My DSL-WiFI router provides MAC address filtering. This is used for access restrictions, e.g for parental controls to keep certain devices off-line during certain hours. A device on the restriction list remains associated with the WiFi AP (router), but access to the internet is prevented by the router.
HOWEVER, when a device on my WLAN uses VPN, the traffic simply seems to tunnel straight through the restrictions. In other words, during restricted hours, a device ordinarily has no access to the internet, but when the VPN is switched on, access is provided.
I understand MAC address filtering, and how a WiFi router uses the MAC address to address 802.11 devices and route traffic in the WLAN/subnet. The MAC address is part of the packet header. The IP traffic, incl. VPN application data, resides within that packet. So how can this even fail?
Any thoughts on what might be going on here? Is the VPN possibly robbing a MAC address and overriding the one on the device? (It's an iPhone and my understanding is that the MAC address cannot be changed -by the user or an app-, although it can change randomly with MAC address randomization)
UPDATE: after some experimentation I can confirm that the MAC address does not change with VPN on/off, contrary to what I was thinking. What DOES change is the LAN Status IPv6 entries. They disappear with VPN "on". I posted it as a separate question: When using VPN, why do LAN IPv6 Addresses disappear in router LAN status?