The issue of restricting access to a home network is becoming increasingly important for router owners. It is often necessary to temporarily block a specific device from accessing the internet or completely block access to the local network. Equipment owners Zyxel Keenetic have at their disposal powerful tools for managing connected clients.
Modern firmware KeeneticOS Provide flexible traffic filtering mechanisms. You can use both hard blocking by hardware address and temporary speed limiting. Understanding these processes will allow you to effectively manage the load on your communication channel.
In this guide, we'll cover all available methods for isolating unwanted devices. We'll cover security, setting up guest access, and manually managing the trusted client list. The router does not require a reboot to apply the changes; the settings take effect instantly.
Identifying a device in the list of connected clients
The first step before restricting access is to accurately identify the target device. The router interface displays all active connections, but sometimes it can be difficult to associate a device name with a specific user. First, log in to the web configurator.
Enter in the address bar of your browser 192.168.1.1 or my.keenetic.netAfter entering your credentials, go to the system's main page. Here, in the "Client List" or "Home Network" section, you'll see a graphical representation of your network.
Please note MAC address and the IP address of each node. If the device name isn't obvious (e.g., "android-12345"), try clicking on the gadget's icon. The window that opens often displays the network card manufacturer, which helps identify whose phone or laptop it is.
For more detailed diagnostics, you can use the built-in utilities. Go to the menu Client List β DetailsThis displays the IP address lease time and current connection speed. If the device is actively downloading data, this will be immediately visible in the traffic indicators.
β οΈ Caution: If you see a device you don't recognize, don't rush to block it. It could be a smart light bulb, TV, or printer that uses standard manufacturer names.
Using a Blacklist to Block
The most direct way to block access is to blacklist the device. This method completely breaks the connection between the client and the router at the data link layer. The device will not be able to obtain an IP address or access network resources.
To implement this method, go to the menu My Networks and Wi-Fi β Access ListsHere you need to select the filter mode. Make sure the "Blacklist" mode is enabled. In this mode, all devices except those added to the exceptions have access, while those on the list are blocked.
βοΈ Check before blocking
Adding a device takes just a few clicks. On the main page, find the desired device in the client list. Click the edit icon or the shield. In the menu that opens, select "Block" or "Add to blacklist."
After adding a MAC address to the filter, the connection to that device will be broken. Even if the user knows the WiFi password, the router Zyxel will ignore the authorization request. This is a reliable method of protecting against repeated connection attempts.
Setting up MAC address filtering in the whitelist
An alternative to blacklisting is "Whitelist" mode. This is a more stringent security method that denies access to everyone by default. Only devices whose MAC addresses are explicitly listed in the allowed list are allowed access.
Switching to this mode requires caution. If you accidentally fail to whitelist your current control device, you will lose access to the router settings. Therefore, always add your computer or smartphone to the exceptions list first.
The setting is carried out in the same section. Access listsSelect "Whitelist" mode. The system will warn you about the risk of losing access. After confirmation, add the MAC addresses of all trusted devices. New devices attempting to connect will see the network but will not be able to authenticate.
| Opening hours | Operating principle | Security level | Difficulty of setup |
|---|---|---|---|
| Blacklist | Blocks only selected devices | Short | Low |
| Whitelist | Allows only selected devices | High | Average |
| Guest network | Isolates guests from the main network | Average | Low |
| Disabling WiFi | Complete loss of wireless connection | High | Low |
Using a whitelist is ideal for small offices or apartments where it's important to prevent unauthorized access even if the password is leaked. However, for larger families with frequently changing devices, this method can be inconvenient due to the need to constantly manually register new devices.
What to do if you've blocked yourself?
If you enabled the whitelist and didn't add your device, you'll need to connect to the router via a LAN cable. A wired connection is typically not filtered by WiFi filtering rules. After connecting via cable, edit the access list in the web interface.
Restricting access via a guest network
If your goal is not to completely disable a user, but to limit their rights, a guest network is the best solution. Zyxel Keenetic Allows you to create up to four virtual access points with separate security settings.
A guest network isolates clients from the main local network. Guest WiFi users will be able to access the internet but won't be able to see your computers, network-attached storage (NAS), or printers. This is ideal for temporary visitors.
The setting is made in the section My Networks and Wi-Fi β Guest NetworkActivate the access point, set its name (SSID) and password. In the security settings, be sure to check "Isolate clients" and "Restrict access to router settings."
You can also set speed limits for the guest network to prevent guests from hogging your entire bandwidth. In the section Traffic prioritization Set maximum download and upload speeds for the guest interface. This will preserve internet performance for primary users.
β οΈ Note: Firmware interfaces may vary depending on the router model and KeeneticOS version. If you can't find a parameter, check the official documentation for your specific device series.
Temporarily disabling a WiFi module or a specific client
Sometimes you need to quickly "kick" all users or temporarily stop broadcasting a signal. This doesn't require delving into complex filter settings. The main page of the web interface has a quick access button for checking the status of WiFi modules.
Click the wireless network icon in the top or side menu. Select "Turn off Wi-Fi." The radio will stop transmitting, and all devices will lose their connection. This is convenient at night or when maximum electromagnetic silence is needed.
To automate this process, use a schedule. Go to System β ScheduleCreate a new rule, such as "Night Mode." Specify the days of the week and time interval when WiFi should be disabled. Apply this schedule to wireless interfaces.
If you only need to temporarily disable one client, the easiest way is to change the WiFi network password. After changing the password, go to My Networks and Wi-Fi, all devices will be disconnected. You'll only have to reconnect your own devices, while the "unwanted guest" will be left behind, unaware of the new security key.
Log analysis and activity monitoring after blocking
After applying the blocking settings, it is important to ensure that they work correctly. System KeeneticOS Maintains detailed event logs. Checking the logs allows you to identify unauthorized access attempts or configuration errors.
Go to the section System β JournalAll system events are displayed here. Look for entries like "Association denied" or "Authentication failed." These messages indicate that the device is attempting to connect but is being rejected by the router.
It's also useful to monitor the CPU load. If the blocked device is infected with a virus and attempts to attack the network (for example, a brute-force attack or port scan), this can create unnecessary load. In the section Monitoring Monitor CPU load graphs.
For advanced users, a notification feature is available. The router can send email notifications about critical events, such as successful login of a new administrator or changes to the security configuration. Configure this setting in the section System β Notifications.
Frequently Asked Questions (FAQ)
Is it possible to disable a device without knowing its MAC address?
Yes, in the interface Zyxel Keenetic You can block a device directly from the list of active clients on the main page. You don't need to manually enter the MAC address; simply click the block button next to the device name. However, to configure permanent filters (whitelist/blacklist), you still need to know the MAC address.
Will a power outage reset my router?
No, simply powering off or rebooting the router does not reset the blacklist or whitelist settings. They are stored in non-volatile memory. However, if you have forgotten the password for the admin panel, you will need to perform a hard reset using the button on the router, which will restore all factory settings, including the open WiFi network.
Will the user see that he has been blocked by the router?
The user won't receive a special "You've been blocked" message. Their device will simply try to connect endlessly or receive the "Obtaining IP address..." status, then return a connection error. To the user, this will appear as a network failure or an incorrect password.
How can I bypass the block if I forgot to add my phone to the whitelist?
The only way is to connect to the router via an Ethernet cable (LAN). Wired connections are typically not subject to WiFi MAC address filtering. Once connected, go to the settings and add your wireless adapter to the list of allowed devices.