How to Permanently Block a Device from Connecting to Your Wi-Fi: A Complete Guide

Have you noticed an unknown device connecting to your network? Or do you want to limit your child's internet access at night? Perhaps a neighbor is "borrowing" your Wi-Fi, slowing down the speed. In any case, blocking unwanted devices is a task even a novice can handle. In this article, we'll cover how. all possible ways to deny access, from standard router functions to advanced methods like VLAN And guest network.

It is important to understand that blocking can be temporary (for example, for an hour) or permanent (after MAC address blacklist). Some methods only work for specific devices, while others work for the entire network. We'll look at options for routers. TP-Link, ASUS, Keenetic, Xiaomi and universal solutions that will fit any model. We'll also find out, Why IP blocking is unreliable and how to bypass it with DHCP reservations.

1. Blocking via a MAC address blacklist (the most reliable method)

MAC address — This is a unique identifier for a network device that cannot be forged without specialized knowledge. Blocking using this method is considered the most effective, as it is not affected by IP or network name changes. To find the MAC address of an uninvited guest, follow these steps:

1. Open your router's control panel (usually at 192.168.1.1 or 192.168.0.1).
2. Go to the section Wireless Mode → Wireless Mode Statistics (the name may differ).
3. Find the device you need in the list of connected devices and copy its MAC (format: XX:XX:XX:XX:XX:XX).

Now add it to the blacklist:

• 🔒 In TP-Link: Advanced Settings → Wireless Mode → MAC FilterSelect "Deny", enter the MAC address and save.
• 🔒 In ASUS: Local Network → Routing → MAC FilterEnter the address and activate blocking.
• 🔒 In Keenetic: Home Network → Devices → [Select device] → Block.

Copied the device's MAC address|Added to the blacklist|Saved router settings|Rebooted the router (optional)

-->

⚠️ Attention: Some devices (such as smartphones) Android 10+) can use MAC randomization, changing the address each time you connect. In this case, MAC blocking won't work—use other methods.

2. Parental control: temporary blocking by schedule

If you need to restrict access not forever, but only during certain hours (for example, for children), use parental controlThis method allows you to:

• ⏰ Block internet access by time (for example, from 10:00 PM to 7:00 AM).
• 📱 Block specific devices or all at once.
• 🌐 Restrict access to certain websites (social networks, games).

Instructions for popular routers:

Example setup for TP-Link:

1. Turn on parental controls in the menu Additional settings.
2. Add a rule: specify the MAC address of the device, select the days of the week and blocking time.
3. Save and reboot the router.

3. IP Blocking: Why It's Unreliable and How to Do It Right

Many people “advise” to block devices by IP, but this method doesn't work in 90% of cases. The reason is simple: the router distributes IP addresses dynamically (via DHCP), and the device can get a new one the next time it's connected. However, there is a workaround— IP reservation:

1. Find the MAC address of the target device (see Section 1).
2. Go to Local Network → DHCP Server (the name may differ).
3. Add a reservation rule: bind the MAC to a specific IP (e.g. 192.168.1.100).
4. Now block this IP in your firewall settings (Security → Firewall).

Example command to block IP in OpenWRT (advanced routers):

iptables -A FORWARD -s 192.168.1.100 -j DROP

⚠️ Attention: If the network is used IPv6, IPv4 blocking won't work. In this case, disable IPv6 in your router settings or configure a firewall for both protocols.

4. Guest network as an alternative to blocking

Instead of denying access, you can isolate the device into a separate network. The guest network allows you to:

• 🔐 Allow internet access, but block local resources (printers, NAS).
• 📶 Limit speed or operating time.
• 🛡️ Automatically disconnect devices after connection is lost.

How to set up a guest network on ASUS:

1. Go to Wireless Network → Guest Network.
2. Enable guest access, specify the network name (for example, Guest_WiFi) and password.
3. Under Local Network Access, select Deny.
4. Save the settings and connect the unwanted device to this network.

What should I do if the guest network is not displayed?

Make sure your router supports multiple SSIDs (usually mid-range and high-end models). If this option isn't available, update your firmware or use alternative blocking methods.

5. Advanced Methods: VLAN and Firewall

For experienced users, there are more flexible methods:

• 🌐 VLAN (Virtual LAN): Creates virtual networks, isolating devices from each other. Supported on routers with firmware DD-WRT, OpenWRT or enterprise devices.
• 🔥 Firewall: Manually adding rules to block traffic. For example, in Keenetic You can create a "Drop" rule for a specific MAC.
• 📡 Separate SSID with restrictions: some routers (eg. Ubiquiti) allow you to configure different policies for different networks.

Example of VLAN configuration on OpenWRT:

1. Go to Network → Switch.
2. Create a new VLAN (eg. VLAN 2) and assign it a separate port.
3. In the Wi-Fi settings, bind the guest network to this VLAN.
4. Configure the firewall to deny traffic between VLAN 1 (the main network) and VLAN 2.

6. How to check if the lock has worked

After using any of these methods, you must ensure that the device is truly turned off. Follow these steps:

1. Try connecting from a blocked device. If the MAC/IP blocking is enabled, you'll see the message "No internet connection" or "Authentication failed."
2. Check the list of connected devices in the router control panel. The blocked device should disappear from the list or be marked as "Blocked."
3. Use apps like Fing (For Android/iOS) or Wireless Network Watcher (For Windows) to scan the network for "uninvited guests".

If the device still connects:

• ❌ Make sure you save your router settings and reboot it.
• ❌ Check if the MAC address has changed (especially on modern smartphones).
• ❌ If you are blocked by IP, make sure that the address has not changed (look in DHCP clients).

7. What to do if nothing helps

If all methods have proven ineffective, the problem may be deeper:

• 🕵️ Password leak: Someone has found out your Wi-Fi password and is connecting manually. Change your password complex (at least 12 characters, with numbers and special characters).
• 📡 Router vulnerability: older models (eg D-Link DIR-300) have vulnerabilities that allow unauthorized connections. Update your firmware!
• 🔄 Double NATIf you have two routers on the same network, blocking may not work. Disable DHCP on the second device.

Extreme measures:

• 🔧 Resetting the router to factory settings (button Reset for 10 seconds).
• 🛡️ Disabling WPS (a vulnerable protocol that allows connection without a password).
• 📶 Changing the network name (SSID) and hiding it in the settings (Hide SSID).

⚠️ Attention: Router interfaces may vary depending on the model and firmware version. If you can't find the menu items listed, consult the official manual for your model.

FAQ: Frequently asked questions about device blocking

Is it possible to lock a device by name (eg "iPhone")?

No, the device name (host name) is easy to spoof. Blocking by it is not reliable. Use MAC address or IP with reservation.

How do I find out who is connected to my Wi-Fi?

Go to the router panel in the section Wireless Mode → Statistics or use applications Fing, NetCutThey will show all connected devices with MAC, IP, and manufacturer.

The blocking worked, but the internet speed is still slow. Why?

Possible reasons:

• There are other devices connected to your network (check the list).
• The neighbor is using the same Wi-Fi channel (change the channel in the router settings).
• Problems on the provider's side (call support).

Is it possible to permanently block a device so that it cannot connect even after resetting the router?

No, after a reset, all settings (including the MAC blacklist) are reset. To permanently block the connection, use:

• A complex Wi-Fi password (for example, k7#pL9!qW2$vR5).
• Disconnection WPS and hiding SSID.
• MAC filtering at the provider level (if such a service is supported).

Does blocking work if the router is in bridge mode?

No, in bridge mode, the router doesn't manage connections—the primary device takes over. Configure the blocking feature on the primary router.