In today's digital world, home network security is becoming a top priority for every router owner. An unknown device connected to your Wi-Fi network can not only slow down your internet speed but also pose a direct threat to your personal data. That's why the question of how to disable Wi-Fi by MAC address is one of the most frequently asked questions among users seeking to control access to their local network.
Filtering by a unique network card identifier is considered one of the most reliable methods of restricting access, although it requires some preparation. Unlike simply changing a password, which can be intercepted by specialized sniffers, linking access rights to the device's hardware creates an additional barrier to attackers. In this article, we'll examine in detail the mechanics of filtering, methods for obtaining identifiers, and step-by-step instructions for various hardware models.
How MAC filtering works and its effectiveness
Every piece of network equipment, be it a smartphone, laptop, or smart light bulb, has a unique physical address assigned by the manufacturer at the factory. Media Access Control The address serves as a digital ID for the device within the local network. When you configure the router to operate in whitelist mode, it only allows connections from devices whose addresses are included in the allowed database, ignoring all other requests.
There's also a blacklist mode, which works the opposite way: everyone has access except those on the block list. However, for maximum security, experts recommend using a whitelist, as it ensures that no unauthorized device can connect, even if they know the Wi-Fi password. MAC filtering does not encrypt traffic, but effectively cuts off unwanted clients at the authorization stage.
⚠️ Please note: MAC addresses can be spoofed (cloned) using specialized software. Therefore, this security method should be used in conjunction with complex WPA2/WPA3 encryption, not as the sole security measure.
It's important to understand that managing an access list requires discipline: if you buy a new phone or have guests over, you'll have to manually change your router settings. This creates a certain level of inconvenience, but it's entirely worth it for the increased security of your network perimeter.
Preparation: How to find a device's MAC address
Before setting up restrictions, you need to gather information about the legitimate devices that will be allowed to connect. There are several ways to obtain this data, and the method you choose depends on the device you're currently using. The easiest way is to look at the address on a device already connected to the network or find a sticker on the device's body.
On Android smartphones, the path usually lies in the settings menu. You need to go to the section About the phone, then select General information or find the item directly Status. The Wi-Fi MAC address will be listed there. On Apple iPhone and iPad devices, the procedure is slightly different: go to Settings, further Main, then About this device and find the line Wi-Fi address.
- 📱 On Android: Settings → About phone → General information → Status.
- 🍏 On iOS: Settings → General → About → Wi-Fi Address.
- 💻 On Windows: Command Prompt → command
ipconfig /all→ Physical address. - 🖥️ On macOS: System Preferences → Network → Wi-Fi → Advanced → Wi-Fi Address.
For Windows computers, you can use a quick method via the command line. Press the key combination Win + R, enter cmd and in the window that opens, enter the command getmac or ipconfig /allYou're interested in the "Physical Address" string, which looks like a set of six pairs of hexadecimal digits separated by hyphens or colons.
General steps for accessing router settings
Filtering is managed directly in the router's web interface. To access it, connect your computer or smartphone to the router's network (via cable or Wi-Fi) and open any browser. Enter the device's IP address in the address bar, which is usually set to 192.168.0.1 or 192.168.1.1The exact address is usually indicated on a sticker on the bottom of the case.
After entering the address, the system will request authorization. The standard login and password are also located on the factory sticker; it is often a combination admin/adminIf you've previously changed your login information and forgotten it, you'll need to perform a factory reset (hard reset) of the router using the button on the device.
| Router brand | Standard IP | Default login | Default password |
|---|---|---|---|
| TP-Link | 192.168.0.1 | admin | admin |
| ASUS | 192.168.1.1 | admin | admin |
| Keenetic | 192.168.1.1 | admin | 1234 |
| D-Link | 192.168.0.1 | admin | (empty) |
Interfaces from different manufacturers may look significantly different, but the logic for finding the desired section remains similar. Look for tabs labeled "Wireless," "Wi-Fi," or "Guest Network." Within these sections, you'll usually find a subsection called "MAC Filter."
Setting up filtering on TP-Link routers
The setup process for devices from the popular TP-Link brand is fairly straightforward and easy to understand, even for beginners. After logging in, navigate to the menu. Wireless mode (Wireless) and select the item MAC address filter (Wireless MAC Filtering). Here you'll see the current status of this feature, which is often disabled by default.
