Are these a complete waste of time since any users of mobile devices can change their MAC with a simple swipe or touch of a button?
How are you guys authenticating multiple attached devices?
Although mobile devices can forge MAC addresses, ordinary users rarely change MAC addresses.
For ordinary networks, blacklists can still block some harmful devices.
You can also use WPA3-SAE encryption and enable isolation on the guest network.
I agree, that ordinarily, your casual mobile device user will not deliberately perform this action. However, Apple mobile devices have a setting where the MAC address can have one of three settings:
- Off: the device uses the built-in hardware MAC address
- Fixed: the device uses a unique, private MAC address that remains constant for that particular network
- Rotating: the devices uses a randomised MAC address that automatically changes around every two weeks
If a device is set to option 3, then no amount of blocklist or allowlist will function as required.
However, if a device is set to option 2, then blocklists and allowlists will work as expected, until either the network device restarts/reboots or the Apple user decides to "forget this network" and then later reattaches their device to the same network. In both these instances the Apple device generates a new MAC.
Admittedly, I had not considered the isolation to the guest network; but do I want an unknown and potentially untrusted device even on my guest network?
If you're serious about blocking everything and anything, use WireGuard with a PSK everywhere.
1 Like
Yikes! Thanks for that bedtime viewing!
1 Like
This topic was automatically closed 90 days after the last reply. New replies are no longer allowed.