Back in the days of wired-only Ethernet, before WiFi even existed, NICs moved over to “soft” reprogrammable MAC addresses. It’s a feature, not some secret known only to elite hackers. These days the built-in network control panel in Windows lets you change the MAC, right there from the GUI.
Then there’s the flip side of the question: how easy is it to discover allowed MAC addresses? Answer: In many cases, it’s printed right on the device, and when it isn’t, inducing the box to give up its preapproved MAC is trivial, since communication is the whole point of networking.
that kind of security is better then not
Are tissue paper welding gloves better than no gloves at all, too?
Security through obscurity isn’t useless, but it should always be coupled with actual security. Example: SSH with modern crypto is highly secure, but I move it to a nonstandard port to frustrate the script-kiddies. No serious attacker would be fooled by me moving the server off port 22, but I’ve still cut 95% of the attack traffic with a simple move, which if nothing else, keeps my logs cleaner, so I can more easily spot serious attacks.
In the same manner, I have no problem with MAC address filtering when coupled with something else that provides proper security, such as dot1x.
no ones answer my question
Why would we help you do something foolish? Doesn’t that make us partially complicit if you later get hacked, after coming to rely on your bogus security solution?
how can I in other option secure access from devices called IoT (like a refrigerator) with have very poor and simple wireless network adapter ?
See, now that’s where you’re getting smart. Instead of asking “I’ve come up with this solution, how do I make it work?” ask instead “I need to solve this problem, how should I accomplish it?” That phrasing allows people to come up with solutions you haven’t even considered.
The most common solution to the IoT isolation problem is VLANs. You can do it per-port, so that if you connect to port 3, you’re automatically put on isolated VLAN 20, and the only way to escape is to move the connection to another port, which isn’t under the IoT device’s control. This isn’t the thread to take up that topic, but you needn’t bother to start a new one. There’s a boat-load of info on VLANs already here in the archives, including this epic guide.
As for WiFi, while you can do VLANs there, too, a simpler and more effective equivalent is multiple SSIDs. It’s actually more secure than VLANs because you can use a strong PSK to prevent malefactors from hopping onto that network without permission. Even better, it’s nearly trivial to set up; if you can figure out how to fire up one SSID, you can figure out how to do two. The only tricky bit is setting up the routing to keep the subnets from commingling. But again, this isn’t the thread to take that separate topic up within.