How to Set Up MAC Filtering on Your Router

What MAC filtering does

MAC filtering is a router feature that checks the media access control address, usually called the MAC address, of each device that tries to connect. You can build a list of approved addresses and let only those devices join, or build a blocked list and keep everyone else working. The MAC address is a hardware identifier that the router sees on every Wi-Fi and Ethernet frame.

Think of it as a door policy. An allow list is like a guest list: only names on the list get in. A deny list is like a list of people banned at the door: everyone else can enter. Because the check is done by address, it does not require you to install software on each device.

• Allow list: only listed devices can connect.
• Deny list: everything connects except listed devices.
• Some routers let you combine MAC filtering with scheduling or parental controls.

Find the MAC filtering page

Open the router's admin page from a browser. The exact location depends on the manufacturer and the router model, but the feature is usually called MAC Filter, MAC Address Filter, or Wireless MAC Filter. It may be under Wireless, Advanced Network, Security, or Access Control. If you do not see it, check the manufacturer's support pages or the user guide. You can also find the router admin address and log in from a device on your network.

• Look under Wireless or Wi-Fi settings.
• Look for Access Control or Device Management.
• Search the router app or web interface for MAC filter.

Collect the MAC addresses

Before building the list, gather the MAC addresses of the devices you want to control. The easiest place to see them is the router's connected-device list, which usually labels each device with its MAC address, IP address, and hostname. On a phone or computer, you can also find the MAC address in the network settings for the Wi-Fi or Ethernet adapter. For a quick reference, keep a written copy or a notes file with each device's name and address.

Most routers display the MAC address as several pairs of characters separated by colons. Use the exact format shown on the router when you enter it into the filter. A small typo can make the rule fail, because the lookup is an exact match.

• Check the router's device list.
• Check the phone, tablet, or computer network settings.
• Check the label on smart-home devices if the router does not name them.

Build an allow or deny list

Pick one mode first. If you want a strict home network, choose allow list mode and add every device that should connect. If you only want to stop one or two devices, choose deny list mode and add those addresses. Apply the change after saving, because some routers do not activate the filter until the wireless network is restarted.

On routers that support multiple SSIDs, you can apply MAC filtering to one network only. Keep the main network on WPA3 or WPA2 and put guests on a separate Wi-Fi name. Filtering the guest network can help you control temporary visitors without touching your main devices.

Apply and test the policy

After saving, test the policy with a device you want to manage. If you created an allow list, try connecting with a device that is not on the list and confirm it fails. Then try a listed device and confirm it works. If you created a deny list, connect with the blocked device first, then connect with another device to confirm normal access.

Testing matters because a filter that is too strict can lock out your phone or laptop. If that happens, connect with another admin device or use an Ethernet connection to the router and remove or adjust the rule. Keep the router admin page reachable so you can fix mistakes.

• Forget the Wi-Fi network on the test device before testing.
• Wait for the router to apply the change.
• Re-check the router's connected-device list to see whether the device appears.
• If the wrong device gets in, double-check the MAC address and the filter mode.

Understand the limitations

MAC filtering is not strong security. A determined user can change the MAC address of a computer or phone in software, and some routers even include a MAC cloning option that copies another device's address. The Wi-Fi Alliance treats WPA3 and Protected Management Frames as the core protections for modern Wi-Fi; WPA3 should be your first line of defense.

Use MAC filtering as one layer in a security plan that also includes encryption, regular firmware updates, strong router passwords, and a separate guest network for visitors. Security guidance from organizations like NIST emphasizes layered risk management, not a single control.

If you are shopping for a router and want filtering plus modern security features, compare current Wi-Fi 6 routers or Wi-Fi 7 routers. The router's admin interface should make it easy to find the MAC filter and to change the Wi-Fi password.

When to use MAC filtering

For everyday use, a well-configured password and WPA3 are more effective than MAC filtering. Use MAC filtering when you need an extra access rule, such as keeping a smart-home hub on a dedicated IoT network or blocking a device your family cannot agree to remove. Parental controls and schedules can also stop Internet access at certain times; MAC filtering is address-based rather than time-based.

If a specific device keeps reconnecting and you want a quick block, use the router's device block feature or the MAC filter. If you need finer access controls for different household members, pair MAC filtering with parental controls rather than relying on the address list alone.

What to pick for your use

Questions

Is MAC filtering secure?

Not by itself. It can deter casual access, but MAC addresses can be changed in software. Use WPA3 encryption and Protected Management Frames as your primary security and treat MAC filtering as one extra policy layer.

Should I use an allow list or a deny list?

An allow list is stricter because only listed devices can connect. A deny list is easier to manage because it keeps everything working except the addresses you add. Choose an allow list for a small trusted group and a deny list for a quick block.

How do I find a device's MAC address?

Check the router's connected-device list, or look in the device's network settings. The router sees the MAC address of every client that connects, so the device list is usually the fastest place to find it.

What happens to a blocked device?

The router ignores or rejects frames from that address, so the device cannot complete the normal Wi-Fi association and will not get network access. It may appear connected at the operating system level for a moment, then stop working.

Does MAC filtering slow down Wi-Fi?

It should not affect the radio data rate in a noticeable way. The router simply checks the address before allowing access, and modern routers do that work without delaying normal traffic.

Can a device bypass MAC filtering?

Yes. A user can change the MAC address in software, and some routers even offer MAC cloning to copy another device's address. That is why MAC filtering works best as a convenience or policy layer, not as a strong security boundary.