To get started, click the button Turn on (Enable). Next, you'll need to select a filtering rule. If you want to disable Wi-Fi by MAC address for specific intruders, select "Deny" (Deny). If you want to allow access only to trusted devices, select "Allow" (Allow).
☑️ Setting up TP-Link
After selecting the rule, click the button Add new (Add New). In the window that opens, enter the MAC address of the device you want to block or allow. In the "Description" field, you can enter a descriptive name, such as "Son's Phone" or "Laptop," to avoid confusion. Don't forget to click Save.
⚠️ Note: On some TP-Link router models, changes take effect only after a device reboot. If the filter doesn't work immediately, reboot through the "System Tools" menu.
It's important to note that newer firmware versions with the blue interface (Tether OS) may have slightly different logic. They often use the "Guest Network" list or a separate "Clients" menu item, where you can simply tap on a device and select the "Block" option, which will automatically add it to the blacklist.
Instructions for ASUS and Keenetic equipment
ASUS routers are renowned for their sophisticated ASUSWRT interface. To configure access, go to the section Wireless network (Wireless) and select the tab MAC address filterHere you need to set the switch “Enable MAC address filtering” to the position Yes.
Next, select the operating mode. To block specific devices, select "Reject Mode," and to create a whitelist, select "Accept Mode." Enter the addresses into the table, and then click the "Enter" button. Apply (Apply) at the bottom of the page. Without this step, the settings will not be saved.
Keenetic (formerly ZyXEL) devices are configured via the web configurator. Go to the menu My Networks and Wi-Fi, then Home networkScroll down to the "MAC Address Filter" section. Here you can flexibly configure rules: allow or deny access, as well as set a schedule for the rules, which is unique. chip this manufacturer.
Keenetic's Secret Function
Keenetic routers allow you to set up scheduled access. For example, you can block Wi-Fi access for children's tablets from 11:00 PM to 7:00 AM, even if they are whitelisted.
Please note that Keenetic displays the client list in real time. You can see an active device in the list of connected devices, click on it, and select "Block," which will automatically create a corresponding filter rule. This significantly simplifies the process of preventing "neighborly" connections.
Compatibility issues and protection bypass
Despite its high effectiveness, MAC filtering has its vulnerabilities. Modern operating systems, such as iOS 14+ and Android 10+, use the "Private Wi-Fi Address Randomization" feature by default to enhance user privacy. This means the phone will present itself to the router as a random address, and your static filtering will no longer function correctly.
To avoid connection issues with authorized devices, you need to find the settings for a specific Wi-Fi network on your smartphone or laptop and disable the "Private Address" or "Use Random MAC Address" options. Only then will the device begin broadcasting its real physical address, which you entered in the router settings.
- 🔒 Address randomization interferes with the operation of static filters.
- 🔄 When you reset your phone, the address may change.
- 🛡️ Attackers can clone the address of a trusted device.
It's also worth mentioning that experienced hackers can use tools to monitor the airwaves, wait until an authorized device (like your phone) is offline, copy its MAC address, and replace their own. Therefore, MAC filtering — This is a great additional barrier, but it's not a panacea. Always use strong passwords and up-to-date encryption protocols.
What should I do if I blocked myself?
If you've configured the whitelist (Allow) but forgot to enter your device's MAC address, or blocked the current PC via the blacklist, you'll lose access to the router's Wi-Fi settings. The only solution is to connect to the router via an Ethernet cable (LAN). Wired connections are typically not filtered by Wi-Fi interface MAC addresses. If you don't have a cable, you'll have to reset the router using the Reset button.
Is it possible to filter devices by time?
Standard MAC filtering doesn't have a timer. However, many modern routers (Keenetic, TP-Link with new firmware) have a "Parental Control" or "Guest Access" feature that allows you to set an internet schedule for specific MAC addresses. This is a more flexible tool for restricting children's access.
How many MAC addresses can be added to the list?
The limit depends on the router model and its RAM capacity. Budget home models typically support 16 to 32 filter entries. For enterprise and high-end home systems (such as Asus with Merlin or Mikrotik firmware), this limit can reach hundreds of entries. This is more than sufficient for home use.