How to restrict Wi-Fi connections on a router: complete instructions with examples

Controlling who connects to your Wi-Fi network and when isn't just a security issue, it's also a way to optimize internet speed. If you notice your neighbors are hogging your bandwidth, your kids are spending too much time online at night, or you simply want to restrict access for guests and your primary devices, this article will help you set up restrictions on any modern router.

We will analyze all the current methods: from the basic MAC address blocking to flexible parental control rules And network operating schedulesThe instructions are universal and will work for popular brands - TP-Link, ASUS, Keenetic, Zyxel, MikroTik, as well as for routers from providers (for example, Rostelecom or Beeline). If your model is older than 2018, check its firmware for the required features—some budget devices only support MAC filtering.

1. Why you should restrict Wi-Fi access

An open or poorly secured network is like leaving the door to your apartment unlocked. The consequences can be varied:

• 🐢 Speed ​​dropEach additional device consumes some of the channel's bandwidth. This is especially noticeable on plans up to 100 Mbps.
• 🔓 Data leak: through your router, it is possible to intercept passwords, browsing history, or even connect to local devices (printers, cameras).
• 💸 Traffic overuse: If you have a limited data plan, "outside" connections may result in additional charges.
• 👶 Online time control: Scheduled access restrictions help regulate children's internet use.

According to statistics Kaspersky LabMore than 30% of home networks in Russia have vulnerabilities related to inadequate router configuration. Moreover, 65% of users are unaware that strangers can connect to their Wi-Fi. This is easy to check: look at the list of connected devices (usually in the "Connected Devices" section). DHCP or Clients) - if there are unknown gadgets there, it's time to act.

⚠️ Please note: If you are a landlord and provide Wi-Fi to tenants, completely blocking their devices may be considered a breach of contract. In such cases, it is better to use guest network with speed limit.

2. Method 1: Filtering by MAC address

The most reliable (but not the most convenient) method is allow connection only to certain devices by their unique MAC addresses. This method works even if the attacker knows the Wi-Fi password.

How to find a device's MAC address:

• 📱 Android: Settings → About phone → General information → Wi-Fi MAC address
• 🍎 iPhone/iPad: Settings → General → About → Wi-Fi Address
• 💻 Windows: run the command in CMD:

  ipconfig /all | findstr "Physical Address"

• 🖥️ MacOS: System Preferences → Network → Advanced → Ethernet/Wi-Fi

Now let's add addresses to the whitelist on the router. Example for TP-Link:

1. Go to the control panel (usually 192.168.0.1 or 192.168.1.1).
2. Let's move on to Wireless Mode → MAC Filtering.
3. Select the mode "Allow access only to specified devices".
4. Enter MAC addresses separated by spaces or on a new line.
5. Save the settings and reboot the router.

Make sure all required devices are connected to the network.

Write down the MAC addresses on paper or in notes.

Check if your router supports MAC filtering (some ISP models do not)

Create a backup copy of your router settings in case of an error-->

The downside of this method: if you buy a new device or have guests over, you'll have to go into settings and add a new MAC address each time. For such cases, it's best to combine this method with guest network (we will talk about it below).

⚠️ Warning: MAC addresses can be spoofed, so this method does not provide 100% protection. For critical networks, use it in conjunction with hiding the SSID And complex WPA3 password.

3. Method 2: Blocking specific devices

If you detect an unknown device on the network, you can block it directly—without filtering all other devices. This method is convenient when you only need to block a few devices.

Instructions for ASUS RT-AX88U (similar for other models):

1. Open the client list: Network Map → Clients.
2. Find the suspicious device (pay attention to Host name And IP address).
3. Click on it and select "Block".
4. Set the blocking time (forever or for a few hours).

On Keenetic the path will be different:

Devices → Connected devices → [Select device] → Block

For the block to work, the device must be currently connected to the network. If it disconnects, the router may "forget" its MAC address the next time it connects. To permanently block the device, add the MAC address to the blacklist (usually in the same settings section).

Once a month

Only when I notice speed problems

Never checked

I use automatic notifications about new devices-->

4. Method 3: Scheduled Restriction

If you want Wi-Fi to work only during certain hours (for example, from 8:00 to 22:00), set access scheduleThis is useful for:

• 🏠 Offices where the internet should not work at night.
• 👨‍👩‍👧‍👦 Families with children (limited evening access).
• 🏨 Guest networks in hotels or rented apartments.

Example setup for TP-Link TL-WR841N:

1. Let's go in Wireless Mode → Wireless Schedule.
2. We enable the function and add a rule (for example, Mon-Fri, 08:00-22:00).
3. Apply the settings. Now Wi-Fi will turn off automatically at night.

On Keenetic this is done through Home Network → Schedules, where you can create multiple profiles (for example, separately for the main and guest networks). Some routers (for example, ASUS) allow you to link a schedule to specific devices, so you can limit access time only for children without affecting adult devices.

⚠️ Note: When using the schedule, please note that some devices (e.g. IP cameras or smart speakers) may require a constant connection. It's best to create an exception for them or use a separate network.

