How to Fix AP Isolation and Guest Network Settings That Block Printing

Joe B.

Reviewed for technical accuracy

Specialities: Windows 11/10, macOS (Sonoma/Ventura/Monterey), Printers, Networking, Office Equipment

Guest Wi-Fi blocks printing (AP isolation / client isolation) — AirPrint, IPP, Bonjour/mDNS, HP, Epson, Canon, Brother

Technician

Hey! Let’s solve your guest network blocks printing issue. Quick details, please: router/AP brand (e.g., UniFi, TP-Link, ASUS, Eero, Netgear), how the printer connects (Wi-Fi or Ethernet), and what you’re using to print (AirPrint on iPhone/iPad/macOS, or Windows via IPP/RAW 9100/LPR). Most failures come from AP isolation (client isolation), guest network firewalls, or multicasts like Bonjour/mDNS being blocked across SSIDs/VLANs.

Customer

We moved everything to an Eero mesh. I created a Guest Wi-Fi for visitors. Now none of our iPhones or Windows laptops can see the HP OfficeJet on Wi-Fi when connected to the guest network. On the main network it prints fine. AirPrint/Bonjour doesn’t discover anything.

Technician

That behavior is expected. Guest networks enable AP/client isolation by design, which prevents client-to-client traffic and blocks mDNS (UDP 5353), AirPrint/IPP (TCP 631), and often RAW 9100 or LPR 515. It keeps guests from reaching printers, NAS, or other devices. To allow printing safely, we can:
• Put the printer on the main LAN and keep guests isolated; users must join the main SSID to print.
• Create an IoT/VLAN for printers, then add firewall allow-rules and an mDNS reflector/Bonjour gateway (UniFi, some ASUS/TP-Link models) to advertise AirPrint across subnets.
• On simple systems (Eero), temporarily disable guest mode or use mixed mode (no isolation) while keeping WPA2/WPA3 security enabled.
• As a last resort, connect the printer by Ethernet to the main router and publish a print server.

Customer

We’d like to keep the Guest Wi-Fi for visitors. Is there a safe way to disable AP isolation for just the printer or allow Bonjour?

Technician

Options depend on the platform:
UniFi / UDM: keep the Guest SSID isolated, place the printer on an IoT VLAN, then enable mDNS Reflector and create firewall rules to allow UDP 5353, TCP 631, TCP 9100 from Guest → Printer only.
ASUS/TP-Link/Netgear: look for Client Isolation (sometimes called AP Isolation). If the UI supports it, disable isolation or add a Device Allowlist for the printer’s MAC/IP. Enable Multicast/IGMP Snooping and Bonjour/mDNS forwarding if available.
Eero: Guest network is fully isolated (no allowlist). For printing, either connect users to the main network, or move the printer and users to the same SSID temporarily while printing. Many homes create a separate “IoT” SSID instead of Guest.
Windows & macOS: if isolation can’t be changed, add the printer by IP (IPP 631 or RAW 9100) on the same subnet as clients; cross-subnet direct IP usually still fails because of firewall rules on guest networks.

Customer

Could we keep Guest isolation but let staff on iPhones print to one HP and one Brother? We also use AirPrint from iPads.

Technician

The safest pattern is: Printers on a dedicated IoT VLAN/SSID ➜ Guest VLAN can reach only the printer IPs and only the needed ports. Steps:
1) Give the printer a static IP (or DHCP reservation).
2) On the router, create rules: Guest → Printer: allow UDP 5353 (mDNS), TCP 631 (IPP/AirPrint), optionally TCP 9100 (RAW) and UDP 137–138/TCP 139,445 OFF (don’t allow file shares). Deny all else.
3) Enable an mDNS/Bonjour gateway or mDNS reflector so AirPrint advertisements cross subnets.
4) For Windows, add the printer via IPP (http(s)://printerIP:631/ipp/print) or RAW 9100. For macOS/iOS, AirPrint should discover it after mDNS is allowed.

Customer

What if our router doesn’t support mDNS forwarding? We’re on consumer gear.

Technician

You have three practical alternatives:
• Same-SSID approach: temporarily connect the device and the printer to the same non-guest SSID to print (keeps Guest isolated the rest of the time).
• Wired printer + print server: plug the printer into the main router, publish it from a small PC/NAS/Raspberry Pi print server; users print over IPP using a URL.
• Upgrade the router/AP to one that supports mDNS/Bonjour gateway, IGMP Snooping, and per-VLAN firewall rules (e.g., UniFi). This preserves security and enables AirPrint on guest networks safely.

