In today's digital world, a home network has become more than just a way to access the internet, becoming a smart home control center, a personal data storage device, and a workspace. An unwanted guestA malicious user who connects to your Wi-Fi network without your knowledge can not only steal your traffic but also access confidential files on your computers or even CCTV cameras. This can cause your connection speed to drop to critical levels, making it impossible to watch high-definition videos or play online games smoothly.
Fortunately, router manufacturers have provided powerful tools to protect the network perimeter. Blocking access This isn't just a password change, but a set of measures that allows the network administrator (you) to fully control the list of connected clients. You can temporarily disable a specific user, create a "blacklist" for unauthorized users, or, conversely, allow access only to trusted devices while blocking all others.
The process of restricting access rights varies depending on the router model and firmware version, but the basic principles remain the same. The key identifier of a device in a local network is the MAC address., a unique code assigned to a network card or Wi-Fi module during manufacturing. This code is the basis for the most reliable filters, which we'll examine in this article, covering popular brands and universal protection methods.
Analysis of connected devices and search for violators
Before taking decisive action and blocking, it's essential to clearly identify who exactly is on your network. Users often mistake their own devices for someone else's, so a thorough audit should always be the first step. To do this, you'll need to log into your router's web interface by entering the gateway IP address in the browser's address bar. This is usually 192.168.0.1 or 192.168.1.1.
After logging in (the default login and password are often found on a sticker on the bottom of the device, unless you've changed them), find the section responsible for traffic monitoring. Depending on the brand of your device, this section may have different names: "Client List," "DHCP Client List," "Wireless Status," or "Wireless Network Status." This section displays a table of all active connections.
⚠️ Important: If you see devices with "Unknown" names or strange MAC addresses, don't rush to block them. First, disable Wi-Fi on all your devices and see if the suspicious entry disappears from the list. This will help prevent smart plugs or printers from being blocked.
For accurate identification, it is recommended to check the MAC addresses against those specified in the settings of your smartphones and laptops. On Android, this can be found in the Settings → About phone → General information, and on the iPhone in Settings → General → AboutIf there's a device left in the router's list that doesn't physically match any of your devices, it means someone else is using your access rights.
Setting up MAC address filtering (Blacklist and Whitelist)
The most effective and widespread access control method is MAC address filtering. This mechanism allows you to create two types of lists: a "Blacklist," which includes devices denied access, and a "Whitelist," which includes only trusted devices, with access to all others automatically blocked.
To configure Blacklist, find the "MAC Filtering" or "Access Control" section in the router menu. Once enabled, select "Deny" and add the MAC address of the intruder you identified in the previous step. After saving the settings and rebooting the router, the device will lose the connection and will be unable to reconnect, even with the correct Wi-Fi password.
Whitelist mode is more restrictive and secure. When enabled, only devices whose MAC addresses are included in the list will be able to connect to the network. This guarantees, that even if someone finds out your password, they will not have access to the Internet, since their physical address is not authorized in the router.
☑️ Check before enabling Whitelist
However, using the whitelist requires caution. If you only add your computer to the list but forget about your phone, it won't be able to connect when you switch to Wi-Fi. Therefore, before enabling "Allow only listed" mode, make sure you've added the addresses of all the necessary devices.
| Filtration type | Operating principle | Security level | Ease of use |
|---|---|---|---|
| Blacklist | Blocks only selected addresses | Average | High |
| Whitelist (Permission) | Blocks everyone except the selected ones | Maximum | Low (requires configuration of each new gadget) |
| Disabled | Access is open to everyone with a password | Short | Maximum |
| Guest network | Isolating guests from the main network | High | High |
Using Guest Mode to Isolate Traffic
Instead of constantly blocking friends or family members who come to visit, it's smarter to use the "Guest Network" feature. This option allows you to create a separate access point with its own name (SSID) and password, completely isolated from your main home network.
Guests connecting to guest Wi-Fi will only have internet access. They won't be able to see your shared folders, network printers, NAS storage, or control your smart home. It's the perfect compromise between hospitality and cybersecurityThe setting is usually located in the "Guest Network" or "Guest Zone" section.
You can set specific restrictions for the guest network, such as a speed limit or a time period (10:00 AM to 10:00 PM). This will prevent your neighbors from downloading torrents through your connection at night. Furthermore, you can change the guest network password daily without affecting the settings of your main devices.
⚠️ Note: Not all routers support full client isolation in guest mode. On cheaper models, devices on the guest network can "see" each other, even though they don't have access to your main LAN. Check the specifications for your model. TP-Link, Asus or Keenetic.
