A modern home network requires strict access control, especially when dozens of connected devices are involved. You might not even suspect that a neighbor or an intruder has connected to your internet and is using your access point for illegal activities. MAC address filtering is one of the most reliable ways to ensure that only devices you trust are on the network.
Unlike simply hiding the network name (SSID) or using a complex password, the whitelisting method works at the hardware identifier level. This means that even with your password, someone else won't be able to connect unless their device is listed as an authorized client on the router.
In this article, we'll take a detailed look at setting up filtering, explain where to find your gadgets' MAC addresses, and how to avoid common mistakes when administering your home network. Please note: router interfaces may differ, but the logic of actions remains universal for most TP-Link, ASUS, Keenetic and MikroTik models.
How MAC address filtering works
Every networked device, whether it's a smartphone, laptop, or smart light bulb, has a unique physical address known as MAC addressIt consists of 12 hexadecimal characters and is programmed into the network adapter at the factory. Routers use this identifier to route data packets within the local network.
When you enable "Allow List" mode, the router ignores all connection requests except those from pre-authorized addresses. This creates a strict security perimeter. If a device isn't on the list, the router simply won't assign it an IP address, and internet access will be impossible, even if the Wi-Fi password is entered correctly.
⚠️ Note: MAC addresses can be spoofed (cloned), so filtering alone is not enough for critical corporate networks. However, for home use, this method is more effective than 95% of attacks by regular users.
There are two filter modes: Allow and Deny/Blacklist. In this mode Blacklist You block specific "unwanted guests" while allowing others free access. Mode Whitelist, which we are considering, works the other way around: by default, access is closed to everyone except selected people.
Preparation: How to Find the MAC Address of Your Devices
Before making any changes to your router settings, you should create a list of the MAC addresses of all devices that need to access the network. If you forget to add the address of your smartphone or laptop, you'll lose access to the router's Wi-Fi settings and will have to connect via cable.
You can find this address in the settings of each device. Below are instructions for the most popular operating systems. Write this information down or keep the table handy.
- 📱 Android: Go to
Settings → About phone → Status(the path may differ depending on the Android version and shell). - 🍎 iOS (iPhone/iPad): Go to
Settings → General → Aboutand find the line "Wi-Fi address". - 💻 Windows: Open command prompt (cmd) and enter the command
ipconfig /all, then find the "Wireless Network" section and the "Physical Address" line. - 🍏 macOS: Click
Optionand click on the Wi-Fi icon in the menu or go toSystem Preferences → Network → Wi-Fi → Advanced.
It's important to distinguish between MAC addresses for different interfaces. If a laptop has both a wired port (Ethernet) and a Wi-Fi module, they will have different addresses. To set up Wi-Fi access, you need the wireless adapter's address. Also, pay attention to the format: some routers require the address to be entered separated by colons (AA:BB:CC:DD:EE:FF), while others require hyphens or a solid entry.
In modern devices with Android 10+ and iOS 14+, the function is enabled Randomized MAC Address (random MAC address) to increase privacy on public networks. For a home network with filtering, this feature is necessary. turn off in the Wi-Fi settings of a specific connection, otherwise the router will stop recognizing your device after a reboot.
☑️ Preparing to set up filtering
Setting up a whitelist on popular routers
The setup process may vary depending on the hardware manufacturer and firmware version. However, the general logic remains the same: log in to the web interface, find the wireless network section, and enable filtering. Let's look at the specifics for different vendors.
On devices TP-Link (new interfaces with blue background) the path usually looks like this: Advanced Settings → Wireless → Wireless MAC FilteringHere you need to enable the filter, select the "Allow" rule, and add new entries, entering the MAC addresses and device descriptions.
