devices appear in the list of connected devices. This is a sure sign that someone else is using your connection. Wi-Fi traffic Without permission. At best, these are neighbors trying to save money on their ISP; at worst, they're intruders trying to intercept your personal data. Regardless of the intruders' motives, access to your local network should be strictly regulated by the owner of the equipment.
Modern routers They offer a wide range of tools for protecting the home network perimeter. However, the standard password for entering the setup interface is often insufficient if the wireless network encryption key itself is weak or has been compromised. Changing your Wi-Fi password immediately disables all devices, requiring you to re-authorize every gadget in your home. Therefore, before resorting to drastic measures, it's worth considering more flexible control tools that allow you to block specific devices without disrupting your own gadgets.
In this article, we'll cover all available access restriction methods in detail, from basic encryption key changes to advanced filtering based on hardware addresses. You'll learn how to see who's connected to your network and effectively manage your list of approved clients. Proper security setup isn't a one-time measure, but a process that requires an understanding of how network protocols work.
Analysis of connected devices and identification of intruders
Before taking blocking measures, it's necessary to accurately identify the "intruder." Many users mistake their own forgotten gadgets for someone else's. First, you need to log into the router's web interface. This is usually done by entering the gateway IP address (most often 192.168.0.1 or 192.168.1.1) in the browser's address bar. After logging in, you should find a section that may be called "Status," "Network Map," or "Wireless Statistics."
This section displays a list of all active clients. Each device is identified by a unique MAC address — the physical identifier of the network card, which is assigned by the manufacturer. If you see a device named "iPhone-Ivan" or "Samsung-TV" that doesn't belong to you, this is cause for concern. Some modern routers, for example from TP-Link or Asus, can display the name of the chip manufacturer (for example, "Apple", "Intel", "Xiaomi"), which greatly simplifies identification.
Pay attention to your traffic activity. If an unknown device is actively downloading data while you're browsing, this is a clear sign of illegal bandwidth usage. Some router models allow you to see the amount of data transferred during the current session, which can help identify heavy users.
Basic protection: changing the password and encryption type
The easiest and most effective way to disable all uninvited guests at once is to change your wireless network password. This will forcefully disconnect all connected devices, and only those you share the new key with will be able to log back in. It's important not only to change the characters, but also to ensure that a modern encryption standard is used. Outdated protocol WEP It can be hacked in a matter of minutes even by a schoolchild with a phone.
In Wireless Settings, select the security type WPA2-PSK or, if the equipment supports it, WPA3-PersonalThese standards ensure reliable encryption of transmitted data. Passwords should be complex: use a combination of uppercase and lowercase letters, numbers, and special characters. The key length should be at least 12-14 characters. Avoid obvious combinations such as date of birth or phone number.
⚠️ Important: After changing your Wi-Fi password, all your devices (smartphones, laptops, smart bulbs) will lose their internet connection. You will need to manually reconnect each one using the new security key. Prepare a list of devices that need to be configured in advance.
It is also worth checking if the function is activated WPS (Wi-Fi Protected Setup). This standard is designed to simplify connecting devices with the push of a button, but it contains critical vulnerabilities that allow password recovery using brute-force attacks. It is recommended to completely disable WPS in your router settings to close this loophole for attackers.
☑️ Basic Protection Checklist
MAC address filtering: whitelists and blacklists
A more advanced control method is MAC address filtering. This feature allows the router to accept or reject connections based on a device's unique identifier, ignoring knowledge of the password. There are two operating modes: "Blacklist" and "Whitelist." In the first mode, you add the addresses of intruders to a blacklist, and the router blocks their access, even if they know the password.
The "Whitelist" mode is the most strict. In this case, only only Those devices whose MAC addresses are added to the allowed list. Even if a neighbor learns your password, their device will be rejected by the router because its physical address isn't in the trusted client database. This is ideal for static networks where the set of devices rarely changes.
However, there's a catch to filtering: MAC addresses can be spoofed (cloned). An experienced user could change their network card's address to match that of your trusted laptop if they somehow discover it. Nevertheless, this method is extremely effective for protecting against ordinary neighbors. You can find the MAC address in the same section of the wireless network statistics or on the device's sticker (often labeled as the MAC ID).
| Filtration type | Operating principle | Security level | Ease of use |
|---|---|---|---|
| Blacklist | Blocks only selected addresses | Low/Medium | High |
| Whitelist | Allows only selected addresses | High | Low (labor intensive) |
| Change password | Resets all connections | Average | Average |
| Hiding the SSID | Makes the network invisible | Low (protection from curious people) | High |
When setting up a whitelist, be careful: if you enter an incorrect address or forget to add your current computer, you may lose access to the router's Wi-Fi settings. In this case, you'll have to connect via a LAN cable or reset the router using the reset button.
