Is MAC address filtering effective on a wifi router?

Question

I want to improve the security of my home wifi. My neighbor wants to crack my Wi-Fi password with a nutcracker.

I tried to activate the protection by MAC address, but now my laptop and smartphone don't have access to the box. Is MAC address filtering effective?

How else can I secure my Wi-Fi?

I'm glad that you solved your problem, but adding "SOLVED" to the question's title is not how we do things around here. Accept the answer you found most helpful, or self-answer your question in a new answer. This way others experiencing same problems and looking for solutions would know how to solve it themselves too. Please also [edit] to add specific details of your problem to your question (it's rather unclear now what your configuration is/was). And specifics of what you did to solve it in a new answer, if the already existing one didn't work for you. Thanks! — TildalWave, Jun 06 '14 at 13:31
Did you add your laptop and smartphone to the allowed MAC list? — schroeder, Jun 06 '14 at 14:33
In addition to securing primary AP, just configure an open guest- and neighbour-friendly access point (maybe redirected into Tor)? — Vi., Jun 06 '14 at 17:47
Change the SSID to `STOP CRACKING OR I CALL THE COPS` - might give them the message. — Philipp, Jun 06 '14 at 18:29

score 22 · Answer 1 · edited Mar 17 '17 at 13:14

MAC address filtering is a very weak form of wifi protection:

the MAC addresses of your devices can be easily eavesdropped with tools like wireshark
the MAC addresses of their devices can be easily changed (OS dependent, but typically an option in Network Settings).
MAC address filtering is annoying to maintain. You have to login to your router configuration every time a new device connects, find the MAC address in the settings of the new device, type in 12 seemingly-random hexadecimal digits (or copy from the logs of connection attempts), and still tell the new device the new strong wifi password.

To secure your wifi, make sure you use WPA2 with a strong passphrase (e.g., 6-8 random words) with WPS (Wifi Protected Setup) disabled (WPS is broken). You should also check that your router doesn't have any known backdoors.

The strong high-entropy password is extremely important. Wifi passwords can be cracked in offline attacks after capturing a handshake, at a rate of trying millions to billions of passwords per second. However, 8 words randomly taken from a dictionary with 10000=10⁴ words, means there are 10³² passwords the attacker would have to try (assuming the attacker knew that's how you choose passwords -- the rate will be worse if they don't know this). At a rate of a billion passwords per second per computer with a million computers, it would take more than a billion years to crack an 8 random word password. (Note picking a well known quote/phrase is much much weaker even if it is 8 words long.) A passphrase of six random words would have 10²⁴ (e.g., with a million computers doing a billion passphrases per second it would take only 31 years to break). Note a four-word passphrase only has 10¹⁶ so a single computer doing a billion passphrases per second would take about a month or two to break it. A three-word passphrase can be broke by a single computer in under 20 minutes.

Note, if you choose to go the random characters route, if you choose characters randomly from uppercase+lowercase+numbers, then a three-word passphrase is about equal to a 7 character password, a four-word passphrase is about equal to a 9-character password, a six-word passphrase is about equal to a 13 character password, and a eight-word passphrase is about equal to an 18 character password.

Great answer -- thank you! Do you have any advice on what procedure a user should use to confirm that their router doesn't have any known backdoors? — D.W., Jun 06 '14 at 17:29
@D.W. - I'd suggest using your favorite search engine and search for (name of router) + "backdoor". Granted you may want to be careful doing this, could be used as evidence you tried to hack someone. Alternatively, use a router with open-source firmware like [DD-WRT](http://www.dd-wrt.com) / [OpenWRT](https://openwrt.org), which presumably do not have obvious backdoors. (Granted OpenSSL is open-source and had heartbleed and several more recent problems for a long time, so open-source while preferred isn't perfectly secure). — dr jimbob, Jun 06 '14 at 18:33
I only use wifi on my devices when needed, so by default the wifi is turned off and as such no MAC address can be found, but your last point is indeed annoying, especially since the maximum MAC address that can be stored is 20 with my router. — Cerveser, Mar 26 '16 at 15:31
@Cerveser - Your MAC address is not secret information -- it's necessary public info for wifi cards to identify packets intended for them. Every communication to any wifi router broadcasts the MAC to everyone with a wifi card in wifi radio range from you and this only needs to be eavesdropped once for just one device (e.g., wireless printer, smart TV, tablet, smart watch, internet camera, laptop, chromecast, smartphone). If by default wifi is off, then you are fine with or without MAC filtering -- there's no wifi to access as you turned it wifi off at the router. — dr jimbob, Mar 26 '16 at 16:00

score 5 · Answer 2 · answered Jun 06 '14 at 14:34

MAC protection isn't much protection at all since you can easily spoof your MAC address. Even if you hide your network SSID (Service Set Identifier) broadcast soon as you connect to the network using wireless and he's sniffing using tool such as AirMon-NG he would gain your SSID name for your AP (Access Point) which is passive and could attack the handshakes. More aggressive approach would be to send de-authentication pack so you have to re-authenticate and he would able to compromise the router.

If however you rarely connect wireless to the router having a longer password will just make his job alot harder if he's trying to brute/dictionary attack your router.

