How to set up MAC address filtering and device allow-listing on your business router

Summary

This guide helps you troubleshoot and resolve: How to set up MAC address filtering and device allow-listing on your business router. Follow the steps below to fix the issue.

Common Causes

MAC address filtering is a straightforward way to tighten security on your business network. By creating an allow-list of approved devices, you prevent unknown laptops, phones, and other hardware from joining your office Wi-Fi, even if they have the correct password. This guide walks you through gathering MAC addresses, logging into your router, and configuring the filter on most common business routers used by 220 Internet Services customers.

If you are new to Wi-Fi basics, see our guide on how to connect to Wi-Fi before proceeding.

Before You Begin

You will need three things before you start:

• Admin access to your router. This is usually the default gateway address (commonly 192.168.0.1 or 192.168.1.1) typed into a browser. Your default username and password are often admin and admin, or printed on a sticker on the router itself.
• A list of every device you want to allow. Walk around your office and note down laptops, desktops, printers, VoIP phones, and any other hardware that needs network access.
• The MAC address of each device. A MAC address is a 12-character identifier (for example, A4:B1:C2:33:44:55) unique to every network-capable device.

Finding the MAC Address of Each Device

Windows 10 or 11

1. Press Windows + R, type cmd, and press Enter.
2. Type ipconfig /all and press Enter.
3. Look for Physical Address under your active Wi-Fi or Ethernet adapter. That value is your MAC address.

macOS

1. Click the Apple menu and choose System Settings (or System Preferences on older versions).
2. Select Network, then click your active connection.
3. Click Details or Advanced. The MAC address is listed as Wi-Fi MAC Address or Hardware Address.

iPhone or iPad

1. Open Settings, tap General, then About.
2. Scroll to Wi-Fi Address. This is your MAC address.

Android

1. Open Settings, tap About phone or About device.
2. Tap Status or All specs.
3. Look for Wi-Fi MAC address.

Network Printers and Other Devices

Most printers, smart TVs, and IoT devices print their MAC address on a label on the back or bottom of the unit. You can also usually find it in the device's network settings menu under Status, Network, or About.

Logging Into Your Router

1. Connect a computer to your router using an Ethernet cable if possible. This avoids being locked out if Wi-Fi filtering is enabled mid-setup.
2. Open a browser and type your router's gateway address into the address bar. Common addresses include 192.168.0.1, 192.168.1.1, or 10.0.0.1.
3. Enter your admin username and password. If you have never changed these, check the sticker on the router or the manufacturer's default credentials list.

Configuring MAC Address Filtering

The exact menu names vary between brands such as Netgear, DrayTek, MikroTik, Ubiquiti, and TP-Link. The general process is similar across all of them.

Locate the Filtering Section

1. Once logged in, look for a menu labelled Wireless, Security, Access Control, or MAC Filtering.
2. On DrayTek routers, look under Wireless LAN then Access Control.
3. On MikroTik routers, look under Wireless then the Access List tab.
4. On Ubiquiti UniFi equipment, open the UniFi Network application and go to Settings, then Wi-Fi, then Advanced.

Switch to Allow-List Mode

1. Change the filter mode from Disable or Deny to Allow. This means only listed devices can connect.
2. Some routers have a checkbox labelled Enable MAC Filtering or Enable Access Control. Tick this box.

Add Each Approved Device

1. Click Add, New Entry, or Add Device.
2. Type or paste the MAC address you recorded earlier.
3. Give the entry a recognisable name, such as Reception Laptop or Front Printer.
4. Repeat for every device on your list.
5. Click Apply or Save when finished.

Test the Configuration

1. Disconnect a known approved device from Wi-Fi, then reconnect. It should join without issue.
2. Try connecting an unlisted device, such as a visitor's phone. It should be denied.
3. If approved devices cannot connect, double-check the MAC address format. Some routers require colons (AA:BB:CC:DD:EE:FF) while others accept dashes or no separators at all.

Maintaining Your Allow-List

MAC filtering is not a set-and-forget feature. Plan to review your list every quarter or whenever staff or hardware change.

• New starters: Add their device's MAC address before they arrive to avoid setup delays.
• Leaving staff: Remove their devices from the allow-list promptly.
• Replaced hardware: Remove the old device's entry and add the new one.
• Visitors: Most routers let you create a separate guest network. Use that instead of adding visitor devices to your main allow-list.

Troubleshooting Common Issues

An Approved Device Cannot Connect

• Confirm the MAC address is entered exactly as shown, including correct casing and separators.
• Check whether the device is using MAC randomisation and disable it for your network.
• Verify the device is connecting to the correct SSID. Filters are usually applied per network.
• Reboot the router after saving changes if the new entry does not take effect immediately.

You Cannot Reach the Router's Admin Page

• Confirm you are connected to the router directly via Ethernet or Wi-Fi, not through another router or VPN.
• Verify the gateway address is correct for your router model. Check the manufacturer's documentation if the common addresses do not work.
• Try a different browser or clear the current browser's cache and cookies.
• Restart your computer and the router, then try again.

Filtering Works for Some Devices but Not Others

• Check whether the affected devices are dual-band (2.4 GHz and 5 GHz). Some older routers apply MAC filters to only one band, so you may need to add the MAC address to both.
• Confirm the device is not using a USB Ethernet adapter or dongle with a different MAC address than expected.
• Some virtual machines and VPN clients present a virtual MAC address. Add that virtual address to the allow-list if the VM needs network access.

Still Having Issues?