Manual

Recipe: a printer usable from several VLANs

Print from the office, the laptop and the phone, without giving up the separation.

The goal: one printer, several separated networks, and printing that works from all of them. This recipe is shorter than it looks. The hard part is not the firewall, it is that your printer cannot announce itself into another network.

What you need

  • The printer's MAC address and, if it already works, its current IP address.
  • A network with VLANs, so the Office router with VLANs role or the VLANs block.
  • A decision about who may print. Everyone is a valid answer, as long as you then remember the guest network.

Step 1: where to put it

Three reasonable places, in order of how much work they cost:

  • In the network where most people print. Everything there works by itself, including finding the printer automatically, and you only arrange exceptions for the rest.
  • In your IoT or devices VLAN. Tidy, because a printer is just as much a box with old firmware. But then automatic discovery works nowhere.
  • In a VLAN of its own. Only worth it with many printers, or when policy says so.

Do not put it in the guest network. That one is isolated, so you would not reach it yourself.

Step 2: a fixed address

A printer without a fixed address is unfindable in six months. If it sits in the untagged network, add it in LAN & DHCP under Fixed addresses (static leases), with an address below the pool: the DHCP range starts at .10 by default.

If it sits in a VLAN, the VLAN table has no field for reservations. Give it a fixed address in its own web interface, outside the DHCP range, or add the reservation after pasting: /ip dhcp-server lease add mac-address=AA:BB:CC:DD:EE:FF address=192.168.30.20 server=dhcp-vlan30-iot. A VLAN's DHCP server is named dhcp- plus that VLAN's name.

Then give it a name under DNS in Static DNS records, for instance printer.lan.example.nl, type A. It saves hunting later.

Step 3: the firewall exception

Go to Firewall & NAT and set Traffic between VLANs to Only what is ticked in the matrix. For every network that may print, tick the direction towards the printer's VLAN. That is all: a row starts the connection, a column receives it, and replies always come back.

If you want it sharper, printing allowed but the printer's web interface not, use Custom filter rules instead of a tick in the matrix. Per network that may print:

  • Chain forward, action accept, protocol tcp, Dst. port 9100,631,515, Dst. address the printer, In-interface the VLAN it comes from.

Custom rules are written before the matrix and isolation rules, so this exception wins over the block below it. 9100 is raw printing, 631 is IPP, 515 is LPD; which one you need depends on the printer and the driver.

If the printer scans to a folder or to e-mail, it is the one starting the connection. Then also tick the direction from the printer to that network, or add a second custom rule with the printer as the source.

Testing it

  1. Ping the printer's address from a machine in the other VLAN.
  2. Open http:// followed by that address. If that works while you only opened 9100, the matrix is still open instead of your own rule.
  3. Add the printer by address and print a test page.
  4. Run /ip firewall filter print stats to see which rule counts the packets.

Why it is not in the list by itself

Automatic printer discovery uses mDNS (Bonjour, AirPrint) and WS-Discovery. Those are multicast packets that travel one network segment. A router does not forward them into another VLAN, and this tool has no mDNS repeater: it is not a setting hidden somewhere, it is not there at all. Opening the firewall changes nothing, because the query never reaches the router as something to forward.

What does work from another VLAN:

  • Adding the printer by hand, on its IP address or on the name from your DNS record. Windows, macOS and Linux can all do this.
  • A print server, or a computer sharing the printer inside the network where the users are.
  • An mDNS repeater you add to the router yourself after pasting. The tool does not generate one.

AirPrint from an iPhone leans entirely on mDNS. With the phone in a different VLAN from the printer it will not see it, however wide you open the firewall. If you want AirPrint, put the printer in the network where the phones are.

What to watch out for

  • Guests printing too? That punches a hole in the guest network's isolation. Do it with a custom rule on that one port and that one address, not with a tick in the matrix.
  • Internet off for the printer VLAN also stops firmware updates and cloud printing. Local printing carries on as normal.
  • Moving a printer to another VLAN means a new address, and a printer that stopped answering on every computer. Do it once, properly, and update the DNS record.

Related: VLANs, Firewall and IoT in its own network.

Want to try it right away? Open the configurator