Where to set the Xiaomi router whitelist? The security center switched on this switch, and even those trying to get the correct password couldn't get in
Last month, I caught a phone that was trying to free the internet. A notification popped up in the Mi Home app late at night: a new device was connected, named "HONOR X20." No one in my family uses Honor. Following the device list, I found that this machine had been connected intermittently for two months, with the internet hours always from 4 to 6 p.m.—when no one was home.
later confronted him, and it turned out that his nephew in middle school came over on the weekend and gave the WiFi password to a classmate from the same community. After school, he could just pass by downstairs and connect. With my old temper, I just changed the password and got the job done. But this time I hesitated: there were over sixty devices at home, and more than twenty smart devices alone. change passwords cameras, and vacuum cleaners would be reconfigured one by one, and it would be all in the middle of the afternoon. There was only one device to use online, so why should sixty devices in the family be required to re-verify it?
this time I changed my approach: no password change, just open the whitelist. Devices outside the name—even if you enter the password correctly, you can't get in. Previously, in my post about checking the internet-freeloading devices, I mentioned the whitelist as 'if you can't afford to serve, use outdated methods.' This time, after thinking it over carefully, I realized it's not that you can't afford to serve, but that you haven't used the right approach.
first distinguish: blacklist means kicking someone, whitelist means locking the door
these two names are easy to mix in. The blacklist is when you identify the one who used to mooch the internet, kick it out individually, block it, and do the other devices as usual—against known enemies, the blacklist is enough. The whitelist is the opposite: first, a "list of insiders" is created. People on the list can enter freely, while those outside are completely excluded, regardless of whether the password is correct.
difference lies in who is being defended. The blacklist protects against "those who have already entered"; if you don't know it exists, you can't keep it out; The whitelist guards against those who haven't come in yet. The phone from the neighboring building that got the password, the shop staff downstairs, and anyone who gets the password from his nephew are all kept at the door. In my case, I caught one by riding the internet, but who knew a few copies of the password would leak out? The whitelist is the real way to break the root.
costs are obvious: once the blacklist is opened, nothing else matters; once the whitelist is open, every device in the home that needs to connect must be on the list first. Sixty-something machines sound scary, but the actual operation takes about ten minutes. Let's explain in detail.
Where is theswitch: Security Center in the frequently used settings, and the Mijia app also has a
web page backend path: 192.168.31.1 (or enter miwifi.com, same method) → Log in to the backend → Common Settings → Router Security Center。 Once inside, the blacklist and whitelist sections are side by side. Below the whitelist is a "Add Online" button, which is the main entrance.
two types of additions for equipment. "Add Online" pops up a list of currently connected devices. Select, confirm, and enter the list with one click, suitable for batch use; "Manual Add" means entering your own MAC address, separated by colons in hexadecimal, making it suitable for reserving space for devices not yet connected to the internet. I mostly use online adding; manually filling in MAC is only a trick when you can't find it in the online list.
two things to mention. First, the menu on older models isn't called the Security Center. The old mini in my drawer goes to 'Network Settings→ Advanced Features→ Wireless Access Control. The names are different, but just remember the words 'Blacklist/Whitelist.' Second, the Mijia app also has the same set of switches: router plugin → anti-internet access, which can be turned on, off, or added on your phone. When you're out, temporarily placing a device is easier than opening a computer.
my recording of adding it: you have to wake up sleeping devices first
before opening the whitelist, put all your home devices on the list—this is the most thoughtful step. My order was to first count: more than forty wireless devices (phones, tablets, speakers, cameras, and a bunch of vacuum cleaners), and a few network devices (desktops, TVs, IPTV enclosures). Here's a worry-free feature—the name includes 'wireless' and it manages WiFi access. Devices plugged in don't go through this door, so my desktop doesn't need to add it at all.
then wake up the devices one by one. The list of online additions only shows the currently online device, while many devices at home are asleep: the TV box is on standby, the printer is usually powered off, and the temperature and humidity sensor is sleeping. After the first check, I only had about thirty units, missing the printer and one camera. The next day, the printer turned on and couldn't connect to the internet, so I realized it wasn't on the list. I woke it up, put it in the background, and checked it on the whitelist, and it was fine. The lesson from this step can be summed up in one sentence: before open the whitelist, power on and wake up every wireless device in your home one by one, and make up all at once. Don't do my practice of splitting it into two days of tutoring.
