The user isn't trying to attack over wifi. They're trying to attack over the Internet.
Aug 30 20:28:09 dropbear: Child connection from ::ffff:18.104.22.168:38463
Aug 30 20:28:11 dropbear: login attempt for nonexistent user from ::ffff:22.214.171.124:38463
Aug 30 20:28:12 dropbear: exit before auth: Disconnect received
::ffff:126.96.36.199 is an IPv6-mapped IPv4 address, specifically
188.8.131.52. The log shows the attacker connecting to an SSH server on your router, trying an invalid username/password pair, and disconnecting.
This is probably a part of the distributed SSH brute-force attack that's been going on for years. MAC filtering and WPA2 will do nothing to stop it, since it isn't coming in over the wireless connection. Rather, you should take the appropriate precautions for dealing with an attack on SSH.