MAC address filtering not working through range extender

Question

I have TP-Link TL-ER604W router wih MAC filtering enabled, allowing only clients from the list. I also have a TP-Link TL-WA850RE range extender in WDS mode.

The trouble is, when a client connects to the range extender, it can connect to the internet even though it isn't in the list of allowed MAC addresses.

Can someone please advise me as to what I'm doing wrong?

Solution 1

MAC filtering is a completely inadequate method for increasing network security. Anyone can spoof any used address, MAC addresses are never encrypted. You need to use WPA2.

The router sees the MAC address of the extender, not the one of the client. So, if you allow the extender's MAC you allow everything connecting through it.

edit: If the MAC filter needs to work through the extender you'll need to filter the MAC on the extender.

PS: have you read this? Apparently, TP-Link has some specialties on their extenders.

Solution 2

You must configure the MAC filter on each access point, when an access point forward packet from the client to another access point, the next access point only sees the forwarder's MAC.

Comments

[user1686]

Is the range extender really in WDS mode? That is, does your main access point allow it to use WDS? Your description sounds like it's falling back to regular client mode.

[Stefcyp]

I'm sorry I forgot to mention that WPA2 encryption is being used on the router. I just use MAC filtering for extra protection

[Zac67]

Well, it's useless.

[Anti-weakpasswords]

@Stefcyp - use a long (25 character plus), random password for your WPA2-AES encryption and abandon the MAC filtering. Macchanger has been here for a long time. Everyone in range (their range, with THEIR big antennas) can see your MACs and clone them on their device.

[Community]

As it’s currently written, your answer is unclear. Please edit to add additional details that will help others understand how this addresses the question asked. You can find more information on how to write good answers in the help center.

[Silbee]

This does not really answer the question. If you have a different question, you can ask it by clicking Ask Question. To get notified when this question gets new answers, you can follow this question. Once you have enough reputation, you can also add a bounty to draw more attention to this question. - From Review