Hitron CGNM-2250 cannot block private / dynamic iOS mac addresses

[redehm]

I am attempting to block a WiFi device via its mac address on my Hitron router. The mac address of the device (an iPhone: a6:5c:36:08:52:12) does not appear to be valid according to a few online mac address checkers. The issue is that the router won't let me block an invalid mac address, giving me the error "Invalid MAC address" when I enter it manually. Note that other mac addresses are blocked just fine.

On further research, I've noticed that iOS 14 now has private WiFi addresses, which is most likely what's going on here. In other words, the iPhone is generating a mac address that the router won't let me block, since it considers it invalid. This seems like a big security hole...

Is there an update to the Hitron firmware to allow for the blocking of these new, dynamic mac addresses? If not, can we escalate?

Many thanks!

[redehm · Accepted solution]

I think that I managed to solve it via another route. The above attempts were done via the "Security" > "Device Filter" page. I attempted to use the "Wireless" > "Access Control" page to add the device and block it. It appears to have worked, although my laptop was disconnected from the WiFi for a minute or two when I clicked "save". Hope that helps someone!

[mdk]

@redehm -- The mac address of the device 

The IOS in the newest iPhones have a feature to change their MAC address every time that it connects to WiFi, as a "security" feature, to avoid possible aggregating and "data-mining" of the MAC-address across different WiFi connections (Starbucks, Tim Hortons, Macdonalds, et cetera).

On the iPhone, disable that setting, to get the iPhone to present a consistent MAC-address to your router.