Pauly The 'Guest Access' exists which would let you prevent them from accessing network files, streaming audio, and your other smart devices. I think moving unknown devices to a default profile feature could work but, for someone who understands it mac address filtering would just allow me to whitelist specific mac addresses on my network for the devices I want. A potential bonus would be if the Guest network was excluded from the filtering and I could just toggle it on/off if it's needed. I would say that with smaller kids what you propose works but when they are old enough to find ways they will. Most routers that you would buy comes with mac address filtering anyways

I could be wrong but if Computer and Console device types get auto recognized by eero it would defeat the purpose of unknown devices to the default group.

cccmdm I don't think the allowlist Mac Address approach would work at least not in an ideal fashion. I used to do this years ago on my old Apple Airport. I dont want to prevent any new devices from accessing the internet. Specifically, I am looking to prevent certain actions. For example, I dont want to prevent unknow MAC addresses from accessing the internet, but I want SafeSearch, YouTube Restricted, Adult Content, Illegal or Criminal, and Violent, Chat and Messaging, and Social filters turned on. I also want prevent access to other devices on my network. The Guest WiFi network would handle that last one, but the filters, as far as I can tell are only allowed to be toggled on using a Profile. As for older kids finding a way, I agree, that it makes it more difficult, but it is possible. Mac Address filtering typically fails, because people can just change their MAC to something else, but placing ALL unknown Macs into a default profile that has been locked down, prevents this. Of couse, there is the option of having a user select the same MAC address as another device in a more permissive profile, but the moment, a device jumps on the network as another device already on the network, they should both be moved to the default profile. Then there is the option of turning off the device with the copied Mac address, but there are other pieces of metadata that could be tied to the Mac address (Manufacturer and Hostname for example) that could be futher used to verify the authenticity of the Mac address. From a user's point of view, this would all be transparent however.  Then there is VPN, but that is another story. I think I am going to make a feature request on that one...

Pauly That's totally fair but I just want to express is that I'm not referring to mac address filtering of itself but mac address whitelisting you can read more about it here if you'd like https://www.csoonline.com/article/3562429/whitelisting-explained-how-it-works-and-where-it-fits-in-a-security-program.html
 

simply put it allows me to preset the mac addresses I want allowed on the network and no other mac address other then the specified ones would be denied access demanding that I give approval first then spoofing wouldn't work since if they were to attempt to spoof their mac address it would not be on the whitelist.

EDIT: I read more of what you had to say and yeah I totally agree that they should incorporate the host names and manufacturer as well I think that maybe alone mac address filtering wouldn't work but if we had these systems combined available to us then it would be really difficult to get around all of it but it's that fact that we don't.