In the age of ubiquitous wireless technology, home network security is becoming critical. Unauthorized access to your internet connection can not only slow down your connection but also lead to personal data leakage or the use of your IP address for illegal activities. Therefore, the question of how to block a device's access to a Wi-Fi network is a concern for many users who encounter signs of unauthorized intrusion.
Modern routers offer powerful tools for monitoring connected clients. You can completely isolate an unwanted device using MAC address filtering or temporarily suspend its operation using the router manufacturer's mobile app. In this article, we'll detail all available blocking methods, examine the interfaces of popular router models, and provide recommendations for strengthening your home network's security against unwanted guests.
Diagnostics: How to detect someone else's device on the network
Before taking decisive action to block the connection, you need to be absolutely sure there's an intruder. Speed drops can often be caused by interference in the air or background updates on your own devices. The first step is to visually analyze the indicators on the router: if the Wi-Fi light is flashing rapidly when all your devices are off or in sleep mode, this is a warning sign.
The most accurate diagnostic method is to log into the router's web administrator account. There, in the section State or Network map A complete list of all active clients is displayed. Please review the list carefully.: Each network card manufacturer has a unique identifier, which often includes the brand name in the device name. If you see a gadget with the name Unknown or a brand that is not in your home is a cause for concern.
For automated searching, you can use specialized network scanners, such as Fing or WiFimanThese applications scan a range of IP addresses and provide detailed information about each connected node, including the device model and open ports.
- 📱 Check the list of connections in your ISP or router manufacturer's mobile app.
- 💻 Compare the number of active devices in the router interface with the actual number of devices in your network.
- 🔍 Pay attention to an unusual network name (Hostname) that does not match your gadgets.
- 📉 Record sharp traffic spikes in your router logs at night.
Keep in mind that some devices may hide their names, displaying them as generic names or a string of numbers. In this case, comparing MAC addresses, which are unique to each network interface and don't change when reconnecting, can help.
Blocking via the router's web interface: general algorithm
A universal way to restrict access is to configure it directly on the router. This method works regardless of the operating system of your computer or smartphone and provides constant control. First, you need to access the control panel: open a browser and enter the gateway IP address in the address bar, usually 192.168.0.1 or 192.168.1.1.
After entering your login and password (often found on a sticker on the bottom of the device), find the section responsible for the wireless network. It may be called Wireless, Wi-Fi, Wireless mode or Client listThis is where the key information for access control lies. Your goal is to find the filtering function or blacklist.
⚠️ Attention: Before making any changes to your router settings, we strongly recommend saving the current configuration using the "Backup/Restore" function. This will allow you to quickly restore network functionality in the event of an important device being accidentally blocked or a configuration error.
The blocking process typically works like this: select a device from the list of active clients and click the "Block" button or add its MAC address to the filter table with the "Deny" rule. After applying the settings, the device will lose the connection and will be unable to reconnect, even with the correct password.
It's important to understand the difference between a temporary disconnection and a permanent block. Some routers allow you to simply "kick" a client, but without changing the password or filtering settings, it will reconnect automatically.
Instructions for TP-Link and ASUS routers
Routers from these brands occupy leading positions on the market, so let's take a closer look at their interfaces. TP-Link With updated firmware (green interface), the path to settings is through the menu Additional settings → Wireless mode → Wireless MAC address filteringHere you need to activate the function and select the "Prohibit listed devices from accessing the network" mode.
To blacklist an offender on TP-Link, simply click the "Add" button in the current clients section, which will automatically fill in the MAC address. In older versions of the interface (blue background), the logic is similar, but the path may differ: Wireless → Wireless MAC FilteringDon't forget to click the button. Save and then Enablefor the rules to come into force.
In routers ASUS With ASUSWNT firmware, access control is implemented through a partition Wireless network → tab MAC address filterThe interface here is more visual: you see a list of all connected devices in real time. Simply click the cross or toggle icon next to a suspicious device, and it will instantly be blacklisted.
ASUS offers flexible scheduling options, but a static rule is sufficient for simple blocking. The system will immediately terminate the connection with the selected client.
- 🔒 On TP-Link, be sure to select "Deny" mode, not "Allow," otherwise you will block everyone except those you select.
- 🔄 On ASUS, changes are applied instantly, without rebooting the router.
- 📝 Write down the MAC address of the blocked device in a notepad in case you need to unblock it.
Both manufacturers regularly update their software, so the menu layout may change slightly depending on the firmware version.
Setting up access on Keenetic and MikroTik routers
Equipment Keenetic (formerly Zyxel Keenetic) is renowned for its logical KeeneticOS operating system. Here, access control is a separate component. Go to the menu My Networks and Wi-Fi → Home networkIn the client list, click on the device name to expand the details and toggle the switch Always online to the off position, or use the lock button.
