I have TP-Link TL-ER604W router wih MAC filtering enabled, allowing only clients from the list. I also have a TP-Link TL-WA850RE range extender in WDS mode.

The trouble is, when a client connects to the range extender, it can connect to the internet even though it isn't in the list of allowed MAC addresses.

Can someone please advise me as to what I'm doing wrong?

  • Is the range extender really in WDS mode? That is, does your main access point allow it to use WDS? Your description sounds like it's falling back to regular client mode. – grawity Jan 14 '18 at 21:49

MAC filtering is a completely inadequate method for increasing network security. Anyone can spoof any used address, MAC addresses are never encrypted. You need to use WPA2.

The router sees the MAC address of the extender, not the one of the client. So, if you allow the extender's MAC you allow everything connecting through it.

edit: If the MAC filter needs to work through the extender you'll need to filter the MAC on the extender.

PS: have you read this? Apparently, TP-Link has some specialties on their extenders.

  • I'm sorry I forgot to mention that WPA2 encryption is being used on the router. I just use MAC filtering for extra protection – Stefcyp Jan 14 '18 at 21:26
  • 2
    Well, it's useless. – Zac67 Jan 14 '18 at 21:47
  • @Stefcyp - use a long (25 character plus), random password for your WPA2-AES encryption and abandon the MAC filtering. Macchanger has been here for a long time. Everyone in range (their range, with THEIR big antennas) can see your MACs and clone them on their device. – Anti-weakpasswords Jan 18 '18 at 4:44

You must configure the MAC filter on each access point, when an access point forward packet from the client to another access point, the next access point only sees the forwarder's MAC.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.