My router's WAN connection is configured to connect to a subscription based public WiFi network. I am effectively, extending a public WiFi network.

I've determined the public network has three different access points in range of my router (all using same SSID, but on different channels)

I've determined that one of the public WiFi APs for the public WiFi SSID, is faulty. My router's WAN connection roams between the good APs without issue, but when it roams to the bad AP, the internet access drops until the router roams back to one of the good APs.

I have identified the MAC addresses of the good and bad APs.

Given that the public WiFi network is not under my control, is there a way on my router to blacklist/block the faulty access point using its MAC address?

My router is Netgear WNDR3700v4, and I flashed with DD-WRT 06-23-2014-r24461


The ap option for iwconfig sounds promising:

man iwconfig(8) ap

Force the card to register to the Access Point given by the address, if it is possible. This address is the cell identity of the Access Point, as reported by wireless scanning, which may be different from its network MAC address. If the wireless link is point to point, set the address of the other end of the link. If the link is ad-hoc, set the cell identity of the ad-hoc network. When the quality of the connection goes too low, the driver may revert back to automatic mode (the card selects the best Access Point in range). You may also use off to re-enable automatic mode without changing the current Access Point, or you may use any or auto to force the card to reassociate with the currently best Access Point. Example : iwconfig eth0 ap 00:60:1D:01:23:45

Even when manually setting the AP to connect to, the connection still roams onto the rogue AP.

I've tried using the "Wireless MAC Filter" options in Wireless-Security in the DD-WRT control panel, and whilst they save, they don't seem to have any affect. I suspect this is because the adaptor is in client mode, so the settings aren't applicable.

I've also tried various iw commands like this:

iw dev ath0 station del aA:BB:CC:DD:EE:FF

I've poured over /proc/net/ hoping to find something to read and write values from and to, but still no luck.


iw dev ath0 disconnect

causes a connection reset, and in my testing, the adaptor always automatically reconnects to one of the good access points. But then, after an indeterminable amount of time, the adaptor roams back to the bad access point and internet access dies.

The only solution I can see at the moment is to write my own connection manager, but without figuring out how to use the tools to do that properly, it's going to be tough.

  • I am not sure I understand. What good is your router unless your extending the network in question with it? If thats the case then you should be setting up your access point to connect to a specific device. Its also not clear what you exactly mean by "will roam to it" – Ramhound Jul 9 '14 at 11:33
  • @Ramhound I've attempted to clarify. The router provides internet access to my devices. The router's own internet connection is a public WiFi internet connection. It's unconventional, but it works most of the time, and circumstances don't allow for anything better. By 'roam' I mean jump from one AP to another AP, with the same SSID. – jon Jul 9 '14 at 12:00
  • So your extending the public network. Which is exactly what I thought you were saying. It still does not make sense. Are you moving your router around to different locations. The public WiFi access points are not moving, so your router should be keeping its connection to the same access point, unless of course your disconnected from that that access point for some reason. – Ramhound Jul 9 '14 at 12:10
  • 2
    @Ramhound - In the real world, wireless environments can be very changeable indeed. Access points don't need to move for SNR to fluctuate signifcantly. – jon Jul 9 '14 at 12:42
  • 1
    Well, theoretically, wpa_supplicant supports connecting to a specific BSSID. Dunno about DD-WRT though. – Daniel B Jul 14 '14 at 11:28

As per Daniel's comment, startup.sh can modify /tmp/ath0_wpa_supplicant.conf to include variable bssid=<mac of good ap> in the network{} declaration, followed by # kill -HUP "$(pidof "wpa_supplicant")" to signal to wpa_supplicant that it should reload config.

This keeps the adaptor connected to an access point, blocking roaming to other access points.

  • 1
    Why is this the accepted answer, it whitelists a single specific AP instead of blacklisting only the faulty AP, which is not what was asked for. – Profpatsch Dec 10 '19 at 14:48

To give you the straight answer, so you don't have to spend your time reading a whole dictionary:

On an ATHEROS based DDWRT device - so this does not work on Broadcom, it will work on yours if telnetting into the router and running 'ps' yields a process called wpa_supplicant.

Go to Administration, Commands, and put this in and save as a Custom Script:

sed -i '7ibssid=xx:xx:xx:xx:xx:xx' /tmp/ath0_wpa_supplicant.conf

kill -HUP "$(pidof "wpa_supplicant")"

The first line inserts the line bssid=(mac address of upstream router) at line 7 in the wpa_supplicant, which should get it in the networking section. You can use less ath0_wpa_supplicant.conf to see what range networking is in, at the telnet prompt in the folder /tmp

The second line as the first answerer states, restarts wpa_supplicant.

The commands are copy-and-paste, as is. The only change you need to make is substituting the upstream AP's MAC for xx:xx...

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.