How to Fix Devices Bypassing Firewalla Parental Controls Using MAC Address Randomisation

If parental controls, screen time rules, gaming restrictions, or social media blocks have stopped working, the usual cause is MAC address randomisation. This guide shows how to disable it on trusted home Wi-Fi and use quarantine to stop bypass attempts.

Firewalla overview Firewalla VPN setup

Overview

If your parental controls, screen time rules, gaming restrictions, or social media blocks have stopped working unexpectedly, the cause is often MAC address randomisation, also known as Private Wi-Fi Address on Apple devices.

This guide explains how to disable MAC randomisation on your home Wi-Fi network and configure a quarantine group so devices cannot bypass parental controls.

Symptoms

You may be experiencing one or more of the following:

A child's device appears multiple times in Firewalla
Screen time schedules stop working
Gaming restrictions are no longer applied
Social media blocking stops working
A device appears as New Device after reconnecting to Wi-Fi
Rules apply to one device entry but not another
A child can bypass restrictions by forgetting and rejoining Wi-Fi

Why This Happens

Most firewall-based parental control systems identify devices using their MAC address.

Modern devices can generate a random MAC address for privacy purposes.

If the MAC address changes:

The firewall sees a new device
Existing parental control rules stay attached to the old device
The new device receives no restrictions unless manually configured

The solution is to disable MAC randomisation on your trusted home network.

Step 1: Disable Private Wi-Fi Address on Apple Devices

iPhone and iPad

Open Settings
Tap Wi-Fi
Tap the ⓘ next to your home Wi-Fi network
Locate Private Wi-Fi Address
Turn it Off
Reconnect to Wi-Fi if prompted

Mac

Open System Settings
Select Wi-Fi
Click Details next to your home Wi-Fi network
Locate Private Wi-Fi Address
Turn it Off
Reconnect if prompted

Step 2: Disable MAC Randomisation on Android Devices

The wording varies by manufacturer.

Look for one of the following:

Randomized MAC
MAC Randomization
Privacy MAC
MAC Address Type

Typical Android Process

Open Settings
Open Wi-Fi
Select your home Wi-Fi network
Open network settings
Locate MAC Address Type or Privacy
Change from Randomized MAC to Device MAC or Phone MAC
Reconnect if prompted

Step 3: Confirm the Device Appears Correctly in Firewalla

After reconnecting:

Open the Firewalla app
Navigate to Devices
Locate the device
Confirm only one active device entry exists
Assign the device to the correct user or parental control group

If duplicate devices exist, remove or archive the obsolete entry after confirming which device is active.

Step 4: Create a Quarantine Group

A quarantine group prevents newly discovered devices from bypassing restrictions.

Recommended Configuration

Create a group called:

Quarantine

Any new device should automatically be placed into this group until approved.

Step 5: Configure Quarantine Restrictions

Recommended Option

Block:

Gaming
Social Media
Adult Content
VPN Services, if required

This allows visitors to use normal internet access while preventing children from gaining unrestricted access by reconnecting as a new device.

Strict Option

Block:

All Internet Access

Use this only if you are comfortable manually approving every new device.

Step 6: Enable Automatic Quarantine for New Devices

In Firewalla:

Open Settings
Open New Device Quarantine
Enable quarantine
Select your Quarantine group

Any device that appears with a new MAC address will now be automatically restricted.

Step 7: Test the Setup

To verify everything is working correctly:

Take a child's device
Forget the Wi-Fi network
Reconnect to Wi-Fi
Confirm the device enters the Quarantine group
Confirm gaming and social media restrictions are applied
Disable MAC randomisation
Move the device back to its normal profile

If the device is correctly restricted after reconnecting, the configuration is working as intended.

Privacy Considerations

Disabling Private Wi-Fi Address or MAC Randomisation on your home Wi-Fi network does not normally disable it on other networks.

Most modern devices apply this setting on a per-network basis.

Your device can still use MAC randomisation when connected to:

Hotels
Airports
Coffee shops
Public Wi-Fi
School networks

You are only disabling it for your trusted home network so that parental controls can function correctly.

Troubleshooting

Device Still Appears Multiple Times

Remove old device entries from Firewalla and verify MAC randomisation is disabled on the active device.

Child Can Still Bypass Restrictions

Check that:

New Device Quarantine is enabled
The device enters Quarantine automatically
Gaming and social media restrictions are active
The device has been assigned to the correct parental control profile

Privacy Warning Appears

This is normal.

The warning simply indicates that MAC randomisation is disabled for that Wi-Fi network.

It does not mean your home network is insecure.

Best Practice Summary

For reliable parental controls:

Disable Private Wi-Fi Address on Apple devices
Disable Randomized MAC on Android devices
Create a Quarantine group
Automatically quarantine new devices
Block gaming and social media for quarantined devices
Assign approved devices to the correct parental control profile