How to Completely Block Access to a Wi-Fi Router: From Device Filtering to Network Hiding

Have you noticed your internet speed has suddenly dropped, and unknown devices have appeared in the list of connected devices? Or perhaps you want to restrict Wi-Fi access for certain family members at night? There are several ways to block unauthorized access to your router, from basic settings to advanced methods like MAC address filtering or changes in the encryption standard.

In this article you will find Step-by-step instructions for routers from TP-Link, ASUS, Keenetic, Zyxel, and other popular brands, and you'll also learn which blocking methods are the most reliable and which are easy to bypass. We'll explore not only how to block access to specific devices, but also how to make your network invisible to Wi-Fi scanners and password guessing programsImportant: Some methods (such as hiding the SSID) reduce the ease of connecting new devices—we'll warn you about this in advance.

If you've never logged into your router's admin panel before, don't worry: all steps are accompanied by screenshots and explanations. And for experienced users, we've prepared a section with Telnet commands for advanced customization.

📊 Why do you need to block Wi-Fi access?
Someone else has connected to my network.
I restrict access for children/relatives
I want to improve security
Other

1. MAC address blocking: reliable, but not perfect

MAC address filtering — one of the most common ways to restrict access to a router. Each device (smartphone, laptop, smart speaker) has a unique MAC address, which can be added to white list (allow only specified devices) or blacklist (block specific gadgets).

How does this work in practice? Let's say you notice an unknown device in the list of connected devices. iPhone 12 with MAC address A4:83:E7:12:F5:89You can add it to the blacklist, and the router will automatically deny it access. However, this method has its weaknesses:

  • 🔄 MAC addresses can be forged (spoofed) using special programs.
  • 📱 When you reset your device or replace your network card, the MAC address may change.
  • 🔧 Setup requires manual entry of addresses for all allowed devices.

To enable filtering on your router TP-Link Archer C6, follow these steps:

  1. Open the admin panel at 192.168.0.1 (or 192.168.1.1).
  2. Go to Advanced Settings → Wireless Mode → MAC Filter.
  3. Select mode "Allow access only to specified devices" (white list) or Deny access to specified devices (black list).
  4. Add MAC addresses manually or select from the list of connected devices.
  5. Save the settings and reboot the router.

Make sure you have access to the admin panel|Write down the MAC addresses of all authorized devices|Check if your router supports MAC filtering|Back up your router settings-->

⚠️ Attention: On routers ASUS RT-AX88U and some models Keenetic MAC address filtering may conflict with the function Smart QoSIf your internet connection slows down after setting up this feature, disable QoS or add exceptions.

2. Device Blacklist: Quickly Block "Strangers"

If you don't need to restrict all devices, but just block 1-2 specific gadgets, blacklist — the simplest method. Unlike a whitelist, it doesn't require manually adding all authorized devices and doesn't interfere with the connection of new ones.

How does it work? The router checks the MAC address of every device attempting to connect. If the address is blacklisted, access is denied. Setup takes less than a minute:

  • 🖥️ On routers Zyxel Keenetic: Home Network → Devices → Block.
  • 🌐 On MikroTik: IP → DHCP Server → Leases → select the device → Make Static → in the interface settings add Access List.
  • 📡 On Xiaomi Mi Router: Settings → Network → Device Management → Block.

The main disadvantage of the method: MAC address is easy to change in the phone or laptop settings. For example, on Android, this is done through Settings → About phone → Status → Wi-Fi MAC address (on some firmwares it is required ADB). Therefore, for reliable protection, we recommend combining a blacklist with other methods.

3. Hiding the SSID: Making the network invisible (but not invulnerable)

Hiding the network name (SSID) — a controversial method of blocking access. On the one hand, your Wi-Fi won't appear in the list of available networks, making it difficult for strangers to connect. On the other hand, Advanced users can find hidden networks using programs like Wireshark or Acrylic Wi-Fi, and then connect manually.

How to hide the SSID on a router ASUS RT-AC68U:

  1. Log in to your admin panel (192.168.1.1).
  2. Go to Wireless Network → General.
  3. Find the field Hide SSID and set the value "Yes".
  4. Save the settings.

