Owen Bradley Sooner or later every home network has an unwelcome guest. It might be a neighbour who still has the password you handed out two summers ago, an old tablet that keeps waking up and hogging bandwidth, or a device you simply do not recognise in the router’s client list. The good news is that every modern router gives you at least one way to kick something off and keep it off. The bad news is that the most famous method, MAC address filtering, is also the weakest, and mobile phones now defeat it by default. This guide walks through how to block a device from Wi-Fi properly, which method to pick for which situation, and how to make the block stick rather than lasting until the next reboot.
What You Need Before You Start
Blocking is a router-side job, so gather a few things first. None of it costs money and the whole process usually takes under fifteen minutes.
- Router admin access. The login page address is normally printed on the router label, commonly 192.168.0.1 or 192.168.1.1. You need the admin username and password, which is not the same as the Wi-Fi password.
- A device already on the network. Use a laptop on Ethernet if you can, because some blocking steps briefly restart the wireless radios.
- The offender’s identity. Ideally the MAC address, a twelve-character code like A4:5E:60:1B:22:C7. Failing that, the hostname or IP address shown in the client list.
- A written list of your own devices. Before you block anything, note the MAC address of every phone, laptop, TV and smart plug you own so you never lock out something you need.
Step-by-Step: Blocking a Device From Your Wi-Fi
- Log in to the router. Open a browser and type the router’s IP address, or use the manufacturer’s app if it offers full admin control. Sign in with the admin credentials, not the Wi-Fi key.
- Open the connected devices list. Look for a menu called Attached Devices, Client List, Device Manager, Network Map or similar. It shows every client currently holding a lease, with a name, an IP address and usually a MAC address.
- Identify the device you want to block. Turn off the Wi-Fi on each of your own devices one at a time and refresh the list. Whatever stays online after everything you own is offline is the stranger. Write down its MAC address exactly.
- Choose your blocking method. Most routers offer a one-click Block or Deny button next to each client, an Access Control list, or MAC filtering. Use the built-in block button first, since it is the fastest and least likely to be undone by a firmware quirk.
- Apply the block. Select the device, choose Block or Deny, and confirm. On routers that use an access control table, switch the policy to blacklist, add the MAC address to the deny list, then save.
- Save and let the router apply changes. Some routers restart the wireless radios here, dropping every client for ten to thirty seconds. That is normal.
- Verify the block worked. Refresh the client list after a minute. The blocked device should either vanish or show a blocked status. If you have physical access to it, try connecting: it should fail to obtain an address or repeatedly say authenticating.
- Change the Wi-Fi password. This is the step people skip and then wonder why the block keeps failing. Blocking one MAC address does nothing about a password that has been shared around. Set a fresh passphrase of at least twelve characters using WPA2 or WPA3.
- Reconnect your own devices. With the new password in place, rejoin everything you own, including the quiet ones such as printers, doorbells, smart plugs and TVs.
Understanding the Three Blocking Methods
Routers bundle these under different names, but there are really only three mechanisms underneath, and they differ a lot in how hard they are to defeat.
MAC Address Filtering
The router keeps a list of hardware addresses and either denies the ones on the list (blacklist) or allows only the ones on it (whitelist). It is universally supported and takes two minutes to set up. Its weakness is that MAC addresses are trivially changed in software, and anyone determined can simply clone an allowed address. Treat it as a way to manage devices, not as security.
Access Control Lists and Profiles
Higher-end routers group devices into profiles or user accounts and apply rules per profile, including full internet blocking, curfews and category filters. This is far more useful in a family setting because you can pause a child’s tablet at bedtime without removing it from the network permanently. If that is your real goal, a router built for the job saves a lot of fiddling, and our roundup of the best parental control routers compares models with genuinely usable scheduling.
Guest Network Isolation
Instead of blocking, you separate. Visitors get their own SSID with its own password, client isolation enabled and no access to your main network’s shared drives or printers. When the visit ends you change or disable that password and nothing else on your network is disturbed. Routers with a properly isolated guest SSID are covered in our guide to the best routers with guest network support.
Why Random MAC Addresses Break MAC Filtering
Recent versions of iOS and Android generate a different, randomised MAC address for every network a phone joins, and some rotate that address periodically. The privacy benefit is real, but the side effect is that a blacklisted phone can rejoin under a brand-new address the moment it forgets and re-adds the network. You block A4:5E:60:1B:22:C7 and thirty seconds later 7A:11:9F:C0:34:B2 appears in the client list, and it is the same handset.