Customer

After enabling multicast and allowing 5353/631, printing works. Any brand-specific tips for HP, Epson, Canon, Brother?

Technician

• HP: Turn on AirPrint and Bonjour in the Embedded Web Server. Prefer IPP Everywhere over RAW 9100 on mixed networks.
• Epson: Enable Bonjour (mDNS) and AirPrint in the network panel; use IPP queue names if adding by IP.
• Canon: On imageCLASS/PIXMA, enable mDNS and AirPrint; for enterprise models, publish via IPP and confirm the service name is visible.
• Brother: Use AirPrint and Web Based Management to confirm mDNS is advertising; disable older NetBIOS/SNMP broadcast discovery if your guest firewall blocks it.

Customer

Will disabling AP isolation reduce security?

Technician

Disabling isolation globally does lower guest security. Safer alternatives:
• Keep isolation on and allow only printer IPs/ports via firewall rules.
• Use a dedicated IoT/Printer SSID with limited access, strong WPA2/WPA3, and no access to admin interfaces.
• Prefer IPP over RAW 9100, and disable unused protocols on the printer.

Customer

Is there a quick checklist to test discovery? We have iPhones, Macs and a few Windows 11 laptops.

Technician

Discovery checklist:
• Ensure client and printer are on networks allowed by your firewall (Guest ↔ Printer VLAN).
• Confirm UDP 5353 and TCP 631 are permitted; enable mDNS/Bonjour gateway.
• On iOS/iPadOS/macOS, AirPrint should appear within 10–20 seconds in the print dialog.
• On Windows 11/10, add the printer via Settings → Bluetooth & devices → Printers & scanners → Add device → Add manually → Add a printer using a TCP/IP address; try IPP first.
• If discovery still fails, try the same SSID test: connect both to the main network; if it works, the guest isolation is the blocker.

Customer

Great, printing works with your rules and the mDNS reflector. Anything else to harden?

Technician

Yes. Lock down with: DHCP reservations, firmware updates for printer and router, disable WPS, keep only necessary services (IPP/AirPrint), and apply a “Guest → Printer Only” rule set with explicit deny any after the allows. This keeps guest devices from probing your LAN.

Customer

Awesome — guests can print and our network stays isolated. Thanks!

Technician

Summary: If printer not discoverable on guest Wi-Fi, the cause is AP/client isolation and blocked mDNS/IPP. Safest fixes: keep isolation on and add allow-rules + mDNS gateway, or place printers on an IoT VLAN with limited access. Avoid disabling isolation globally. Need help mapping rules for your model (UniFi, ASUS, TP-Link, Eero, Netgear)? Open the chat.

Quick answer: the accepted fix

Accepted fix when guest network blocks printing: keep AP/client isolation enabled for guests, but allow traffic from Guest → Printer IPs only: UDP 5353 (mDNS), TCP 631 (IPP/AirPrint), and optionally TCP 9100. Enable an mDNS/Bonjour gateway (or place devices on the same SSID) and disable unnecessary ports. This restores AirPrint and IPP while staying secure.

FAQ

Step-by-step (Windows 10/11)

1. Connect the PC to the network that is allowed to reach the printer (main SSID or Guest with rules).
2. Go to Settings → Bluetooth & devices → Printers & scanners → Add device → Add manually.
3. Choose “Add a printer using a TCP/IP address or hostname” → enter the printer’s IP → use IPP (TCP 631) when available.
4. If your router supports it, enable mDNS/Bonjour so AirPrint/IPP discovery works automatically.

Step-by-step (macOS)

1. Join the SSID that can reach the printer or ensure your Guest → Printer rules are active.
2. Open System Settings → Printers & Scanners → click Add Printer.
3. If the printer appears under AirPrint, select it. If not, choose IP → Protocol IPP → enter http://<printerIP>:631/ipp/print.
4. Print a test page; if it works only on the main SSID, your guest isolation still blocks mDNS.

Sources

• Apple — About AirPrint & Bonjour (mDNS)
• Microsoft — mDNS service discovery in Windows
• Ubiquiti — mDNS/Bonjour reflector
• TP-Link — Client Isolation & Guest Network FAQs
• Eero — Guest Network behavior

Matt ● replies in < 1 min

Technician Expert

⭐⭐⭐⭐⭐ Trusted by 27,000+ customers

Alex · Expert's Assistant

Start Chat

5 Tech Support Specialists are online right now.