After this, your network will disappear from the list of available Wi-Fi networks. However, to connect new devices, you will need to enter the network name (SSID) manually. For example, on iPhone it's done like this:

  1. Open Settings → Wi-Fi → Other network.
  2. Enter the network name (SSID) and password.
  3. Select the security type (WPA2/WPA3).
⚠️ Warning: Hiding the SSID may cause connection issues with some smart home devices (e.g. Xiaomi Mi Home or Amazon Echo). Before setting up, check the compatibility of your gadgets.
Blocking method Difficulty of setup Reliability Impact on convenience
MAC filtering (whitelist) ⭐⭐⭐ ⭐⭐⭐ Average (need to add new devices)
MAC Blacklist ⭐ ⭐⭐ Low
Hiding the SSID ⭐ ⭐ High (difficult to connect new devices)
Guest mode with restrictions ⭐⭐ ⭐⭐⭐ Low

4. Guest mode: limited access without risks

If you need to provide Internet access to guests, but without access to the local network (for example, to printers or network drives), use guest Wi-FiThis mode creates a separate network with its own password and restrictions:

  • 🔒 No access to other devices on the main network.
  • ⏰ You can set a time limit (for example, 2 hours).
  • 📶 Speed ​​limit (useful for renters or cafes).

Setting up the router TP-Link Archer AX20:

  1. Go to Guest network (on the menu Wireless mode).
  2. Enable guest access and set a network name (e.g. Guest_WiFi).
  3. Set a password (recommended) WPA3).
  4. In the section "Additional settings" limit your speed (for example, to 10 Mbps) and operating time (s 09:00 to 21:00).
  5. Save the settings.

Guest mode is especially useful for:

  • 🏨 Hotels and inns (distributing Internet to guests without risk to the main network).
  • ☕ Cafes and restaurants (time limits encourage customers not to "hang out" at their laptops).
  • 🏠 Landlords (control of tenant traffic).

5. Changing encryption standards: WPA3 vs. WPA2

If your router is still using an outdated protocol WPA or WEP, it can be hacked in a few minutes using programs like Aircrack-ng. Modern standard WPA3 It is free of most vulnerabilities and makes password guessing much more difficult.

How to check and change the encryption standard:

  1. Go to your router settings (usually 192.168.0.1 or 192.168.1.1).
  2. Go to the section Wireless Network → Security Settings.
  3. In the field Network Authentication select WPA3-Personal (or WPA2/WPA3 for compatibility with older devices).
  4. Set a complex password (at least 12 characters, with numbers and special characters).
  5. Save the settings and reconnect all devices.

If your router does not support WPA3, update the firmware through the section System → Software UpdateFor models older than 2018 (e.g. TP-Link TL-WR841N) WPA3 may not be available - in this case, use WPA2-AES (Not TKIP!).

⚠️ Please note: Some smart home devices (eg. Xiaomi cameras or Nest thermostats) do not support WPA3Before changing the standard, check the manufacturer's documentation for compatibility.
How to hack WEP and WPA2?

Protocol WEP vulnerable to attack FMS (Fluhrer, Mantin, Shamir), which allows you to recover the key in a few minutes if you have a sufficient number of packages. WPA2 With TKIP can be hacked through a vulnerability KRACK (Key Reinstallation Attack), and weak passwords are brute-forced. WPA3 protected from these attacks thanks to the protocol SAE (Simultaneous Authentication of Equals).

6. Scheduled blocking: time-based access restrictions

If you need to block Wi-Fi access during certain hours (for example, at night for children or during work hours for employees), use Access Control function (or Parental Control). This method does not require knowledge of MAC addresses and works at the router level.

Setting up on Keenetic Giga:

  1. Open the router's web interface (my.keenetic.net).
  2. Go to Home Network → Devices.
  3. Select the device for which you want to set restrictions.
  4. Click "Restrict access" and set up a schedule (for example, blocking with 23:00 to 07:00).
  5. Save the rules.

On routers ASUS a similar function is called AiProtection → Parental ControlHere you can not only block access by time, but also restrict specific websites or content categories (social networks, games, etc.).

Advantages of the method:

  • ⏰ Automatic locking without manual intervention.
  • 📵 Does not require changing settings on devices.
  • 🔄 Easy to edit your schedule (for example, during holidays).

7. Advanced Methods: Telnet, VLAN, and IP Blocking

For experienced users who require maximum protection, advanced blocking methods are suitable. These require knowledge of network protocols and the ability to work with command line, but provide complete control over access.

Blocking by IP address

If an unknown device has already connected to the network, you can block it by IP address through firewall router. For example, on MikroTik it's done like this:

/ip firewall filter add chain=forward src-address=192.168.1.100 action=drop comment="Block unknown device" disabled=no

Where 192.168.1.100 — IP address of the blocked device.

Using VLANs to Isolate Devices

VLAN (Virtual LAN) allows you to divide your network into virtual segments. For example, you can create a separate VLAN for smart TV or IP camerasso that they don't have access to the main network. The setup requires VLAN support on the router (available at Ubiquiti, MikroTik, Keenetic with firmware NDMS 3.0+).