A more advanced method on Keenetic is to use an access profile. You can create a "Guests" or "Forbidden" profile and assign a rule to it. No internet accessThis allows you to not only turn off the device, but also redirect its traffic or limit its speed, which is useful for parental control.
For professionals and advanced users routers MikroTik offer maximum flexibility through the system WinBox or web interface. Blocking is done through the menu Wireless → tab Access List. Here a new rule is created, where in the field MAC Address the address of the offender is entered, and in the field Comment You can add a note.
In MikroTik it is critical to check the box Forwarding in a state no Or use firewall rule chains to completely drop packets. This ensures that the device cannot transmit data even if association with the access point is formally permitted.
⚠️ Attention: Configuring the MikroTik requires caution. An error in the firewall rules or access list can block access to the router itself, requiring a hardware reset to restore control.
The difference in approach is clear: Keenetic focuses on simplicity and speed, while MikroTik provides complete control over every bit of traffic, requiring in-depth knowledge of network protocols.
☑️ Check before blocking
Using black and white lists (MAC filtering)
The most reliable technical protection method is MAC filtering. Each network adapter has a unique physical address, hardcoded at the factory. A router can operate in two main filtering modes: Blacklist and Whitelist. Understanding the difference between them is critical for properly configuring security.
Blacklist — This is a list of devices that are denied access. All others can connect freely. This mode is convenient when you need to quickly disable a specific intruder without reconfiguring the entire network. You simply add the "neighbor's" MAC address to the block list, and they can no longer log in.
Whitelist — This is an enhanced security mode. In this mode, the router allows connections ONLY to devices that are on the list. Even if an attacker learns your password, they won't be able to connect because their MAC address isn't on the allowed list. This is the most effective protection, but it requires manual registration of each new device (a guest smartphone, a new TV).
To configure a whitelist, go to the filtering section, select "Allow listed" and sequentially enter the MAC addresses of all trusted devices. Once this mode is enabled, all other connection attempts will be ignored.
| Parameter | Blacklist | Whitelist |
|---|---|---|
| Operating principle | Blocks only selected devices | Blocks everyone except the selected ones |
| Security level | Average | Maximum |
| Ease of use | High (no action required for new guests) | Low (need to add each new device) |
| Reaction to password change | Does not protect against reconnection | Protects even if the password is known |
Using a whitelist is especially important for office or home networks, where it is important to prevent outsiders from connecting, even theoretically.
Radical measures: changing the password and hiding the SSID
If MAC address filtering seems too complex or you want to ensure that all users are kicked out at once, change your Wi-Fi network password. Changing the security key will disable all connected devices. You'll have to re-enter the new password on each of your devices, but this ensures that other devices (which you may not have identified yet) will lose access.
It is recommended to use a complex password consisting of mixed-case letters, numbers, and special characters, at least 12 characters long. The encryption type must be set to WPA2-PSK or WPA3, because it is outdated WEP hacked in a few seconds.
An additional security measure is hiding the network name (SSID Broadcast). This prevents your network from appearing on phones and laptops. To connect, users will have to manually enter the network name and password. This doesn't provide 100% protection (networks can still be found using specialized scanners), but it does filter out casual users who are trying to profit from free internet.
- 🔑 Change your Wi-Fi password immediately after purchasing a new router, deleting the factory one.
- 👤 Do not use personal information (dates of birth, phone numbers) in your password.
- 📡 Hiding the SSID may cause connection issues with some smart devices (IoT) that cannot search for hidden networks.
The combination of a complex password, WPA3 encryption, and periodic key changes makes your network virtually impenetrable to the average user.
What to do if you forgot your Wi-Fi password?
If you don't remember the password but have physical access to the router, you can find it on the sticker on the bottom (assuming you haven't changed it). If the password has been changed and forgotten, you'll have to reset the router using the Reset button (usually press and hold for 10-15 seconds) and set up the network again.
Frequently Asked Questions (FAQ)
Can a blocked device bypass the ban by changing its MAC address?
Technically, it's possible. Advanced users can clone the MAC address of a trusted device onto their own. However, for regular home use, this is a complex procedure requiring root access on Android or jailbreaking on iOS, so the risk is minimal.
Will my internet speed decrease after blocking other people's devices?
Yes, your speed should increase or stabilize as your connection channel clears out excess traffic. Latency (ping) in online games will also decrease.
Do I need to reboot my router after setting up filtering?
Most modern models (TP-Link, ASUS, Keenetic) apply changes instantly. However, if the device doesn't power off immediately, a brief reboot of the router will help ensure the new rules are applied correctly.
Will a blocked user see that they have been blocked?
They won't receive a direct notification. The network will simply show up as "Unable to connect," or the connection process will remain stuck indefinitely at "Obtaining IP address."