How to completely block Wi-Fi access for other users on a TP-Link router

Have you noticed your Wi-Fi has slowed down, and unknown devices are appearing in the list of connected devices? Or do you simply want to ensure maximum security for your home network? Block Wi-Fi access to unauthorized users on your routers. TP-Link There are several ways to do this, from a basic password change to advanced methods like filtering by MAC addresses and settings guest networkIn this article, we'll look at all the current methods that work on models. Archer C6, TL-WR841N, Deco X20 and other popular devices of the brand.

It's important to understand: simply changing your Wi-Fi password isn't enough. Experienced users can crack it in a matter of hours, especially if you use simple combinations like 12345678 or qwertyWe'll show you how to combine multiple layers of security to make your network virtually impenetrable. All instructions are provided for the latest firmware versions. TP-Link (including Omada for business models) and do not require special technical knowledge.

If you're a landlord and want to restrict tenants' access to the main network, or simply want to split traffic between personal devices and guests' gadgets, you'll find a solution here too. We'll start with the simplest methods and gradually move on to more advanced settings.

1. Changing your Wi-Fi password: Basic security

The first thing to do is change your Wi-Fi password to a secure combination. Even if you've done this before, changing it again can kick all current "visitors" off the network. On routers TP-Link it takes no more than a minute:

1. Open your browser and type in the address bar 192.168.0.1 or 192.168.1.1 (If it doesn’t work, check the sticker on the back of the router).
2. Enter your login and password to log in to the control panel (by default, usually admin/admin).
3. Go to the section Wireless Mode → Security Settings (or Wireless → Wireless Security (in the English version).
4. In the field Wi-Fi password (Wi-Fi Password) enter a new combination.
5. Select encryption type WPA2-PSK or WPA3-PSK (if supported).
6. Save the changes and reboot the router.

How to create a strong password? Use:

• 🔢 Minimum 12 characters (optimally 16+)
• 🔤 A combination of uppercase and lowercase letters (A-z)
• 🔢 Numbers and special characters (!@#$%)
• 🚫 Avoid personal information (dates of birth, names, addresses)

⚠️ Important: After changing the password, all devices will be disconnected from the network. Prepare a list of gadgets that will need to be reconnected in advance, especially if you have smart devices (cameras, light bulbs, speakers) that may not have a screen for entering a new password.

If your router supports WPA3, choose this standard—it's more resistant to brute-force attacks. However, keep in mind that some older devices (such as printers or TVs from 2015–2018) may not support it. WPA3In that case, leave it. WPA2-PSK or use mixed mode WPA2/WPA3.

2. Hiding the Network Name (SSID): Pros and Cons

Many users believe that if hide network name (SSID), then their Wi-Fi will become invisible to outsiders. This is partially true, but the method has its nuances. A hidden SSID is not broadcast, so connecting to such a network requires manual access, knowing its name. However, experienced hackers can detect a hidden network using specialized software (for example, Wireshark or Airodump-ng).

How to hide SSID on TP-Link:

1. Go to your router control panel.
2. Go to Wireless → Wireless Settings.
3. Find the option Hide SSID (Hide SSID) and check the box.
4. Save the settings and reboot your device.

After this, your network will disappear from the list of available networks. To connect to it from a new device, you need to:

1. In the Wi-Fi settings on your gadget, select "Other network" or "Connect manually."
2. Enter the network name (SSID) and password.

⚠️ Note: Hiding the SSID may cause problems for devices with limited Wi-Fi settings (for example, some smart TVs or printers). It also doesn't protect against targeted attacks—a hidden SSID is easily detected by traffic analysis.

We recommend using this method in combination Combined with other security methods, not as a standalone solution. For example, a hidden SSID + MAC filtering + a complex password will have a cumulative effect.

3. MAC address filtering: device whitelist

One of the most reliable ways to restrict access to Wi-Fi is MAC address filteringEach device has a unique MAC address (e.g. 00:1A:2B:3C:4D:5E), which can be added to the "whitelist." After this, only devices on the list will be able to connect to the network.

How to set up filtering on TP-Link:

1. Go to your router control panel.
2. Go to Wireless Mode → MAC Filtering (or Wireless → Wireless MAC Filtering).
3. Enable filtering by selecting the option Allow only devices from the list (Allow).
4. Add the MAC addresses of your devices. You can find them here:
   • 📱 On Android: Settings → About phone → General information → Wi-Fi MAC address
   • 🍎 On iPhone: Settings → General → About → Wi-Fi Address
   • 💻 On Windows: Run the command ipconfig /all in the command line

Save the settings.