Blocking via Telnet/SSH

On routers with support Telnet or SSH (For example, ASUS Merlin) you can block the device with the command:

nvram set wl_maclist="A4:83:E7:12:F5:89" # Add to the blacklist

nvram set wl_macmode=deny


nvram commit


service restart_wireless

⚠️ Warning: Incorrect commands in Telnet may reset your router. Before experimenting, create a backup copy of your configuration via Administration → Backup/Restore.

8. What to do if nothing helps?

If, despite all blocking measures, third-party devices continue to connect to your Wi-Fi, it is possible:

  • 🔑 Your Wi-Fi password has been compromised (for example, you gave it to guests or it is too simple).
  • 🕵️‍♂️ Someone is using Wi-Fi repeater or access point on your network.
  • 🛠️ There is a vulnerability in the router (for example, CVE-2021-20090 for some models TP-Link).

Actions in such cases:

  1. Change your Wi-Fi password to complex (example: 7h#kP9!mQ2$vL5*).
  2. Update your router firmware to the latest version.
  3. Check the list of connected devices for the presence of unknown gadgets.
  4. Reset your router to factory settings and set it up again (instructions below).

How to reset a router Zyxel Keenetic:

  1. Press and hold the button Reset (usually on the back panel) for 10 seconds.
  2. Wait for the reboot (the indicators should turn green).
  3. Connect to the router via cable and configure it from scratch.

If the problem persists, your router may be compromised at the firmware level. In this case, we recommend:

  • 🔧 Install alternative firmware (DD-WRT, OpenWRT).
  • 🛡️ Buy a new router with support WPA3 And protection against Evil Twin attacks.

FAQ: Frequently asked questions about blocking Wi-Fi access

Is it possible to block Wi-Fi access without accessing the router?

No, all blocking settings are configured in the router's admin panel. If you don't have access to it (for example, if you're renting), you can:

  • Use firewall on your device (For example, Windows Defender Firewall).
  • Connect via mobile Internet or USB modem.
  • Agree with the router owner about setting up a guest network.
How do I know if someone else is using my Wi-Fi?

Signs of unauthorized access:

  • ⚡ A sharp drop in internet speed.
  • 📡 Unknown devices in the list of connected gadgets (checked in the router panel).
  • 🔌 Router indicator activity during non-working hours.
  • 💻 Notifications about new devices in apps like Google Home or Mi Home.

Use apps to monitor traffic GlassWire (Windows) or Fing (mobile devices).

Which is better: MAC address blacklist or whitelist?

The choice depends on your task:

  • Whitelist Suitable if you have fixed set of devices (For example, a home network with 5-6 devices). It's more reliable, but requires manually adding each new device.
  • Blacklist more convenient if you need to block 1-2 specific devices, without restricting others. However, it can easily be bypassed by changing the MAC address.

For maximum security, combine whitelisting with WPA3 And hiding the SSID.

Why does the device still connect after blocking the MAC address?

Possible reasons:

  • 🔄 The device has changed its MAC address (on Android this can be done without root rights via Settings → About phone → Wi-Fi MAC address).
  • 🔧 Router settings were not saved (check that you clicked Apply or "Save").
  • 📡 The device connects via guest network or second range (2.4/5 GHz).
  • 🛠️ The router settings have been reset (check the date/time - they may be reset if there is a problem).

Solution: Update your router firmware and check the connection logs in the section System → Journal.

Is it possible to block access to certain websites through a router?

Yes, it is done through Parental Control function or DNS setupMethods:

  1. Through the router panel (for example, on ASUS: AiProtection → Parental Control → Website Blacklist).
  2. Via DNS: change DNS servers to 1.1.1.3 (Cloudflare Family) or 84.200.69.80 (DNSWatch).
  3. Via the Hosts file (on individual devices).

The restriction only works for devices connected through your router. If someone uses VPN or mobile Internet, the blocking will not work.

📖 Read also

How to Hack a Wi-Fi Password: Facts, Myths, and Network Security Wi-Fi password cracking methods: from brute force to social engineering. Why cracking WPA3 is impossible. How to connect a Wi-Fi camera to a dash cam: step-by-step instructions A complete guide to setting up wireless IP cameras. Connecting via the ONVIF protocol, setting up an NVR, How to find out the Wi-Fi password at work: methods and rules Learn how to access Wi-Fi at work legally. Methods via Windows, a router, and the administrator. The Impact of Wi-Fi on Human Health: Myths and Facts Does Wi-Fi affect your health? We examine the scientific data on the effects of router radiation on humans. How to Block Freeloaders from Wi-Fi: 7 Effective Methods Noticed your Wi-Fi is slowing down? Learn how to find and block intruders on your network. TP-Link WiFi Security: How to Protect Your Router from Hacking Step-by-step instructions: how to protect your TP-Link WiFi router from unauthorized access. Changing the password