MAC address filtering will block a device when its hardware address is not listed in the allow list, is entered incorrectly, or is randomized by the OS. Log in to your router, go to Access Control, manually add the MAC address that appears when you run ipconfig /all or in the Wi-Fi settings, and turn off client private address rotation.
Symptoms
- Device connects to Wi-Fi but gets no IP address or shows "authentication failed"
- One specific laptop or phone is blocked while every other device works fine
- New devices join, then drop off after a few minutes with no obvious error
- Router log lists "MAC filter drop" or "unauthorized client" entries
- Guest devices cannot connect even with the correct Wi-Fi password
Common Causes
Device MAC is not on the allow list
Filtering is set to "allow listed only" and the client's hardware address was never added. Common right after a router reset or firmware update wipes the list.
Private / randomised MAC address
iOS 14+, Android 10+ and Windows 11 rotate a fake MAC per SSID for privacy. Each rotation looks like a new, unlisted device to the router.
Typo in the whitelisted address
A single wrong hex character, or colons entered as dashes on a router that expects colons, silently rejects the client. Copy-paste beats retyping.
Filter mode set to deny instead of allow
Someone added the MAC to a blocklist rather than an allow list, or inverted the rule. The device is explicitly banned rather than simply missing.
USB dongle or VM changed the MAC
Docking stations, USB-Ethernet adapters, VPN clients and hypervisors expose their own MAC. The address the router sees is not the one printed on the laptop.
Step-by-Step Fix
- Is filtering really enabled?
Log on to the router at 192.168.1.1 or 192.168.0.1 with the admin name/password on the label. Under Wireless > Access Control (or Security > MAC Filter). If there's no option, you're looking at the wrong PSK or the wrong cause (DHCP exhaustion, band steering). If it is set, choose the mode: allow-list or deny-list. - Read the actual MAC of the client Windows:
Execute ipconfig /all in an admin command prompt and note the Physical Address under the connected adapter.macOS: Option-click the Wi-Fi icon to show the MAC address.iPhone: Settings > Wi-Fi > [i] icon next to SSID. Android: Settings > About phone > Status > Wi-Fi MAC. - Disable private / random MAC on the client
If the address changes each time the device joins the SSID, turn off randomisation for that network. iOS: tap the SSID and toggle Private Wi-Fi Address off. Android: Network details > Privacy > Use device MAC. Windows: Settings > Network > Wi-Fi > properties > Random hardware addresses off. - Add the address to the router allow list
Back in Access Control, choose Add and paste the MAC in the format the router expects (colons vs dashes matters). Give it a recognisable label like "Anna-ThinkPad". Save and, if prompted, reboot the radio. Some TP-Link and ASUS firmwares apply the rule only after a full reboot. - Fix the filter mode if it is inverted
Check whether the list is "Allow listed devices" or "Block listed devices". A device on the deny list will never connect no matter how correctly it is entered. Move the entry to the correct list, or flip the mode. Save the change before closing the tab. - Account for docks, VPNs and virtual adapters
If the client uses a USB-C dock or hypervisor, the visible MAC belongs to the dock or virtual switch, not the laptop. Whitelist the address the router actually logs. Router event logs under System > Logs usually show the rejected MAC in plain text. - Test, then decide whether filtering earns its keep
Reconnect the device and confirm it pulls a DHCP lease. MAC filtering is trivially bypassed with a spoofed address and adds real support overhead. For home and small-office networks, WPA3 with a strong passphrase, plus a separate guest SSID, delivers more protection with less friction.
Common MAC filtering symptoms mapped to cause and fix
| Symptom | Likely cause | Fix |
|---|---|---|
| Device authenticates then gets no IP | MAC not on allow list | Add the exact address under Access Control |
| Same device blocked intermittently | Private MAC randomisation | Disable private Wi-Fi address for that SSID |
| Whitelisted MAC still rejected | Wrong separator or typo | Re-enter using the router's expected format |
| All new devices blocked | Mode set to allow-list only | Add device, or switch to deny-list mode |
| Docked laptop blocked, undocked works | Dock exposes its own MAC | Whitelist the dock's address as well |
| Phone works, tablet does not | Tablet using randomised MAC | Turn off Private Address on the tablet |
Prevention
- Keep an inventory of whitelisted MACs with device names before firmware upgrades
- Disable private MAC on trusted networks so addresses stay stable
- Prefer WPA3-Personal or WPA2-AES over MAC filtering as your primary control
- Export the router config after any Access Control change
FAQ
Is it OK to have MAC filtering as my primary security?
Not likely. MAC addresses are included, unencrypted, in Wi-Fi frames and can be spoofed with a few lines of script in most OSes. Consider filtering a feeble resistance to an attacker. WPA3-Personal, or WPA2-AES with a long passphrase, does the heavy lifting. Keep filtering only if you need to for compliance.
Why does my iPhone use a different MAC address every time I connect?
As of iOS 14, iPhones create a per-SSID Private Wi-Fi Address to reduce tracking from network to network. When you connect to a router, you get a new, unknown, unlisted MAC address, and the router rejects it. To disable it on a network: Open Settings > Wi-Fi, tap the (i) for the network, and turn Private Wi-Fi Address off for that SSID only.
What are some MAC filtering rejection indications?
Examine the system log, find the rejected MAC, and compare it character for character to the one entered. Dashes instead of colons, or a dock or VPN adapter using its own address instead. If the log accepts the right MAC, ignore filtering: exhaust DHCP scope, band steering, captive portal.