How to Block Wi-Fi for a Single User on a Router: 5 Working Methods

Have you noticed that a neighbor or unwanted guest is connecting to your Wi-Fi without permission? Or do you want to restrict internet access for a specific device on your network—for example, for a child during school hours or for a smart TV at night? Blocking Wi-Fi for a single user is a simple procedure that doesn't require any specialized knowledge, but there are some nuances depending on the router model and the purpose of the restriction.

In this article we will look at all possible methods: from basic blocking to MAC address to flexible rules parental control and scheduled restrictions. You'll learn how to find "unnecessary" devices on the network, why blocking sometimes doesn't work, and what to do if your router doesn't support the features you need. And for advanced users, we've prepared setup instructions via Telnet and alternative firmware.

Important: blocking methods are not universal. For example, TP-Link Archer C6 And Keenetic Giga have different interfaces, and older models may not support some features. If your router was released before 2018, check for firmware updates—this will expand your customization options.

1. How to find the device you want to block

Before blocking a user, make sure you've correctly identified their device. Many routers display a list of connected devices with their MAC addresses, IP addresses and names (if specified). Here's how to do it:

• 📱 Via the router's web interface: Go to the control panel (usually at the address 192.168.0.1 or 192.168.1.1), log in and find the type section DHCP → Client List or Wireless Mode → Connected Devices.
• 🔍 Via mobile app: if you have a router ASUS, TP-Link or Xiaomi, use the official app (eg Tether or AiMesh) - there is a visual list of devices with icons.
• 💻 Via command line (Windows): run the command

  arp -a

  to see all IP and MAC addresses on your local network.

Please note device manufacturer — the first 6 characters of the MAC address indicate the brand. For example, B8:27:EB belongs Raspberry Pi, A 78:31:C1 — AppleThis will help you distinguish yours. iPhone from someone else's.

⚠️ Attention: If you see unfamiliar MAC addresses from Chinese or unknown manufacturers in the list of devices (for example, XiaoMi, HiSilicon), this could be a sign that your network has been hacked. In this case, it's best not only to lock your device but also to change your Wi-Fi password to a more complex one (at least 12 characters, including numbers and special characters).

2. MAC address blocking: a universal method

The most secure way to block a device is to add it MAC address blacklist. This method works on 90% of routers, including TP-Link, D-Link, Zyxel And MikroTikInstructions for most models:

1. Go to the router control panel (default logins/passwords are usually admin/admin or indicated on the device sticker).
2. Go to the section Wireless Mode → MAC Filter (or Wireless → MAC Filtering in English-language firmware).
3. Select mode Blacklist (Deny).
4. Enter the MAC address of the device (e.g. 00:1A:2B:3C:4D:5E) and save the settings.

On routers ASUS the path may differ: Local Network → DHCP Server → MAC Reservation and FilteringOnce blacklisted, the device will be unable to connect to Wi-Fi, even if it knows the password.

Make sure the MAC filter is enabled|Check that the MAC address you entered is correct (case-insensitive)|Reboot the router after saving the settings|Try connecting from a blocked device to check-->

⚠️ Attention: Some devices (especially on Android 10+ And iOS 14+) can randomize MAC address When connecting to new networks. If, after blocking, the user simply "forgets" the network and reconnects, their MAC address will change, and the blocking will no longer work. In this case, use the methods in Section 4 (IP blocking).

3. IP Blocking: An Alternative for Complex Cases

If MAC blocking does not work (for example, due to randomization), you can block the device by its IP addressThis method is less reliable, as the IP may change when reconnecting, but it is useful for temporary restrictions.

First, find the device's IP address in the DHCP client list (see Section 1). Then:

1. Go to Local Area Network → ARP Binding (or LAN → ARP Binding).
2. Add a rule by binding the device's MAC address to its current IP.
3. In the section Firewall → Filtering Rules Create a rule to deny traffic from this IP.

On routers Keenetic this is done through Control → Traffic Rules, where you can specify Source (IP) and action Block.

If the device uses a static IP (manually set in its settings), IP blocking will be permanent. However, if the IP is assigned automatically (DHCP), the user can simply reconnect and obtain a new address.

4. Parental control: scheduled blocking

If you don't need to completely lock your device, but only restrict its access at a certain time (for example, at night or during school), use the function parental controlIt is available on most modern routers, including TP-Link, ASUS And Mercusys.

Example setup for TP-Link:

1. Go to Additional settings → Parental controls.
2. Add a device by MAC address or IP.
3. Specify the days of the week and time intervals for blocking (for example, from 10:00 PM to 7:00 AM).
4. Save the rule and reboot the router.