Advantages of the method:

• 🔒 Maximum security: even if someone finds out your password, they won't be able to connect without an authorized MAC address.
• 📱 Device control: know exactly which gadgets are connected to the network.

Flaws:

• 🔄 Inconvenience: when adding a new device, you will have to go to the router settings.
• 🔧 MAC addresses can be spoofed, but this requires specialized knowledge.

⚠️ Note: If you use devices with dynamic MAC addresses (some smartphones and laptops can randomly change them for privacy reasons), filtering will no longer work. In this case, disable random MAC address generation in your device's settings.

For convenience, keep a list of MAC addresses in a text file or table. Example:

Find the MAC addresses of all your devices

Disable random MAC generation on gadgets

Create a backup copy of the current router settings

Check the connection after applying the filter-->

4. Setting up a guest network: traffic isolation

If you frequently host guests or rent out your property, instead of providing access to your main network, you can create guest networkIt operates in parallel with the main network, but has a separate password and limited permissions. For example, devices on the guest network won't be able to access your network folders, printers, or smart devices.

How to set up a guest network on TP-Link:

1. Go to the control panel.
2. Go to Wireless Mode → Guest Network (or Wireless → Guest Network).
3. Enable the guest network by checking the box. Enable guest network.
4. Set a name (SSID) for the guest network (e.g. MyHome_Guest).
5. Set a password (you can use a less complex one than for the main network).
6. In the section Insulation turn on the option Isolate guest users - this will prevent devices on the guest network from "seeing" each other.
7. Limit the speed or time of the guest network if necessary.
8. Save the settings.

Benefits of a guest network:

• 🔐 Security: Guests don't have access to your personal data.
• 📶 Convenience: no need to constantly change the main network password.
• 📊 Control: You can limit the speed or operating time of the guest network.

Flaws:

• 🔌 Some smart devices (such as printers or speakers) may not work on a guest network due to restrictions.
• 🔄 Separate settings are required for each band (2.4 GHz and 5 GHz).

A guest network is especially useful for landlords or small hotel/cafe owners. You can provide internet access without compromising the security of your main network. It's also convenient if you frequently have friends over—you don't have to share the password for your main Wi-Fi.

What to do if the guest network is not working?

Make sure the feature is enabled for the desired band (2.4 GHz or 5 GHz).

Check if the guest network name conflicts with the main network name (they should be different).

Reboot your router after applying the settings.

If a Mesh system is used (for example, TP-Link Deco), guest network settings may differ - see the instructions for your model.

5. Time and speed limits: control usage

If you don't want to block access completely, but want to limit it by time or speed (for example, for children or tenants), in routers TP-Link there is a function bandwidth control And parental control.

How to limit speed for individual devices:

1. Go to Advanced Settings → Bandwidth Control (Advanced → Bandwidth Control).
2. Enable bandwidth control.
3. Specify the maximum download/upload speed for the device (e.g. 5 Mbps).
4. Add a rule for a specific MAC address or IP.

How to limit access by time:

1. Go to Additional settings → Parental controls (Advanced → Parental Controls).
2. Add a new rule by specifying the MAC address of the device.
3. Set a schedule (for example, access only from 8:00 to 22:00).
4. Save the settings.

These features are useful if:

• 👶 You want to limit your children's online time.
• 🏠 You have tenants and want to prevent excessive bandwidth consumption.
• 📱 You need to "slow down" devices that consume too much speed (for example, torrent clients).

⚠️ Note: Speed ​​limiting only works for devices connected to your router. If the user connects via a VPN or mobile data, these rules will not apply.

On some models TP-Link (For example, Archer AX6000) there is a function QoS (Quality of Service), which allows you to prioritize traffic. For example, you can give your devices maximum speed while allocating only 20% of the total bandwidth to the guest network.

6. Updating firmware and disabling vulnerable functions

Many users forget that outdated router firmware may contain vulnerabilities that allow you to bypass all security settings. Regular software updates are a must for network security.

How to update firmware on TP-Link:

1. Go to the control panel.
2. Go to Additional settings → System tools → Firmware update.
3. Click Checking for updates and follow the instructions.
4. Do not turn off the router during the update!

What features should be disabled to improve security:

• 🔌 WPS (Wi-Fi Protected Setup) - vulnerable to brute force attacks.
• 🌐 Remote control - if you do not use internet access to your router.
• 📡 UPnP (Universal Plug and Play) - can be used for attacks.
• 🔄 IGMP Proxy - if you do not use IPTV.