How to find MAC address on different devices?
On Windows: In the command prompt, type ipconfig /all and look for the line "Physical Address." On Android: Settings → About Phone → General. On iOS: Settings → General → About. On macOS: System Preferences → Network → Wi-Fi → Advanced (or Hardware).
Hiding the network name (SSID) as a security method
Another layer of security is hiding the wireless network name (SSID). In standard mode, the router constantly broadcasts its name, and anyone within range sees it in the list of available connections. If you disable SSID broadcasting, the network disappears from the list. To connect to it, the user will have to manually enter the network name and password in their device's Wi-Fi settings.
This method isn't fully secure, as professional traffic sniffers can easily detect hidden networks based on their service data packets. However, it works well for protecting against random connections from neighbors simply looking for an open "Free_WiFi" or "TP-Link_Guest" network. It reduces "noise" and the number of automatic connection attempts by other devices.
Keep in mind that hiding the SSID can cause inconvenience when connecting new guest devices. You'll have to dictate or type the exact network name, taking care to ensure proper case-invariant access. Furthermore, some older devices may not work properly with hidden networks, constantly trying to find them and draining the battery.
Using Guest Mode for Visitors
If you need to share internet access with friends or family but don't want to share your main network password, use the "Guest Network" feature. This is an isolated Wi-Fi segment with its own password and name. The main advantage of Guest mode is isolation: Guest network users don't have access to your local resources, such as network-attached storage (NAS), printers, or files on computers.
Guest access settings allow you to set time restrictions (for example, the network is only available from 10:00 AM to 10:00 PM) and speed limits (limiting bandwidth to prevent guests from downloading torrents). This is the perfect compromise between hospitality and security. You can change the guest network password daily without affecting the settings of your main devices.
In modern routers such as Keenetic or MikroTikYou can create multiple guest networks with different access rights. For example, one for children with content filtering, another for adult guests. This provides a flexible way to manage traffic in your home.
Setting up parental controls and scheduling
Parental controls built into most routers not only filter content but also manage network access on a schedule. You can set up a rule that allows Wi-Fi access for specific devices (such as children's tablets or smart TVs) only during specified hours. Outside these hours, devices will automatically disconnect from the network.
This is useful not only for raising children but also for saving energy and improving security at night. For example, you can set a rule to turn off Wi-Fi for all devices except video surveillance systems and smart home devices between 3:00 and 6:00 AM. This minimizes the risk of attacks while you're sleeping.
⚠️ Note: Router interfaces from different manufacturers (D-Link, Asus, TP-Link, Zyxel) may differ. Function names may vary: "Access Control," "MAC Filtering," "Wireless Schedule." If you don't find an exact match, look in the "Security" or "Wireless" sections.
To implement complex scenarios, such as blocking specific apps (YouTube, TikTok) or game servers, more advanced settings or installation of third-party firmware, such as OpenWrt or DD-WRTHowever, for most household tasks, the built-in functionality is sufficient.
Frequently Asked Questions (FAQ)
Can my neighbor hack my Wi-Fi if I changed the password?
If you used a complex password (longer than 10 characters, including numbers and symbols) and enabled WPA2/WPA3 encryption, a brute-force attack would take years. However, if you have WPS enabled, it can be bypassed. The risk also remains if the password is shared with someone with access to your network.
Will enabling MAC address filtering slow down my internet speed?
No, MAC address filtering occurs at the driver and router processor level and does not affect data transfer speeds. The load on the router's processor when checking a list of dozens of addresses is negligible for modern equipment.
What should I do if I forgot my router password and can't access the settings?
The only way out is to perform a hard reset. There's a button on the router body. Reset (often recessed into the case). Press it with a paperclip for 10-15 seconds while the power is on. The router will reset to factory settings, and the login password will be located on a sticker on the bottom of the device.
Does my ISP see how many devices are connected to my router?
The ISP sees only one device—your router. All internal connections and the number of devices within your local network are hidden from the ISP behind NAT technology. They only see the general traffic originating from your IP address.