How to Block a Device on a TP-Link Router's Wi-Fi Network: 3 Working Methods

Connecting unfamiliar devices to your home Wi-Fi isn't just an annoyance; it's a real security threat. Unauthorized devices can slow down your internet speed, consume bandwidth, or even intercept personal data. If you notice an unknown phone, laptop, or smart device in the list of connected clients, you should block it immediately. In this article, we'll explain how to do this on routers. TP-Link - from budget Archer C20 to the flagship AX6000.

The blocking process varies depending on the router's firmware version and model, but the general logic is the same: find the MAC address or IP address of the suspicious device and add it to the blacklist. We'll cover all current methods, including blocking via a mobile app. Tether, a web interface, and even a command line for advanced users. We'll also explain why blocking sometimes doesn't work and how to fix it.

1. Preparation: How to find a suspicious device on the network

Before blocking, you need to identify the "uninvited guest." To do this:

• 🔍 Access the router control panel via your browser by entering in the address bar 192.168.0.1 or 192.168.1.1 (the exact address is indicated on the device sticker).
• 📋 Go to the section DHCP → Client List or Wireless Mode → Statistics (the name depends on the model).
• 🔎 Check the list of connected devices. Pay attention to any unknown ones. MAC addresses (format XX:XX:XX:XX:XX:XX) and unfamiliar hostnames.

If there are dozens of devices in the list, use filters: sort by connection type (2.4 GHz or 5 GHz) or by last activity time. Devices with zero traffic or connected outside of business hours are prime candidates for blocking.

It's important to distinguish legitimate devices from unauthorized ones. For example, smart light bulbs. Xiaomi or columns Amazon Echo may appear under unintelligible names. If in doubt, temporarily disconnect all your devices from Wi-Fi and see which devices remain listed.

⚠️ Attention: Some routers TP-Link cache the client list. If you recently rebooted your router, wait 5-10 minutes for the list to refresh.

2. Method 1: Blocking via MAC filter (the most reliable method)

Filter by MAC address — the most effective method, since the address is tied to the physical device and does not change when the IP address changes. Instructions for firmware TP-Link versions 3.x and newer:

1. Open the router's web interface and go to Advanced Settings → Wireless Mode → MAC Filter.
2. Activate the switch Enable MAC address filtering.
3. Select mode Deny the stations specified in the list access to the network.
4. In the field MAC address Enter the device address (e.g. 00:1A:2B:3C:4D:5E).
5. Click Add, then Save.

Once the settings are applied, the target device will be immediately disconnected from the network. To unblock it later, simply remove the MAC address from the list or disable filtering.

Make sure the address is entered without errors and hyphens.

Check that the device is not part of a guest network.

Save settings before exiting the panel

Reboot your router if the blocking doesn't work right away.

-->

On some models (eg, TL-WR841N) the path to the settings may differ: Wireless → Wireless MAC FilteringIf you can't find the section, update your router's firmware via System Tools → Firmware Update.

3. Method 2: Blocking by IP address (temporary solution)

If MAC filtering is unavailable or not working, you can block the device by its IP addressThis method is less reliable, as the IP may change when reconnecting, but is suitable for a quick disconnect:

1. Find the IP of the suspicious device in the client list (DHCP → Client List).
2. Go to Advanced Settings → Network Tools → Bandwidth Control.
3. Turn on Bandwidth control and add the rule:
• IP Range: Specify a specific IP (eg. 192.168.0.105).
• Maximum download/upload speed: 1 kbps (effectively blocks access).

Save the settings.

This method doesn't completely disable the device, but limits its speed to a minimum. For complete blocking, it's best to combine it with a MAC filter.

⚠️ Attention: If the device is connected via guest network, blocking on the main network won't work. Check your guest access settings in Wireless Mode → Guest Network.

4. Method 3: Using the Tether app (for mobile devices)

If setting up your router via a computer is inconvenient, use the official application TP-Link Tether (available for Android And iOS). Blocking algorithm:

1. Connect to the router's Wi-Fi network from your phone.
2. Open the app and select your router.
3. Go to Device management or Clients (depending on the application version).
4. Find the device in the list and tap on it.
5. Select an option Block or Add to blacklist.

The app automatically applies a MAC filter, so the blocking is permanent. The convenience of this method is that you can quickly unblock the device directly from your smartphone, without having to access the web interface.