On routers ASUS the function is called AiProtection → Parental Control and allows you to block not only the Internet, but also access to specific websites (for example, social networks).

5. Advanced Methods: Telnet, DD-WRT, and Scripts

If your router supports alternative firmware (DD-WRT, OpenWRT) or has access by Telnet/SSH, you can block a user using commands. This is relevant for MikroTik, Ubiquiti or routers with firmware Tomato.

Example of blocking by MAC via Telnet on DD-WRT:

nvram set wl_maclist="00:1A:2B:3C:4D:5E"
nvram set wl_macmode="deny"
nvram commit
reboot

For MikroTik RouterOS use the command:

/interface wireless access-list
add interface=wlan1 mac-address=00:1A:2B:3C:4D:5E action=deny

What to do if the router does not support blocking?

If your router is older than 2015 and does not have MAC/IP filtering features, consider the following options:

1. Buy a new router with parental control support (eg TP-Link Archer AX10 or ASUS RT-AX55).

2. Use third-party software on a computer that distributes the Internet (for example, Windows Firewall or pfSense).

3. Configure VLAN (if the router supports it) and isolate the device to a separate network without internet access.

4. Change your Wi-Fi password and do not disclose it to the unwanted user (a radical but effective method).

⚠️ Attention: Using alternative firmware (DD-WRT, OpenWRT) may void the router's warranty and cause it to malfunction if improperly installed. Before flashing the firmware, back up your current settings using Administration → Backup/Restore.

6. Why blocking may not work and how to fix it

Sometimes, even after proper configuration, the device continues to connect to Wi-Fi. Here are some causes and solutions:

• 🔄 The device changes its MAC address: modern smartphones and laptops can use MAC randomizationSolution: Block by IP or set up a static DHCP lease for this MAC.
• 📡 The router does not apply the rules: Always reboot your router after making changes. Some models (for example, D-Link DIR-300) require a double reboot.
• 🔌 The device is connected via cable (LAN): MAC/IP filtering usually only works for Wi-Fi. Solution: Block it through a firewall.
• 🛠️ Outdated firmware: update your router software via Administration → Firmware UpdateFor example, in TP-Link After updating to the latest version, the function appears Client isolation.

If all else fails, check to see if your router has been reset to factory settings. This can happen after a power outage or a malfunction. To avoid losing your settings, export the configuration to a file using Administration → Backup.

7. How to unlock your device if you change your mind

To remove the block, follow these steps:

1. Go to your router's control panel.
2. Go to the MAC/IP filtering section (depending on the blocking method).
3. Delete the rule for the desired device or switch the filter to the mode Allow.
4. Save the settings and reboot the router.

If you've blocked yourself by mistake and can't access your settings:

1. Connect to the router via cable (LAN).
2. Reset to factory settings by holding down the button Reset for 10–15 seconds.
3. Reconfigure the router using the data from the sticker (default logins/passwords).

⚠️ Attention: On some routers (for example, Keenetic) reset settings via button Reset does not remove firewall rules. In this case, use emergency access via 192.168.1.1/ndm (For Keenetic) or connect via Telnet in recovery mode.

Frequently Asked Questions (FAQ)

Is it possible to block a device without knowing its MAC address?

Yes, but it's less secure. You can lock the device by IP address (see section 3) or by host name (If the router displays it). However, IP addresses can change, and hostnames are easy to spoof. The best way to find the MAC address is through the DHCP client list.

Will a locked device see the Wi-Fi network?

Yes, the network will be visible in the list of available networks, but when attempting to connect, the device will either receive an authentication error or will continually "obtain an IP address" without success. Some routers (for example, Ubiquiti UniFi) allow you to completely hide the network for specific devices.

How to block internet access but leave access to the local network?

To do this, configure the firewall to only block outgoing traffic to the Internet (WAN), but allow traffic within the local area network (LAN). Keenetic this is done through Control → Traffic Rules, where the goal is indicated Internet (WAN).

Is it possible to block a device on a router from a provider (for example, from Rostelecom)?

Yes, but the capabilities are limited. Routers from providers (for example, Sagemcom or Sercomm) often have limited functionality. Try:

1. Log in 192.168.0.1 and find the section Wi-Fi → MAC Filter.
2. If there is no filter, turn it on Bridge Mode and connect your router.
3. Contact your provider's support team—sometimes they can block your device on their end.

What should I do if my internet speed drops after being blocked?

This can happen if you have used QoS or firewall to block. Disable unnecessary rules or reset settings. QoS to factory settings. Also, check if the router is overloaded - on weaker models (for example, TP-Link TL-WR841N) traffic filtering can load the processor.