I manage my own Wi‑Fi network and want to prevent unknown devices from connecting, even if someone learns the wireless password. I have been using terminal tools such as `sudo arp-scan --localnet` to see devices on the local network, but I am confused by changing or randomized addresses and cannot rely on the limited settings available in my modem's web interface. Should I use IP addresses, MAC addresses, or another method to create a reliable device allowlist?
3 Answers
Be aware that many phones and laptops use private or randomized MAC addresses for each Wi‑Fi network. You can either disable that setting for your own network or add the current private MAC address shown in the device’s Wi‑Fi settings. If it changes later, the allowlist will need updating.
MAC filtering is only a basic deterrent, not strong security. Someone who can obtain the Wi‑Fi password may also be able to observe or spoof an allowed MAC address. Use WPA2 or WPA3 with a long, unique password, change the password if it has been shared, keep the router firmware updated, and use a guest network for visitors. If the modem cannot configure an allowlist, you would need a separate access point or router that supports it; scanning from a computer cannot enforce access control by itself.
For a device allowlist, use its MAC address rather than its IP address. Configure the router or wireless access point to permit only the approved MAC addresses, and optionally assign those devices fixed DHCP leases afterward. IP addresses identify network locations and can change; they are not a dependable way to identify hardware.
That helps clarify the difference. I was treating the changing IP addresses as if they were device identities.
So the scan can help detect devices, but the actual restriction has to be enforced by the router or access point. That is likely the missing piece.