Is it possible to hack a guest network?
Theoretically, if an attacker is within range and has powerful equipment, they could attempt to brute-force the password. However, since the guest network is isolated, even if successful, they won't gain access to your personal files on your computer.
Parental control as a blocking tool
Parental controls are often thought of solely as a way to restrict content for children, but they're also a powerful tool for blocking Wi-Fi access on a schedule. You can set up a rule that completely disables internet access for a specific device during certain hours.
For example, if you want to prevent your child from using the internet after 11:00 PM or limit console gaming time to two hours per day, this feature is ideal. Unlike simple MAC address filtering, it offers flexible time settings. You can find this section under "Parental Control," "Access Control," or "Access Restriction."
Modern routers such as Keenetic or MikroTik, allow you to create complex profiles. You can block access to social networks or gaming servers while leaving access to educational resources. This is done by filtering domain names or website categories, which requires more fine-grained configuration but produces excellent results.
Specifics of setting up popular router models
Interfaces vary significantly between manufacturers, so it's important to know where to find the right switches. Below is a table with sample paths to lock settings for the most common brands. Keep in mind that the names of the options may change depending on the firmware version.
On devices TP-Link (especially with the blue interface) you need to go to Wireless → Wireless MAC FilteringClick "Add New," enter the MAC address, and select "Disabled" or "Enabled" depending on the selected filtering mode. Don't forget to click "Enable" in the main filtering menu.
In routers Asus with AsusWRT firmware the path lies through Wireless Network → MAC FilterIt's convenient to switch between the "Accept" and "Reject" modes. Zyxel Keenetic (new OS) access control is implemented through the "Device List" → selecting a specific client → the "Block" button or creating a "Home Network" profile with restrictions.
| Router brand | Menu section | Key option | Peculiarity |
|---|---|---|---|
| TP-Link | Wireless / Wireless mode | MAC Filtering | Requires manual activation of the function |
| Asus | Wireless network | MAC address filter | Convenient list interface |
| Keenetic | My Networks and Wi-Fi | Client List / Access | Flexible management by profiles |
| D-Link | Wi-Fi / MAC filter | Add a rule | Often hidden in advanced settings |
| Tenda | Wireless Settings | Wireless MAC Filter | Simple interface, few settings |
⚠️ Note: Router interfaces are constantly being updated. If you don't see the above points, please refer to the manufacturer's official documentation or download the latest instructions for your specific model from the support website.
Common mistakes and additional security measures
Even after setting up blocking, users often make mistakes that render their efforts useless. The most common of these is ignoring the security of the encryption protocol itself. If you have WEP protection or an open network, a hacker can bypass MAC filtering in minutes, as they can spoof the authorized MAC address.
The second major mistake is a weak password for the router's admin panel. If you've left the default password (for example, admin/admin), anyone who connects to your Wi-Fi (even a guest network, if it's not isolated) will be able to access the settings and override all your blocks. Change password Logging into the web interface is a mandatory step.
The WPS function is also worth mentioning. Despite the convenience of connecting without entering a password, this protocol has vulnerabilities. Attackers can use programs to brute-force the WPS PIN and gain access to the network bypassing filters. Recommended disable WPS in your wireless network settings if you don't use it constantly to connect new devices.
What should I do if I blocked myself?
If you enabled Whitelist mode and forgot to add your computer, you'll lose internet access. There's only one solution: connect to the router using a network cable (LAN). Wired connections aren't typically filtered by Wi-Fi rules. After connecting via cable, go to settings and add your MAC address to the allowed ones or disable filtering.
Is it possible to block access by time of day?
Yes, most modern routers allow you to create schedules. In the "Parental Controls" or "Access Restriction" sections, you can set time intervals (for example, from 11:00 PM to 7:00 AM) during which access for selected devices will be completely blocked.
Will resetting the router settings remove the blocking?
Yes, resetting the router to factory settings (using the Reset button on the router) will clear all MAC filter lists, passwords, and restrictions. The network will return to its default state, and access will be available to anyone with the password (or without a password, if that was the default).
Does my ISP see who I block?
No, your ISP only sees general traffic passing through your router. Internal access policies, blocking specific MAC addresses, and configuring guest zones occur within your local network and are not broadcast externally.
Will hiding the network name (SSID) help?
Hiding the SSID is a weak security measure. The network will no longer appear in the list of available networks for regular users, but specialized scanners can easily find it. Furthermore, hiding the network name can cause connection issues for some smart devices (light bulbs, sockets) that are unable to connect to hidden networks.