5. Method 4: Guest network with restrictions

The most elegant way to restrict access is to create guest network with a separate password and restrictions. This will allow you to:

• 🔒 Grant access to guests without revealing the main password.
• 📉 Limit speed for guest devices.
• 🚫 Deny access to local resources (printers, network drives).
• ⏰ Set up a separate work schedule.

How to set up on ASUS RT-AX55:

1. Let's move on to Guest network (tab on the left).
2. Enable guest access and set:
   • SSID (network name, eg Guest_WiFi),
   • Password (minimum 8 characters, preferably WPA2/WPA3),
   • Speed ​​limit (eg. 10 Mbps),
   • Working hours (optional).

Activate the option "Isolate guest clients" (so that they don't see each other).

Save the settings.

On MikroTik The guest network is configured via IP → Hotspot or Wireless → Security Profiles (depending on the firmware). To make things easier, you can use virtual AP (Virtual AP), which creates an additional access point with different security settings.

What to do if the guest network does not appear in the list

Make sure that the function is supported by your router model (check the documentation).

Update your firmware to the latest version - in older versions, the guest network may be hidden.

Try disabling the main network, saving the settings and enabling it again.

If nothing helps, use VLAN to separate traffic (advanced method).

A guest network doesn't replace basic security measures—it still needs to be protected with a strong password and the router's firmware needs to be updated regularly.

6. Method 5: Parental Control

If you need to not just restrict access, but control What websites do children visit? or how much time do they spend online, use the built-in parental controlThis feature is available in all modern routers, but its capabilities vary greatly:

• 🕒 Time limit: for example, 2 hours a day for social networks.
• 🚫 Blocking websites: by keywords (for example, "torrent") or categories (gambling sites, adult content).
• 📊 Usage statistics: which devices and when were online.

Example setup for Keenetic:

1. Let's move on to Parental Controls → Profiles.
2. Create a new profile (for example, "Children") and bind devices to it by MAC or IP.
3. Setting up the rules:
   • Deny access to categories "Social media" And Games from 10:00 pm to 8:00 am.
   • We limit the total time on the Internet to 3 hours a day.

Let's activate the profile.

On TP-Link parental control is hidden in Additional settings → Parental controlsYou can block websites by URL or keywords, but there are no flexible schedules. For advanced features (like YouTube blocking), it's better to use specialized apps like Kaspersky Safe Kids or Norton Family, which operate at the device level, not the router level.

⚠️ Warning: Children quickly learn to bypass blocks. For reliability, combine parental controls on your router with settings on their devices (e.g. screen time on iPhone or family bond on Android).

7. Additional security measures

Limiting connections is only part of the protection. To ensure your network is truly secure, follow these steps:

• 🔐 Change the default password for the admin panel: many routers have default admin/admin or admin/1234. Use a complex password (e.g. T7#pL9!kM2@q).
• 🔄 Update the firmwareVulnerabilities in older versions allow you to bypass all restrictions. Check for updates every three months.
• 📡 Disable WPS: This feature simplifies connection, but it is easy to hack (even without a password). The setting is usually located in Wireless Mode → Security.
• 🔍 Hide SSID: Your network won't appear in the public list, but you can still connect to it manually. Cons: This doesn't protect against targeted attacks.
• 🌐 Use WPA3: If your router supports this standard (available since 2018), enable it in the security settings.

To check your network security, you can use free tools:

• Wireshark — traffic analysis.
• Fing (mobile application) - scanning devices on the network.
• RouterPasswords — a database of default passwords for routers (to make sure you have changed the default one).

FAQ: Frequently Asked Questions

Is it possible to limit the speed for a specific device?

Yes, but not on all routers. ASUS this is done through Adaptive QoS → Bandwidth LimitingOn . Keenetic - V Traffic → Restriction RulesIf there is no such function, use guest network with a general speed limit.

How do I find out who has connected to my Wi-Fi without permission?

Take a look at the client list (DHCP Clients or Connected Devices). Unknown devices usually have strange names (for example, android_123456) or unrecognized MAC addresses. For accurate identification, use a network scanner. Fing - it will show the device manufacturer by MAC.

What should I do if my router doesn't support MAC filtering?

Possible solutions:

1. Update your firmware - sometimes this feature appears in new versions.
2. Use static DHCP: Bind IP addresses to MAC manually and disable IP distribution for unknown devices.
3. Buy a router with support VLAN or ACL (For example, MikroTik or Ubiquiti).

Is it possible to restrict Wi-Fi access based on geolocation?

No, the router can't determine the geolocation of devices. But you can:

• Use range: Reduce the transmit power (Transmit Power) in the Wi-Fi settings so that the network is not available outside your apartment.
• Tune white geozone on children's smartphones (via family services) Google or Apple).

Why does the device still connect after being blocked?

Possible reasons:

• Device cloned MAC another permitted gadget.
• You blocked him by IP, and not by MAC (IP may change).
• The router did not save the settings - try rebooting it.
• It's working online second router in repeater mode (check 192.168.0.2 or 192.168.1.2).

Check your router logs (System log) - there may be hints there.