A drop in internet speed in the evening often comes as an unpleasant surprise to home network owners. You pay for a plan with a certain amount of bandwidth, but the actual speed drops to a minimum, pages take a long time to load, and videos constantly buffer. This behavior is almost always caused by unauthorized connection strangers to your access point.
Neighbors, drivers parked near your home, or simply passersby can use your Wi-Fi if the password has been compromised or brute-forced. In some cases, the router itself allows dozens of devices to connect simultaneously, which puts a strain on the router's processor and leads to instability in the entire network. That's why the ability control the client list is a basic skill for home network administration.
There are several effective ways to not only see who's using your channel but also forcibly disconnect from unwanted guests. We'll cover methods ranging from simple MAC address blocking to setting up hidden networks and limiting the number of connections at the router firmware level. This will help you regain control of your traffic and ensure the stable operation of your devices.
Analysis of current connections and identification of violators
Before taking drastic measures to restrict access, it is necessary to accurately identify all participants in your local network. Modern routers from manufacturers such as TP-Link, Asus or Keenetic, have built-in monitoring tools that display a list of all active connections in real time. This information is usually located in the Status, Network map or Client list.
Carefully review the list of connected devices. You need to match the MAC addresses and hostnames with your personal gadgets: smartphones, TVs, laptops, and smart plugs. If you find a device named Unknown or a brand you don't have (for example, Xiaomi when you only have Apple devices), this is a clear sign of an intruder. Ignoring this fact can lead to personal data theft or the use of your channel for illegal activities.
For a more in-depth analysis, you can use specialized utilities on your PC, such as WireShark or Fing for mobile devices. They allow you to see not only the connection status but also the amount of traffic consumed by each device. This is especially useful if someone in the household or guests is downloading torrents, consuming all the bandwidth, even if they have permission to be online.
Below is a table to help you classify devices and make decisions about blocking:
| Device type | Feature in the list | Action |
|---|---|---|
| Personal gadget | Well-known name, matching MAC | Allow access |
| Smart Home | Manufacturer's brand (Tuya, Aqara) | Allow access |
| Unknown | Generic, Android-xxxx, Unknown | Block immediately |
| Guest | Arrangement of friends/relatives | Limit speed or time |
Using MAC address filtering for tight control
The most reliable and time-tested method of restricting access is filtering by MAC addressEach network device has a unique physical identifier, which is assigned at the factory and does not change (with rare exceptions). By configuring your router to operate in "Whitelist" mode, you ensure that only those devices you explicitly specify in the settings will have access to the network.
To implement this method, you need to go to the router's web interface, usually at 192.168.0.1 or 192.168.1.1. Find the section Wireless mode (Wireless) and subsection MAC address filteringEnable this feature and select the "Allow only listed MAC addresses" rule. Then, add the addresses of all your trusted devices to the table.
⚠️ Important: Be extremely careful when setting up a whitelist. If you accidentally forget to add the MAC address of the device you're setting up, or forget to add a printer, you'll lose network access and won't be able to access your router's Wi-Fi settings. Always have an Ethernet cable handy for emergency connections.
An alternative method is "Blacklist." In this mode, you block specific addresses while allowing all others. This is convenient if you need to temporarily restrict one specific user, but less secure in the long term, as an attacker can simply change the MAC address on their device.
☑️ Setting up a MAC filter
Limiting the number of connections in the router settings
Many modern router models, especially business class and advanced home solutions from MikroTik or Keenetic, allow you to programmatically limit the maximum number of clients. This feature is often found in the advanced Wi-Fi settings. By setting a limit of, say, 10 devices, you physically prevent an eleventh device from completing the connection, even if it knows the password.
This approach is useful in offices or apartments where maintaining network performance for the core user base is crucial. However, it's important to understand that this method is not a security measure. It only regulates the load, but does not protect against data interception if the password is weak. An attacker can displace a legitimate user if they disconnect and take their place in the limit.