There are three practical answers. First, change the Wi-Fi password, which defeats every address the device can invent because it no longer knows the key. Second, use a whitelist rather than a blacklist so unknown addresses are denied by default, accepting that you must add every new device manually. Third, use a router that blocks by device profile rather than by raw MAC, which tracks the client across address changes. The third option is the least painful day to day.
Blocking Internet Access Without Removing the Device
Sometimes you want a device on the local network but off the internet. A camera that should only stream to a local recorder, a games console that should be offline during homework hours, or a smart TV you would rather did not phone home all night are all good candidates. Look for a setting named Internet Access Control, Block Internet, or a per-device toggle inside the parental controls section. The device keeps its address and stays reachable inside the house, but outbound traffic is dropped.
Firewall rules give you the sharpest version of this control, letting you block a single device by IP address, restrict it to particular ports, or allow only local traffic. Routers with a proper rules engine rather than a few checkboxes are worth the upgrade if you plan to do this often; see the best firewall routers for models with granular outbound rules.
Safety and Housekeeping Notes
- Never block your own gateway or repeater. Mesh nodes and extenders show up as clients. Blocking one can knock out half the house.
- Do not enable a whitelist remotely. If you get the list wrong while away from home, you can lock yourself out of your own router.
- Keep firmware current. Access control bugs are common in old firmware, and updates also patch the vulnerabilities that let people onto your network in the first place.
- Disable WPS. Push-button pairing is a classic backdoor onto a network that otherwise has a strong password.
Troubleshooting: When the Block Does Not Hold
The device reappears with a new name. Almost always MAC randomisation. Change the Wi-Fi password and, if the router supports it, block by profile instead.
The block disappears after a reboot. Some routers only write access control rules to volatile memory unless you save the configuration explicitly. Save, reboot, then check the rule is still listed.
Blocking one device knocked out several. You probably blocked a range or an extender. Clear the rule, re-add only the exact MAC address, and check whether your extender rebroadcasts client addresses.
You cannot tell which client is which. Rename every device you own in the router’s client list. Once your own gear has friendly names, anything left with a raw manufacturer string stands out immediately.
Common Mistakes to Avoid
The biggest mistake is treating a MAC block as a security fix when the real problem is a leaked password. If you suspect anyone unauthorised has been on the network, rotate the passphrase and the router admin password together, then check the port forwarding and remote management settings for anything you did not create. The second mistake is building a whitelist and forgetting about it, so six months later a new laptop mysteriously refuses to connect and you spend an evening blaming the hardware. Document the list. The third is running very old equipment: a router stuck on WEP or WPA with no firmware updates can be broken into regardless of any filtering you configure, which is why a modern platform with WPA3 and automatic updates matters more than any single rule. Our picks for the best secure Wi-Fi routers cover the current security baseline worth having.
Frequently Asked Questions
Will the blocked device know it has been blocked?
Not explicitly. It will simply fail to connect, usually showing an authentication error or an endless obtaining IP address message. If you change the password instead, it reports an incorrect password, which is slightly less obvious.
Is MAC filtering worth using at all?
As a convenience tool, yes. As security, no. Use it to tidy up which devices belong on your network, but rely on a strong WPA2 or WPA3 passphrase for actual protection.
Can I block a device only at certain times?
Yes, if your router supports schedules. Create a profile for the device and set a time window for internet access. Purpose-built models handle this far more reliably than generic firmware, which is one reason the best routers with parental controls remain popular with families.
Does blocking a device slow down my network?
No. Denied clients are dropped at association, so they consume almost no airtime. Removing a heavy streaming device usually improves performance for everyone else.
How do I unblock a device later?
Return to the access control or client list, find the entry, and choose Allow or Delete. If you also changed the Wi-Fi password, you will need to enter the new one on that device.
Final Thoughts
Blocking a device from Wi-Fi is easy; making the block permanent takes one extra step that most people miss. Identify the client carefully, apply the router’s own block or access control rule, then change the Wi-Fi password so a randomised MAC address cannot walk straight back in. For ongoing control over kids’ devices or guests, profiles and a separate guest SSID beat maintaining a blacklist by hand. Keep a written record of the devices you own, keep firmware current, and revisit the client list every few months. Done that way, your network stays yours in 2026 and beyond, without a monthly ritual of hunting for strangers in the device list.