List of things you'll want to do:

Strong password like LinuxGuts69 recommended.
MAC filter (Just add your phone and other devices to whitelist).
Isolate your wireless clients from your network.
Hide your SSID like LinuxGuts69 recommended.
Limit the amount of devices that are connected to your network. If you have maximum of 3 devices connected and the hacker the 4th tries to connect he won't have space to connect. This would let you know if it was successful or not.
Enable successful connection logs on your router.
Enable time based network access if you are always working at x time then schedule your router to not broadcast at x time.
Change your default administrator password
Disable auto-connect on your devices. Only connect when you need to. Which will reduce the potential attack of handshakes.

score 0 · Answer 3 · answered Jun 06 '14 at 17:13

A couple of thoughts...

As pointed out, security based on MAC or SSID is pretty useless against a dedicated attacker. WEP encryption is useless as well.
Use the best security mechanism your router supports. WPA2 is good. WPA is okay, when used in conjunction with TKIP or EAP. Use the longest encryption key you're offered.
Use the longest PSK you are allowed (usually 63 characters); this will stop brute force attacks. Unless you have a lot of ad hoc additions to your WLAN, the key should be random sequence. FWIW..."LinuxGuts69" is a terrible password that a decent cracker will quickly find (2 dictionary words + "69" is the kind of pattern the specifically look for).
Look and see if your wireless AP supports changing the "key renegotiation interval". Change it to something smaller, like 300 seconds. This forces the AP and the client to compute a new session key and will defeat attacks that rely on collecting a lot of encrypted data under a single session key. Don't set it too small or it will effect performance.
If you have a small area that you use your WLAN in, reduce the transmit power of your AP radios. He can't hack you if he can't get a signal. Similarly, if your AP supports it, you might get a directional antenna the beams most all the signal away from your bad guy.
If you can find out the MAC of your bad guy, you can use something like Aircrack-ng to send him dissociate packets and repeatedly kick him out of your AP. Be aware that he can return the favor and kick you off as well.
If your bad guy has only has an 802.11B/G or 2.4GHz only 11N WLAN card, moving to 802.11A or 5GHz 11N means he can't see you. You might also change the channel your WLAN works over to one or the other end of the spectrum. If he's particularly unsavvy and depending on what gear he has, that can make it harder for him to get a signal to you.

There are probably some more things you can do, but complexity goes up pretty quick.

Joke Sr. OK · Answer 4 · 2014-06-06T18:02:09.567

-You can also use the small md5pass application to assist you in creating a much more elaborate and strong password on a more fragile, so you can use this password to better protect your network, here's an example:

   md5pass keyword bit 

  -Would be something like:

   md5pass inviolable 4096

           $1$4096$NBmqXsDvKsMuHCXHMXAJK.

 -Since -> $1$4096$NBmqXsDvKsMuHCXHMXAJK.

(It is the result generated by using the word inviolable md5pass that you can now use the generated key as password).

This is very useful to set a password to a user group to a router, wireless routers mainly because you can store the keyword that generated the password somewhere else and use the key that is stronger and better prepared to be used only for those who possess it, believe me here in my neighborhood there are many wireless routers with passwords that are very easy to crack a well drafted password does not mean you are 100% secure from intrusion, but believe hinder the work the attacker much what it is already something. With this you can use it like an pasword on some one of the systems WEP,WAP or WAP2 in the Wireless router.

This only provides security by obscurity. The hashed password *looks* much more complicated, but if the attacker knows or guesses that you are using md5pass in this way, he needs only to run the contents of a dictionary through md5 and try those few thousand keys, which will take very little time. You need a password with high entropy; running a low-entropy string ("inviolable") through a well-known deterministic function doesn't give you more entropy. — Nate Eldredge, Jun 06 '14 at 18:51
yes! but like I say before, this gave us a little help to keep more secure if combined with the others methods like WEP, WAP/WAP2... Without forget that we change the password "key" with some frequency give us more chance to block an try to invade us! Don't forget anyone system is inviolable and are our work leave it this way.But like I say before, this is only a point view of the use of the tools to do the security more strong in the access points. — Joke Sr. OK, Jun 06 '14 at 19:24

score -1 · Accepted Answer · answered Jun 06 '14 at 13:16

-1

If your neighbor is trying to crack your wifi you should change your password to a 15 character or more password containing letters, numbers, symbols, uppercase letters, lower case etc so its going to make it alot harder to crack the password to your wifi. If anything disable your network or make your network hidden.

answered Jun 06 '14 at 13:16

LinuxGuts69

42
4

Thanks a lot, i'll do that ! I hope he will not success to crack my connection – Belin Jun 06 '14 at 13:21
Yeah make sure its more then 15 and has special characters aswell to make it harder also you should randomly generate the new password. just look up password generator in google. I hope this helped! – LinuxGuts69 Jun 06 '14 at 13:26
6

Also, never use WEP as security, and disable the push button login if your router has the function. These are easy to crack. – BadSkillz Jun 06 '14 at 14:38
Good routers will disable WPS after a few failed PINs, though. (It should really be one; how hard is it to push a button?) – Ry- Jun 06 '14 at 16:56
3

Making your wifi hidden doesn't help much. It prevents it from appearing in normal WIFI configuration tools but does not work for any dedicated cracking tools. – Philipp Jun 06 '14 at 18:33

Is MAC address filtering effective on a wifi router?

5 Answers5