Please note: in Tether Sometimes not all connected devices are displayed. For full control, it is recommended to combine the mobile app with the web interface.

5. Advanced Methods: Blocking via Telnet/SSH

For experienced users there is the option to block via command lineThis method requires the inclusion of Telnet or SSH on the router and is suitable for models based on firmware OpenWRT or modified versions TP-Link.

An example command for blocking a device by MAC (executed in the terminal after connecting to the router):

iptables -I FORWARD -m mac --mac-source 00:1A:2B:3C:4D:5E -j DROP

To unlock, replace -I on -D:

iptables -D FORWARD -m mac --mac-source 00:1A:2B:3C:4D:5E -j DROP

⚠️ Attention: Incorrect commands iptables may impair the router's operation. Use this method only if you understand the consequences. To reset the settings after an error, hold down the button. Reset on the router 10 seconds.

On standard firmware TP-Link access by Telnet/SSH It's usually disabled. Activating it may require installing custom firmware, which will void the warranty.

6. Why blocking may not work and how to fix it

Sometimes a device remains connected despite the settings applied. Common causes and solutions:

• 🔄 MAC address caching: Reboot your router after adding it to the blacklist. On some models, changes are applied only after a reboot.
• 📡 Dual Network (2.4GHz + 5GHz): The device may be connecting to a different frequency. Block it separately for each network.
• 🔧 Reset settings: If the blocking is removed after updating the firmware, check the list of MAC filters - it may have been reset.
• 🛡️ VPN or proxy: Some devices use third-party servers to bypass restrictions. In this case, changing the Wi-Fi password is the only solution.

If the device continues to connect after all these steps, there's a high probability that it's using MAC spoofing. In this case, the only reliable solution is to change the network name (SSID) and password.

How to check if a device is spoofing its MAC address?

Compare the MAC address in the router's client list with the device's actual address (for example, in your phone's settings or using the ipconfig /all command on your PC). If they don't match, it's spoofing.

7. Additional security measures after blocking

To prevent unwanted devices from reconnecting:

• 🔐 Change your Wi-Fi password: Use a complex combination of 12+ characters with numbers and special characters. Avoid obvious passwords like 12345678 or qwerty.
• 📛 Disable WPS: Function Wi-Fi Protected Setup vulnerable to brute-force attacks. Disable it in Wireless Mode → WPS Settings.
• 🔄 Enable client isolation: Option AP Isolation (in some firmware versions) prevents devices from exchanging data with each other, which makes it more difficult for viruses to spread.
• 📡 Create a separate network for guests: Set up guest Wi-Fi with limited access to your local network Wireless Mode → Guest Network.

Check the list of connected devices regularly (every 1-2 weeks). To automate monitoring, you can use third-party utilities such as Fing (for mobile) or Wireless Network Watcher (for PC).

FAQ: Frequently asked questions about blocking devices on TP-Link

Is it possible to lock a device by name (eg "iPhone")?

No, blocking by hostname is unreliable, as it can be easily spoofed. Use only MAC address or IP (Temporary solution). The device name in the client list is displayed for convenience only and is not used for filtering.

How do I block a device if I have a router from a provider (for example, Rostelecom) with TP-Link firmware?

MAC filtering is often disabled on ISP routers. Try this:

1. Go to advanced settings (usually at 192.168.1.1 or 192.168.0.1).
2. Find a section Parental Control (Parental Control) and add the device to restrictions.
3. If nothing helps, contact your provider's support team and request access to full settings.

Will a blocked device be visible in the client list?

Yes, the device may appear in the list, but with no activity (traffic = 0). Some firmware versions hide blocked MAC addresses from the list only after a router reboot.

Is it possible to lock the device for a certain time (for example, at night)?summary>

Yes, use the function for this Parental Control (Parental Control):

1. Go to Additional settings → Parental controls.
2. Add the MAC address of the device.
3. Set up a schedule (for example, blocking from 11:00 PM to 7:00 AM).

This method is useful for restricting access by children or guests at night.

What should I do if all my devices lose internet access after being blocked?

You've likely accidentally blocked the MAC address of your default gateway or DHCP server. Check:

• Open the list of blocked MAC addresses and remove all but the target device.
• Reboot the router using the button Reset (hold for 5 seconds for soft reset).
• If the Internet is not restored, reset the settings to factory settings (hold Reset 10+ seconds).