devices with random MACs don't need to worry. Apple's Android "private address" is a fixed random MAC per WiFi network, not changed every time you connect to the internet, so adding your phone to the whitelist once is enough, without repeating it. I explained this mechanism in my about MAC addresses, and my iPhone at home is connected to WiFi without any issues, so don't worry.
there's a lazy boundary situation: I have an old AX3600 at home that only emits a 2.5G IoT private network, with a whitelist only on the main router AX3000T, and the WiFi on the private network isn't managed by the other side—each machine manages its own broadcast. I never even had a whitelist on the IoT private network; the passwords were obscure, and all the devices were troublesome low-power products, not worth serving.
three pitfalls: customers, new equipment, and a
of continuous service. After the first week, all three pitfalls came one by one.
pitfalls first: customers can't get through. mother-in-law's friend came to visit. After entering the password and spinning around for a long time, the message finally showed that the connection couldn't be reached—the password was correct, but the whitelist wouldn't allow entry. There are two solutions: temporarily go to the security center to turn off the whitelist, then the customer connects and reactivates it, within a minute; Or simply let guests connect to their phone hotspots. You can operate it in the Mijia app, so you don't have to go to the study to turn on the computer. If guests come often, you need to plan this in advance to avoid embarrassment.
pitfall two: the newly purchased smart device failed to connect to the network. the whitelist was open, but new devices weren't on the list, the network setup step got stuck—the camera scanned the code and spun in circles, but the vacuum cleaner wouldn't connect. It's not that the equipment is broken, it's that the door isn't open. Correct order: Before configuring the network, turn off the whitelist. Once the device is set up and connected to the internet, check it in the online add-in section to add it to the list, and finally open the whitelist back. If you accidentally damage devices already connected to the network, causing mass disappearance, follow the Mijia device offline check first rescue them, then add missing devices to the list.
third is the 'Indulgent Snack' and 'Break Dishes'. this is what the official statement says: once wireless access control is enabled, the router quick connection (Changkuai connection) won't work. The two functions are inherently mutually exclusive—Kuailian's system relies on hidden channels to automatically connect devices to the network, while access control only allows MACs on the list, which logically conflicts. The 'Smooth Link' mode means the smart device won't disconnect after changing the password, while the 'Whitelist Map' means unfamiliar devices can't get in. If you want both, you can only choose one. I chose the whitelist, since changing passwords is basically nowhere to be seen in my home—the door is locked, so why bother changing the lock cylinder?
which families are suited to drive: a checklist
whitelist isn't something everyone should open; the more equipment you have, the higher the service cost. Match this chart:
| family situation | it's recommended to | reasons |
| no more than ten smart devices | and check every ten minutes Once and for all, the defense line is fixed once and for all | |
| with solid evidence that you've been used online | I suggest opening the | password has already been leaked, so changing the password is better to lock the door |
| fifty or sixty pieces of equipment | think carefully before opening | count, wake up, and add to the list, doubling the cost |
| frequent guests at home | Install guest network and then activate | guest network to avoid the hassle of constantly adding new equipment every |
| on | always having to close and then open the door every time you set up the network, which is annoying |
my compromise is a whitelist plus new device notifications—double insurance: the whitelist blocks those off the list, while the Mijia app's new device access reminders keep an eye on those on the list—if any of your devices change their MAC (factory reset or network settings will change), as soon as the notification rings, I know it's time to add to the list, so I don't have to wait for the device to go missing.
finish with a complete sequence
start in this order, and one run becomes:
| sequence | movements | key points |
| 1 | decide whether to start the | First, check the number of devices and the risk of internet access |
| 2 | and wake up all wireless devices | wake up those that are asleep or powered out, and skip the network cables |
| 3 | Security Center adds online | checks all at once, missing any |
| 4 | to open the whitelist | after starting, test a device from the list to confirm it truly |
| 5 | blocks the new equipment through the process | temporarily shut down the → distribution network→ add → to the list before activating |
a month after driving, that Honor never appeared again, and my nephew's classmate switched to another entertainment spot. When it comes to anti-internet access, checking for internet access relies on notifications, kicking internet access relies on blacklists, and rooting out the virus relies on whitelists—after three layers, this router at home finally feels like a home with access control.
