The day after the router was blocked and the Internet was blocked, it changed the MAC and connected again. This is how I was blocked.

Last year, I caught an Android machine using the Internet in the backend of the router. I clicked Disable and watched it disappear from the device list. I felt quite relieved. The next night I looked through the device list, and another unfamiliar device popped up, with a name prefixed with "Xiaomi-Redmi". The MAC was completely different from the one from yesterday. My first reaction was that there was a new one. I was about to disable it again, but I had an extra thought.: I went into its details page and looked at the signal strength and connection duration - they were full and still transmitting things at two in the morning. The wall covering of my house is not that impressive. The probability of attracting two groups of Internet surfers in one night is too low. It was only later that I figured out that the two "different devices" were the same mobile phone. They had opened a random MAC, and disabling them meant that they were not disabled.

I struggled with this matter on the Mercury D191G for four days. The main problem was not the blacklisting itself, but "you thought you were blacklisted, but in fact you were just blacklisted." Next, write down the order of identifying people, blocking doors, and preventing recurrences. The operating positions of Mercury and Tenda are clearly written down. I have gone in and clicked on the backends of both companies.

First make sure it is really a new vest and not a new one.

If there is an unfamiliar device in the device list, don't jump to conclusions. I later fixed the three fields and looked at them to see if they were the same person.

Focus on the third line. The first six digits of the MAC are the manufacturer number (OUI). Normal equipment can be found to be made by Xiaomi or Huawei. After a random MAC is enabled on the phone, the generated address will have a "local management bit", and the manufacturer cannot be found in the prefix, or it may be a registration number that does not exist at all. I am here The device list is garbled I mentioned in the backstage of Mercury to check the position of MAC. The main thing here is to check whether the prefix is ​​correct. There is another stupid but effective way: Limit the speed of suspicious devices to 512Kbps, and those who cheat on the Internet will stop coming the next day. If you are really wronged, your family members will complain to you on the spot - it is gentler than Lahei, and it can also verify your identity. The speed limit entrance is at Mercury speed limit article Wrote in.

Don’t skip the step of identifying people. My neighbor disabled his son's mobile phone on his router. The child's mobile phone automatically changed the MAC and reconnected. His father thought he was kicking a thief and kicked him again, so he banned it four times. My family members also have random MAC enabled on their mobile phones. This is the system’s default behavior and it’s not their fault.

Why can't blacklisting people change their MAC?

When I blocked that phone, what the router actually recorded was the MAC it was using at the time. The disable rule is lying in the MAC filter table, and it says "This address is not allowed to access the Internet." The next time the phone connects to WiFi, the system will generate a new MAC. When the router sees that this number is not in the address table, it will be released as a new device. It's like you put a wanted notice on the door, and the wanted person is a piece of clothing, and the person changes into a coat and comes in.

This mechanism is the same for Mercury and Tengda, because MAC filtering originally blocks people based on their addresses. I won’t elaborate on the principle of random MAC here. The random MAC article I drew pictures in it, one sentence version: Every time a WiFi is connected (some systems will change it regularly), the system generates a fake address. The original intention is to prevent merchant tracking. The side effect is that all the MAC functions of the router - filtering, binding, speed limiting and designated devices - are all fake addresses.

If you know the principle, you will understand why serial blacklisting is useless.: How many pieces of "clothes" you ban can be regenerated into as many pieces. This is how I spent the first two days. I banned it three times and it came back three times. The fourth time I learned my lesson and stopped playing dress-up games with it and just changed the lock.

first line of defense: Change the password and close the door completely

There is only one premise for using the Internet: It stores your home WiFi password on the phone. If you don’t change your password, blacklisting and speed limiting are all temporary treatments. Changing the password is the only action that can prevent the other party from getting in. No matter how fancy the random MAC is, if the password is incorrect, it will stop at the door.

My approach is to directly replace it with a 16-digit string containing uppercase and lowercase numeric symbols. Don’t use family members’ birthdays - people who use the Internet often know you. Passwords such as birthdays that “only acquaintances know” are the first to be tried. The operation of changing the password can be completed in five minutes on the mobile phone. The specific steps are as follows: The article about changing Mercury password on mobile phone Walk. After the modification, the devices at home will be reconnected one by one. The smart sockets and cameras will be disconnected and need to be reconfigured. Be mentally prepared in advance and don’t be surprised to see the camera offline in the middle of the night after the modification.

Changing your password has a side benefit: The management password on the router's backend was also changed easily. I later checked the backend login records and found out that there were several login attempts from unfamiliar IPs in the backend during that time. I don’t know if it was a random one or a coincidence. The management password and WiFi password are two different systems. How to retrieve the background password if you forget it? Mercury backstage password article The two generations of interfaces were written separately and replaced with different ones.

second line of defense: Turn off WPS, and this side door must also be locked.

After changing the password, I didn’t dare to let it go because WPS was still on. WPS is the "one-click pairing" on the router. The 8-digit PIN code can be violently tried out within a few hours. After trying it out, changing the WiFi password a hundred times has no effect. People enter through the side door. Veterans who use the Internet to pick out routers with WPS turned on. This is not a metaphysics, but the tool automatically runs it.

The entrance to Mercury is on the "Wireless Settings" page in the background. There is a WPS switch or QSS, just turn it off. Tenda's is hidden in "Wireless Settings-WPS" and is also turned off. After both shut down, it is recommended to restart the wireless and confirm that the switch status is gray. After turning off WPS on my Mercury, the "mobile phone for surfing the Internet" never appeared again - it relied on the password being tried and added to the WPS cover. Both were locked, and it was useless to change ten MACs. It could not reach the authentication step at all.

third line of defense: Stupid way to identify MAC, don’t think about it if you have few devices at home

If you only have three or five devices at home and don’t have many guests, you can go to the “Host Network Protection” or MAC whitelist.: The MAC addresses on the list are allowed, but those not on the list can connect to WiFi and cannot access the Internet. Mercury is in "Internet Control", Tenda calls it wireless MAC filtering. This is the most thorough way to stop someone from using the Internet. Even if the password is correct, they will be stopped at the door.

There are two costs. First, guests have to be let in manually, and families with three groups of relatives in a month use diaphragm to respond. Second, if the random MAC of a family member's mobile phone is changed, you will be blocked from the door, which is equivalent to adding trouble to yourself - you must first change the "random address" to "use device MAC" in the WiFi details of each mobile phone. The Apple path is the "Private WiFi Address" switch in WiFi details, and the Android path is in "Privacy" or "Advanced" of the WiFi network. If you have more than ten devices and frequent guests, I advise you not to put them on the whitelist, change your password, turn off WPS, and check the device list regularly. These three things are enough. In case you need to use these operations such as blacklisting and kicking people offline, Block the third gear article I divided it into the most detailed parts, and also wrote down how to retrieve it if it was pulled out by mistake.

ending: My fixed inspection rhythm

Now my family goes through the equipment list once a month, and it only takes four steps and five minutes.:

If you still don’t understand the device list entry and exit, please fill it in first. Go through the equipment list and go to the article on Canceng.com , explain the three tricks of recognizing people in detail. One final reminder: Blocking people is not useless, it is useless to "old acquaintances who have changed their vests". New equipment appears for the first time, blacklisting still works ； It will change the MAC the next day, and that is a matter of password level. Stop fighting with the filter table and just change the lock. The most valuable lesson I learned in those four days was this - the hammer in the toolbox was useful, but this time the problem was a screw.