In some firmwares, for example OpenWrt or DD-WRT, you can set more flexible rules. You can set different limits for the guest network and the main network. For example, you can limit guests to 5 devices, while hosts can limit it to 50. This allows you to effectively manage the router's processor resources, preventing it from overheating and freezing due to a large number of simultaneous requests.
What should I do if my router doesn't support limits?
If the default firmware doesn't have a client limiting feature, you can try installing alternative firmware (OpenWrt, DD-WRT) if your router model is supported by the community. This will give you access to advanced traffic and queue management features.
Hiding the SSID and creating a guest network
One of the most effective ways to reduce the number of random connections is to make your network invisible to Wi-Fi scanners. Hide SSID (Hide Network Name) stops broadcasting your access point's identifier. To connect to this network, the user must manually enter not only the password but also the exact network name (SSID), taking care to ensure proper case-invariant letters are used.
This creates an additional barrier for nosy neighbors who are simply looking for open or easily accessible networks in the list. However, an experienced user with wireless network auditing software can still detect a hidden network using its service packets. Therefore, this method should be considered a "foolproofing" feature rather than a full-fledged security system.
It is much more efficient to use the function Guest networkAlmost all modern routers allow you to create a separate Wi-Fi channel with its own name and password. You can set strict restrictions for the guest network: a speed limit (e.g., 5 Mbps), a time limit, and, most importantly, isolation from the local network. Guests will have internet access, but won't be able to access your files on your NAS or printer.
Comparison of protection methods and their effectiveness
The choice of user restriction method depends on your goals: whether you want to secure your data, simply increase speed, or restrict your children's internet connection. Each method has its pros and cons, and often a combination of them yields the best results. It's important to understand the difference between access restrictions (who can connect) and traffic restrictions (how much can be downloaded).
For example, MAC address filtering provides maximum control, but requires manual configuration of each new device. Hiding the SSID is convenient, but inconvenient for constantly connecting new devices. A guest network is ideal for parties, but doesn't solve the problem if the main network password has already been stolen.
The table below provides a comparison of the main methods by key parameters:
| Method | Security level | Ease of use | Impact on speed |
|---|---|---|---|
| Change password | High | Low (needs to be changed on all devices) | Instant |
| MAC filtering | Very tall | Low (manual addition) | High (control) |
| Hiding the SSID | Average | Average | Minimum |
| Guest network | High (insulation) | High | Depends on the settings |
Frequently asked questions and troubleshooting
During setup, users often encounter common situations that cause difficulties. Below are answers to the most frequently asked questions to help avoid errors and quickly restore network functionality.
What should I do if I blocked myself when setting up a MAC filter?
If you've enabled the whitelist and haven't added your MAC address, Wi-Fi will stop working. The only way out is to connect to the router via LAN cable (Ethernet). Wired connections are typically not filtered by the Wi-Fi interface's MAC address. After connecting via cable, go to the settings and either disable the filter or add your address to the allowed list.
Can a user bypass the MAC address restriction?
Yes, a tech-savvy user can clone the MAC address of your trusted device onto their own device. However, if that device (such as your phone) is already on the network, an address conflict will occur, and one of the devices will be disconnected. For increased security, use encryption. WPA3, which makes it difficult to intercept service data.
Does the number of connected devices affect internet speed?
Yes, directly. A router is a mini-computer with limited processor and RAM resources. Every connected device, even if it's not downloading files, exchanges service packets. With a large number of clients (more than 15-20 for budget models), the router begins to operate at its limit, which increases ping and reduces overall channel throughput.
How often should I change my Wi-Fi password?
At home, there's no need to change your password monthly if you use a complex combination of characters. It's sufficient to do so every six months or a year, and also immediately after sharing your password with guests who might write it down or photograph it. If you notice an unknown device, change your password immediately.
⚠️ Note: Router interfaces may vary from manufacturer to manufacturer. The location of the "MAC Filtering" or "Client List" menu varies. If you can't find the desired option, consult the official documentation for your model or search for instructions on the manufacturer's website, as firmware updates are regularly updated.