After updating the firmware, all router settings are reset to factory settings. Make a backup copy of the configuration in the section in advance System Tools → Backup and Restoreto quickly restore settings after an upgrade.

⚠️ Note: On some models TP-Link (especially business series Omada) The update process may vary. Always check the official documentation for your model.

If your router does not support automatic updates, check for new firmware versions on the official website. TP-Link every 3-6 months. This is especially important for owners of older models (for example, TL-WR740N or TL-WR841ND), which are still widely used but have not received security updates for a long time.

7. Additional measures: VPN, separate VLAN and monitoring

If you want to maximize your network security, consider these advanced methods:

1. Using a VPN on a router

Some models TP-Link (For example, Archer C5400X or Deco X90) support setting up a VPN server directly on the router. This allows you to:

• 🔒 Encrypt all network traffic.
• 🌍 Connect securely to your home network from outside.
• 🚫 Block network access without a VPN connection.

2. Configuring VLANs (virtual networks)

If you have a business model TP-Link Omada, you can divide the network into multiple virtual segments (VLANs). For example:

• 🏠 VLAN 10 - personal devices.
• 👨‍💼 VLAN 20 - working gadgets.
• 👫 VLAN 30 — guest network.

3. Monitoring connected devices

Regularly check the list of connected devices in the section Wireless Mode → Wireless Mode StatisticsIf you see an unknown MAC address:

1. Disable it via the function Device lock.
2. Change your Wi-Fi password.
3. Check your network for vulnerabilities (for example, using Wireshark).

To automate monitoring, you can use third-party utilities such as Fing (for mobile devices) or Advanced IP Scanner (for PCs). They show all devices on the network, their MAC addresses, and even manufacturers.

8. What to do if nothing helps?

If, despite all measures, foreign devices continue to appear on your network, it is possible:

• 🔌 Your router has been hacked (for example, through a firmware vulnerability).
• 📡 Someone is connecting via WPS or other vulnerable protocols.
• 🏠 There is a security hole in your apartment/house (for example, a neighbor connected through your signal repeater).

Actions in such a situation:

1. Reset your router to factory settings (button Reset on the back panel).
2. Update the firmware to the latest version.
3. Check physical security: Are there any extraneous cables connected to the router?
4. Use a network analyzer (For example, Wireshark) to identify suspicious activity.
5. Contact TP-Link support, if you suspect your device has been hacked.

As a last resort, consider buying a new router, especially if your model is older than 5 years. Modern devices (e.g., TP-Link Archer AXE75 or Deco XE75) support WPA3, have built-in protection against attacks and receive regular security updates.

If the problem persists, someone may be deliberately trying to hack your network. In this case, consider:

• 🔒 Installing a separate firewall (for example, pfSense).
• 📡 Switch to a wired connection for critical devices (e.g., a work PC).
• 🛡️ Using cloud security services (e.g. TP-Link HomeShield on supported models).

FAQ: Frequently Asked Questions

Is it possible to block Wi-Fi access by IP address?

Yes, but it's less secure than MAC blocking. IP addresses on the local network can change (if DHCP is enabled), so it's better to use MAC filtering or a combination of methods. To block by IP, go to Advanced Settings → Network Tools → Access Control and add a rule for the desired IP.

Why don't some devices connect after changing the password?

Possible reasons:

• The device stores the old password in the cache - try "forgetting" the network and connecting again.
• The selected encryption type is not supported (for example, the old device does not work with WPA3).
• Password entry error (check the case of the characters).

Smart devices (cameras, speakers) may require a factory reset.

How do I know if someone else is using my Wi-Fi?

Signs of unauthorized access:

• 📉 A sharp drop in internet speed.
• 🔌 Unknown devices in the list of connected devices (checked in the router panel).
• 💻 Network activity while all home devices are turned off.
• 🔍 Suspicious requests in the router logs (section System Tools → System Log).

Use mobile apps like Fing or NetScan to scan the network.

Does MAC blocking work on TP-Link Deco Mesh systems?

Yes, but the settings may differ. In the system Deco:

1. Open the app TP-Link Deco.
2. Go to Advanced → Security → MAC Filtering.
3. Add devices to the whitelist or blacklist.

Please note that in Mesh systems, blocking applies to the entire network, not to individual nodes.

Is it possible to restrict Wi-Fi access based on geolocation?

No, routers TP-Link don't support geolocation blocking. However, you can:

• Use range: Reduce the signal transmission power in the settings so that the Wi-Fi does not extend beyond your apartment.
• Tune scheduleso that Wi-Fi turns off when you are away.
• Use third-party solutions (eg. OpenWRT), if your router model supports alternative firmware.