Many users are familiar with the situation where internet speed drops for no apparent reason and the router's lights flash wildly. Often, this is caused by an uninvited guest that has managed to connect to your wireless network. This isn't just an annoying issue that reduces the quality of streaming or online gaming, but also a real threat to the security of your personal data.
The most effective way to combat "parasites" is to enter their MAC addresses into blacklist Router Blacklisting. This method allows you to forcibly disconnect from a specific device and permanently prevent it from reconnecting, even if the attacker knows the correct WiFi password.
Unlike a simple password change, which requires reconnecting all your personal devices, MAC address filtering is targeted. You block only the intruder, leaving your home network functioning unaffected for authorized users. Below, we'll explain in detail how to find the intruder and permanently block their access.
How to detect an intruder connected to the network
Before blocking, you need to accurately identify the device. Modern routers have built-in monitoring tools that display all active connections in real time. First, you'll need to log into the router's control panel via the web interface.
Open your browser and enter the router's IP address in the address bar, most often it is 192.168.0.1 or 192.168.1.1After entering your login and password (they're on the sticker on the bottom of the case if you haven't changed them), find the section responsible for network status. It may be called Client List, Wireless Status, DHCP Client List or "Client List".
Carefully review the list of connected devices. Look for unfamiliar names or MAC addresses. If you only have smartphones and laptops at home, and an unknown device appears on the list, Android Device or Unknown, this is most likely the intruder. To accurately identify the device, you can temporarily disable WiFi on your devices and see which device disappears from the list.
⚠️ Note: Some mining programs or VPN services may mask the device name. If you see a device with a name similar to yours but a different MAC address, be sure to verify it by comparing it with the address on the device itself.
What is MAC filtering and how does it work?
The filtering technology is based on a unique network interface identifier known as MAC addressThis is a physical address assigned by the manufacturer to each network card, smartphone WiFi module, or TV. It consists of 12 hexadecimal characters and looks something like this: 00:1A:2B:3C:4D:5E.
The router has two filtering modes: "Allow List" and "Deny List." In "White List" mode, only devices whose addresses you've manually entered into the database can access the network. All others, even with the password, will be blocked. This is the highest level of protection, but it's inconvenient if you have frequent guests.
The blacklist mode discussed in this article works in reverse. The router allows everyone except those on the blacklist. This is ideal for targeting specific offenders without having to reconfigure all your personal smartphones and tablets.
Is it possible to spoof a MAC address?
Yes, advanced users can clone the MAC address of an authorized device onto their own device. However, for simple "neighborly WiFi theft," this is too complex a manipulation, so standard blocking is sufficient.
Step-by-step instructions: setting up a blacklist on routers
Interfaces vary from manufacturer to manufacturer, but the logic remains the same. You need to find the section related to wireless security or access control. This is usually located in the menu. Wireless → Wireless MAC Filtering or Advanced → Security.
Let's look at the process using popular brands as an example. First, enable the filtering function. Then, select the "Deny" or "Blacklist" mode. Then, click the "Add New" button and enter the MAC address of the intruder you found in the previous step.
Some router models, for example TP-Link or Asus, allow you to select a device directly from the list of current connections (DHCP Client List), eliminating the need to manually enter the address. Simply check the box next to the desired client and select "Block."
☑️ Blocking algorithm
After saving the settings, the router may require a reboot. At this point, the connection with the intruder will be severed. If the device attempts to connect again, the router will immediately reject the authorization request.
Configuration features for different router models
The location of settings may vary depending on the firmware and brand. To make it easier for you to navigate, we've prepared a table with approximate paths to the necessary functions for common models.
| Router brand | Menu section | Function name |
|---|---|---|
| TP-Link | Wireless → Wireless MAC Filtering | Enable / Deny |
| Asus | Wireless → MAC Address Filter | Reject MAC addresses |
| D-Link | Wi-Fi → MAC Filter | Ban / Blacklist |
| Keenetic | My Networks and WiFi → Access | Blocking devices |
| Tenda | Wireless Settings → Wireless MAC Filter | Forbidden |
Please note that in routers Keenetic and some modern models MikroTik Access control is implemented through a more flexible profile system. It allows you to not only block a device, but also limit its speed or access to specific resources.
If you are using a router from an internet service provider (for example, Sagemcom or Sercomm), the interface may be limited. In such cases, look for the "Parental Controls" or "Guest Network" section, as MAC filtering functionality is sometimes hidden there.
Additional wireless network security measures
Blocking alone isn't enough if your network is poorly secured to begin with. Once you've blacklisted the offender, it's highly recommended to strengthen your overall security. The first step should be changing your WiFi password, even if you haven't changed it before.
Use a strong encryption algorithm. In the wireless security settings (Wireless Security) select the mode WPA2-PSK or WPA3Old WEP and WPA standards are easily cracked by automated programs in a matter of minutes, rendering any blacklists useless.
Also disable the feature WPS (Wi-Fi Protected Setup). This technology allows you to connect to a network by pressing a button or entering a PIN, but it contains critical vulnerabilities that allow hackers to bypass the password and gain full access to the network.
⚠️ Note: Router interfaces are constantly being updated. The location of menu items may differ from those described. If you don't find an exact match, look for synonyms: Filter, Access Control, Ban, Block.
Common problems and solutions
Users may encounter a situation where a device continues to appear in the list of connected devices even after being blacklisted. This may be due to data caching on the router or the client itself. Try rebooting the router by unplugging it for 10-15 seconds.
Another common problem is "MAC address randomization." Modern versions iOS And Android By default, random MAC addresses are used for each new network for privacy purposes. If an attacker uses this feature, blocking a specific address may not help, as the next time their device connects, it will present itself as a new address.
In the case of randomization, the only solution is to change the WiFi password and switch to "Whitelist" mode if you have a small number of devices. Also, check to see if anyone is connecting through a guest network, which often has separate access and isolation settings.
If you've blocked your device, but it's still consuming traffic, it's possible an attacker has managed to hack into the router's settings. In this case, only a hard reset will help.Reset) devices to factory settings and setting a new administrative password.
Questions and Answers (FAQ)
Will a blocked user be able to connect again if I simply change the password?
Yes, if you don't block their MAC address but only change the password, they'll be able to reconnect once they know the new password. The blacklist works regardless of the password.
Does a blocked user see that they have been blocked?
No, it will look like a normal connection failure. The device will try to connect endlessly or return a "Failed to connect" error, but won't receive a blocking notification.
Is it possible to temporarily lock a device and then unlock it?
Of course. In the same MAC filtering section, you can remove an address from the list or temporarily disable the filtering function itself by unchecking the "Enable" box.
Does a large number of blacklisted entries affect the speed of the router?
On modern models, no. However, if you add hundreds of addresses, this may slightly increase the load on the router's processor when processing access tables, but for home use, this is unnoticeable.