How to permanently block a specific device from connecting to Wi-Fi: by MAC address, IP address, and router settings

Example rule for ASUS RT-AX88U:

Source: 192.168.1.100 (IP of the blocked device)
Purpose: ANY
Protocol: ANY
Action: DROP

This method is especially useful if you don't want to completely block your device, but only access to certain websites or services (for example, social networks or online games). In this case, you specify only ports or domains in the firewall rule, not all traffic (for example, 443 For HTTPS).

4. Parental control: temporary blocking by schedule

If you don't need to permanently block access, but only restrict it for a certain time (for example, at night or during school hours), use the function parental control (Parental Control). It is available on almost all modern routers and allows you to:

• ⏰ Block internet access according to a schedule (for example, from 10:00 PM to 7:00 AM)
• 🌐 Block specific websites or categories (social networks, games, video hosting sites)
• 📱 Limit internet speed for individual devices

How to set up parental controls using an example Keenetic:

1. Go to Apps and Games → Parental Controls.
2. Add a new rule by selecting a device from the list or typing it in MAC/IP manually.
3. Set restrictions:
   • Access time: for example, Mon-Fri 18:00–20:00, Sat-Sun 12:00–14:00
   • Blocked sites: Add domains separated by commas (e.g. vk.com, youtube.com, twitch.tv)

On routers MikroTik (with firmware) RouterOS) parental control is configured through IP → Firewall → Layer7 Protocol or Queue Trees to limit the speed. This is a more complex process, requiring knowledge of network protocols.

⚠️ Please note: Some smart devices (such as TVs) Samsung or prefixes Xiaomi) can bypass parental controls through the built-in VPN or DNS serversIn this case, additionally block the change DNS in the router settings.

5. Hiding a Wi-Fi Network: A Radical Method for Advanced Users

If you want to completely hide your network from prying eyes (including a locked device), you can disable SSID broadcastingIn this case, your Wi-Fi will not be displayed in the list of available networks, and you can only connect to it manually, knowing the exact name (SSID) and password.

How to hide a network:

1. Go to the router settings section Wireless network (Wi-Fi).
2. Find the option Hide SSID (Hide SSID, Enable Hidden Wireless) and activate it.
3. Save the settings. Your network will then disappear from the list of available Wi-Fi networks on all devices.
4. To connect to a hidden network, you need to manually create a new Wi-Fi profile on your device with the following information: SSID and password.

Disadvantages of this method:

• ❌ Inconvenience for legitimate users (you will have to enter the network name manually)
• ❌ Some devices (such as smart bulbs or cameras) cannot connect to hidden networks
• ❌ An experienced user can still find your network using a scanner (for example, Wireshark)

Hiding SSID It is best to use it in combination with other blocking methods (for example, with MAC filter). This way you will get double protection: the network will be invisible to outsiders, and even if someone finds it, they will not be able to connect due to blocking by MAC.

How to connect to a hidden network on different devices

Android: Settings → Wi-Fi → Add network → Enter the SSID and password.
iPhone: Settings → Wi-Fi → Other network → Specify the network name and security settings.
Windows: Control Panel → Network and Internet → Manage wireless networks → Add → Enter data manually.
Smart devices (IoT): many gadgets (for example, Xiaomi or Tuya) do not support connecting to hidden networks. Check the documentation before setting up.

6. Advanced Methods: VLAN and Separate Network for Blocked Devices

If you are using a professional router (for example, MikroTik, Ubiquiti or PFSense), you can go further and create separate virtual network (VLAN) for unwanted devices. This method allows you to:

• 🔒 Completely isolate a blocked device from your main network
• 📡 Limit his speed or access to certain resources
• 🛡️ Prevent interaction with other devices on the local network

Example setup for MikroTik:

1. Create a new one VLAN V Interfaces → VLAN (For example, VLAN10 for blocked devices).
2. Set up DHCP server for this VLAN, selecting a separate range IP addresses (For example, 192.168.10.100–192.168.10.200).
3. Add a rule to Firewall, which will redirect the blocked device's traffic to VLAN10:

/ip firewall filter add chain=forward src-mac-address=00:1A:2B:3C:4D:5E action=mark-connection new-connection-mark=blocked_vlan passthrough=yes
/ip firewall mangle add chain=prerouting connection-mark=blocked_vlan action=mark-routing new-routing-mark=to_vlan10 passthrough=yes
/ip route add dst-address=0.0.0.0/0 gateway=192.168.10.1 routing-mark=to_vlan10

In this configuration, the blocked device will connect to the network but will be placed in an isolated segment without access to the internet or other devices. This method requires advanced networking knowledge and is only suitable for experienced users.

⚠️ Warning: Incorrect setting VLAN This may result in loss of access to the router or disconnection of all devices from the internet. Before experimenting, back up your configuration!

7. What to do if the device bypasses the lock

Sometimes, even after all the settings have been completed, a blocked device continues to connect to Wi-Fi. This can happen for several reasons:

If the device uses VPN or Tor, router-level blocking may not work. In this case:

• 🔌 Disable access to alternatives DNS servers (set up forced use DNS router)
• 🚫 Block the ports used VPN (For example, 1194 For OpenVPN, 443 For WireGuard)
• 📵 Completely disconnect the device from the network physically (if possible)

If the blocked device is a smartphone or tablet, its owner can bypass the restrictions by resetting the network settings or changing the MAC address through the engineering menu. In this case, the only reliable way is to change the Wi-Fi password and not share it with the unwanted user.

8. Additional security measures: how to protect Wi-Fi from unwanted connections

To avoid constantly blocking new devices, it's best to protect your network from unauthorized access in advance. Here are some tips:

• 🔐 Use a complex Wi-Fi password (at least 12 characters, with numbers, letters, and special characters). Avoid obvious combinations like 12345678 or qwerty.
• 🔄 Change your password regularly (every 3-6 months). This is especially important if you have guests.
• 📡 Turn off WPS (Wi-Fi Protected Setup) - this protocol is vulnerable to brute-force attacks.
• 🛡️ Turn on WPA3 instead of WPA2 (if your router supports it). This is a new encryption standard that is harder to crack.
• 👀 Periodically check the list of connected devices in the router control panel. Unfamiliar MAC addresses — a reason to be wary.
• 🌐 Set up DNS filtering (for example, through Cloudflare Family or OpenDNS) to block malicious sites at the network level.

If you suspect your Wi-Fi has been hacked, immediately:

1. Change the password for your router and Wi-Fi.
2. Update your router firmware to the latest version (vulnerabilities are often fixed in new releases).
3. Check your settings DMZ And Port Forwarding — they could have been modified for remote access.

⚠️ Attention: If a device with MAC address, starting with 00:0C:29, 00:50:56 or 00:1C:14, this could be a virtual machine or emulator. Such devices are often used for network testing, but they can also indicate a hacking attempt.

Frequently Asked Questions