In routers Keenetic (formerly ZyXEL) mechanism is even more flexible. In the menu My Networks and Wi-Fi → Client List You can simply click on the connected device and toggle the switch between "Always Allow" and "Block." The system will automatically offer to save the rule to a permanent list.
| Manufacturer | Menu section | Function name | Default mode |
|---|---|---|---|
| TP-Link | Wireless / MAC Filtering | MAC Filter List | Disabled |
| ASUS | Wireless Network / MAC Filter | Access Control List (ACL) | Disabled |
| Keenetic | My Networks and Wi-Fi | Client list | Allow everyone |
| MikroTik | Wireless / Access List | Access List | Accept everything |
For routers ASUS you should go to the section Wireless network, select a tab MAC address filterSet "Filtering Mode" to "Accept" (which corresponds to the whitelist), and enter addresses manually or select them from the list of connected clients.
What to do if the router does not support filtering?
Some older or more basic router models (often carrier-grade versions) may lack MAC filtering. In this case, the only solution is to replace the hardware with more advanced ones or install alternative firmware (such as OpenWrt or DD-WRT), if the model supports it.
Common errors and access problems
After enabling filtering, users often encounter a situation where "everything stops working." This is a normal security response if you forgot to add the current device to the whitelist. If you were setting up a Wi-Fi network and forgot to add your laptop to the whitelist, the connection will be lost immediately after applying the settings.
Another common issue is confusion between the 2.4 GHz and 5 GHz bands. Some routers assign different MAC addresses for different frequency bands (the guest network may also have its own virtual MAC address). Make sure you add the address used for your primary connection to the list.
⚠️ Note: If you lose access to your router after setup, the only way to regain control is to perform a full reset using the button on the device or connect to the device via a LAN cable if the router allows cable access even when Wi-Fi is blocked.
It's also worth keeping in mind that every time you buy a new phone or laptop, you'll have to manually enter its MAC address into your router settings. This is a small price to pay for increased security, but it requires discipline from the network administrator.
Don't forget about guest networkIf you have friends over, don't disable filtering for their sake. It's better to create a separate guest network with a simple password, but without access to your local resources (printers, NAS storage), and don't apply a strict MAC filter to it.
Alternative and additional methods of protection
While MAC address whitelisting is a powerful tool, it shouldn't be your only line of defense. An attacker could sniff the airwaves, see the MAC address of an authorized device (like your smartphone), and clone it onto their adapter, bypassing your defenses.
Therefore, it is critical to use encryption. WPA2-PSK (AES) or the newest WPA3Stop using the outdated WEP protocol, which can be cracked in seconds even by a schoolchild with a phone. The combination of a complex password and a MAC filter creates multi-layered protection.
Additionally, it is recommended to disable the function WPS (Wi-Fi Protected Setup). Despite the convenience of push-button connection, this protocol has vulnerabilities that allow PIN recovery and network access without the password.
- 🔒 Changing the default password: Always change the factory administrator password of your router.
- 📡 Disabling remote control: Disable access to router settings from the external network (WAN).
- 🔄 Firmware update: Check the manufacturer's website regularly for security updates.
For advanced users, customization is available. VLAN (Virtual LAN). This allows you to isolate IoT devices (smart plugs, light bulbs, cameras), which often have weak security, into a separate network segment that has no access to your computers and files.
Frequently Asked Questions (FAQ)
Does enabling MAC address filtering affect internet speed?
No, filtering does not affect speed. Address verification only occurs when the device connects to the network. After successful authorization, traffic is transmitted at the full speed supported by your plan and equipment.
Is it possible to bypass MAC filter?
Yes, a skilled hacker can intercept the MAC address of an authorized device and spoof it. Therefore, this method isn't considered completely reliable for protecting government or banking secrets, but for home use, it will deter 99% of potential intruders.
What if I sold a phone that was authorized for access?
Be sure to remove the MAC address of the device you've just sold from the whitelist in your router settings. Otherwise, the new owner of the phone (if they reset the settings to factory defaults and the MAC address is restored) could theoretically connect to your network if they know the password.
How many devices can be whitelisted?
The limit depends on the router model. Budget home models typically support 16 to 32 entries. More powerful routers (like the Keenetic Giga or ASUS RT-AX series) can store hundreds of entries, which is enough for even a large office.