> For the complete documentation index, see [llms.txt](https://doc.engenius.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://doc.engenius.ai/home-cloud-user-manual/configuring-networks/access-control.md).

# Client Access Control

In some cases, it is necessary to block a specific client on a  network. This configuration will apply to the whole network and will affect the client immediately. 

## Blocked List

Navigate to **Configure** > **Client** **Access Control > Rules > Block list** to access this screen. 

<figure><img src="https://3893603398-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgVsoqihVR3I0VRYmyO%2Fuploads%2Fd3jUR7uTsvSpayxyTKvS%2F1706773057443.jpg?alt=media&amp;token=8c3d3233-761e-46e8-89fd-1e3ef700512d" alt=""><figcaption></figcaption></figure>

You could block clients in all SSIDs in the current network or on an SSID basis depending on your requirements. This blocked list displays which you added the blocked clients in **SSID** > **Access Control** and  **Manage > Clients**. So you could manage whole blocked clients easily in single lists.&#x20;

{% hint style="info" %}
**Good to know**

AP PRO Feature Plan: 1000 entries. Basic mode:100 entries.
{% endhint %}

### How to block clients

1. Click **Add** in the top-right corner.

&#x20;  2\. Enter the **Mac Address**, select the **Scope** ( All SSIDs in current Network or  SSID basis), then click **Apply**&#x20;

### How to Unblock Clients

&#x20; 1\. Select the clients on the lists&#x20;

&#x20; 2\. Click **Unblock**

## VIP Lists

All VIP clients can bypass the Captive portal.  **Wired** VIP clients can bypass L2 isolation.&#x20;

If **wireless** printer/scanner/IoT to be accessible, pls make sure the wireless printer/scanner/IoT devices are under the SSID of

* **Bridge** mode
* L2 Isolation is **disabled**
* Optional: If captive portal is enabled on the SSID, the “VIP” can let the IoT skip captive portal entry

If **wired** printer/scanner / IoT device to be accessible, then

* Make the devices be “**VIP**” to all SSIDs (or to the SSIDs for the wireless clients to be able to access)
* Any wireless client can access.  No matter if NAT/Bridge mode.  L2 Isolation can be enabled/ disabled

You could add the VIP clients in the current network or on SSID basis depending on your requirements. This VIP list displays which you added the VIP clients in **SSID** > **Access Control** and  **Manage > Clients**. So you could manage whole VIP clients easily in single lists.&#x20;

{% hint style="info" %}
**Good to know**

AP PRO feature plan:1000 entries.  basic mode:100 entries.
{% endhint %}

### How to Add VIP clients

1. Click **Add** in the top-right corner.

&#x20;  2\. Enter the **Mac Address**, select the **Scope** ( Current Network or  SSID basis), then click **Apply**&#x20;

### How to remove VIP clients

&#x20; 1\. Select the clients on the lists&#x20;

&#x20; 2\. Click **Delete**

{% hint style="info" %}

\
If L2 isolation is enabled, the VIP clients will be excluded, which means clients under the subnet can access this client even if L2 isolation is on (Only wired clients can take effect )

If NAT mode, "client isolation” will be enabled automatically&#x20;
{% endhint %}

## Whitelist

You could block clients in all SSIDs in the current network or on an SSID basis depending on your requirements. This Whitelist displays which you added the white clients in **SSID** > **Access Control** and  **Manage > Clients**. So you could manage whole whitelist clients easily in single lists.&#x20;

The default Client Access Control is Blocklist, so you need to change the default ACL Rule to **Allow whitelist only**, so your whitelist client will take effect.

<figure><img src="https://3893603398-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgVsoqihVR3I0VRYmyO%2Fuploads%2FCjcCP1bLwmk0uZq1Z1Kj%2F1706772316607.jpg?alt=media&amp;token=89194506-7b4b-4dc4-8936-e61a82b629b8" alt=""><figcaption></figcaption></figure>

{% hint style="info" %}
**Good to know**

AP PRO feature plan: 1000 entries.  basic mode: 100 entries.
{% endhint %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://doc.engenius.ai/home-cloud-user-manual/configuring-networks/access-control.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.