There are four practical ways to remove a device from your WiFi, and they differ enormously in how fast they take effect and how easily they are bypassed. Picking the wrong one is why people block a device, watch it reconnect ten minutes later, and conclude the block "did not work".
This guide covers each method, what it actually enforces, and where it breaks down.
Method 1: Change your WiFi password
The blunt instrument. Changing the pre-shared key immediately invalidates every saved credential on the network, so the device you want gone is disconnected the moment it tries to re-authenticate.
It works, and it cannot be trivially bypassed. The cost is that it also disconnects every other device you own, and you will spend the next hour re-entering the key on phones, laptops, TVs, printers and anything else with a radio in it.
- Effective immediately, and hard to circumvent
- Disconnects everything, not just the target device
- Useless if the person you are blocking will simply be told the new password
Method 2: MAC address filtering on the router
Nearly every consumer router offers a MAC filter, usually under Wireless, Access Control, or Parental Controls. You add the device's hardware address to a deny list and the router refuses its association requests.
How to do it
- Open your router admin page, typically 192.168.0.1 or 192.168.1.1.
- Find the connected devices or DHCP client list.
- Identify the target device and copy its MAC address (six hex pairs, like A4:B1:C2:D3:E4:F5).
- Add that address to the MAC filter deny list, or switch the filter to allow-list mode and omit it.
- Save and let the router apply the change.
Where it falls down
MAC addresses are not a security boundary. They are self-reported by the client, and every modern phone and laptop can change one. iOS and Android both ship MAC randomisation on by default now, which means a phone can rejoin with a completely different address simply by forgetting the network and reconnecting. Your filter is then blocking an address nothing uses.
MAC filtering is fine for a device that will not fight back, like a smart TV or a games console. It is close to useless against someone who does not want to be blocked.
Method 3: Guest network isolation
Rather than blocking a device outright, move it to a guest SSID with client isolation enabled. It keeps internet access but cannot see your main network, and most routers let you cap guest bandwidth or set access schedules.
This is the right answer more often than people expect. Much of the time the real goal is not "remove this device from the internet" but "stop this device from saturating the connection or reaching my file shares". Isolation solves that without a confrontation.
Method 4: Network-level blocking from a computer
Software running on a machine already on the network can enforce a block at the local network layer, without touching router configuration at all. Because the enforcement happens on the wire rather than in the router's association logic, it takes effect within milliseconds and does not require admin access to the router.
This is the approach Perimetery PRO uses. You see every device on the subnet with its manufacturer identified, and blocking is a single toggle. The policy is keyed to the device's hardware address, so it survives a restart of the app and a new DHCP lease.
- No router admin password needed
- Takes effect in milliseconds, and reverses just as fast
- Per-device, so nothing else on the network is disturbed
- Can throttle instead of block outright, which is often the better answer
Which method should you use?
| Situation | Best method |
|---|---|
| You think your WiFi password has leaked | Change the password |
| A smart TV or console is hogging bandwidth | Throttle it, or guest isolation |
| A device you control should never reach the LAN | Guest network isolation |
| You need it gone now, without router access | Network-level blocking |
| You want it slowed rather than removed | Per-device bandwidth cap |
A note on blocking devices you do not own
Everything above assumes the network is yours, or that you administer it with the owner's permission. Interfering with traffic on a network you do not control is illegal in most jurisdictions regardless of how easy the tooling makes it. If you are managing a workplace network, make sure your acceptable use policy actually covers what you are enforcing.
Frequently asked questions
Does blocking a MAC address permanently stop a device?
No. MAC addresses can be changed in software, and iOS and Android both randomise them by default. A MAC filter reliably stops appliances like TVs and consoles, but not a phone or laptop whose owner wants to reconnect.
Will the blocked device know it has been blocked?
It will see that it cannot reach the internet, but it is not notified of the reason. With router MAC filtering the device usually fails to associate at all; with network-level blocking it stays connected to WiFi but traffic does not pass.
Can I block a device only at certain times?
Many routers support access schedules on guest networks or parental control profiles. Scheduling is not yet available in Perimetery PRO, where blocks apply until you change them.
Is it better to block a device or limit its bandwidth?
Limiting is usually better. Most complaints that lead people to block a device are really about one device saturating the connection. A bandwidth cap fixes the congestion without removing access.
See every device on your network
Perimetery PRO shows live upload and download per device, and lets you cap or block any of them in one click. Runs on one Windows machine, no agents to deploy.
See pricing