@Dee_Evans 

To add to what was said by @Wrayman  

This feature is called "Allow List" and is documented here: How to configure Wi-Fi Access Control on your Deco

This feature is not available for Deco M5, and might never be as M5 is reaching or already reached End of Sale status. It is unlikely TP-Link will release firmware update with new features for M5.

If you need "Allow List" feature, you may need to buy Deco that supports it, from those most compatible with M5 is going to be Deco X50 or Deco X55. If I am correct, you only need Main Deco with that feature to have it for all of your Deco mesh, which means buying single X50 or X55 and making it Main Deco.

If you think it is also time to upgrade your Deco mesh from WiFi5 (M5) to WiFi6 (X50/X55), you can just replace all M5s you have with X50/X55s.

  @Wrayman 

Wrayman wrote

  @Dee_Evans it sounds like their devices are using a random MAC address to bypass your blacklist/blocking. The only way to prevent them joining the network is for TP-Link to update the firmware of the router to create a whitelist of approved devices instead of a blacklist (which in a world where most mobile devices have random MAC addresses by default should be a standard feature).

 

Assuming the devices aren't owned by friends or family, you should also come up with a better wifi password and change your network SSID after hiding it to improve your security.

Hi - somewhat of a novice question here but I better ask BEFORE I do something dumb.

OK - I think I understand the business with random MAC addresses, and how a Block List can be bypassed simply because the Block List relies on MAC address for identification, and those can be faked. Now suppose I change to Allow List mode. Won't random MAC addresses cause exactly the same problem, but in reverse? My wife's iPhone may be on the whitelist now, but if she travels and then comes back home and reconnects, her phone will generate and identify itself with a different random MAC address. Which is NOT on the whitelist, so her connection request will be rejected. Right?

One potential solution is to disable the generation of random MAC addresses; but while this solves one problem, it may generate worse ones - those that led to the idea

of "generating random MAC addresses" in the first place. Or am I misunderstanding this?