Firewall blocks WSD/SMB/IPP — exact ports to allow on Windows/macOS
Joe B.
Expert ★★★★★ 27,853 satisfied customers
Specialities: Windows 11/10, macOS (Sonoma/Ventura/Monterey), Printers, Networking, Office Equipment
Allow printer ports for WSD discovery, SMB/CIFS printing, IPP/AirPrint — HP, Epson, Canon, Brother
Technician Technician • WSD (Web Services for Devices) uses UDP 3702 for WS‑Discovery and TCP 5357 (and sometimes 5358) for service connections — many firewalls drop multicast/UDP.
• AirPrint / IPP relies on UDP 5353 mDNS (Bonjour) for advertisement and TCP 631 for IPP. Secured IPP (IPPS) uses TCP 443.
• SMB/CIFS printing to shares uses TCP 445 (legacy also 139/TCP and 137/138 UDP for NetBIOS).
• Direct “raw” printing (JetDirect/RAW) uses TCP 9100; LPD/LPR uses TCP 515.
• SNMP status queries use UDP 161, and some vendors announce via SLP UDP/TCP 427.
We’ll allow the right mix and limit to your LAN for safety.
Technician Discovery: WSD UDP 3702, TCP 5357–5358; Bonjour/mDNS UDP 5353; optional SLP UDP/TCP 427.
Printing protocols: IPP TCP 631; IPPS TCP 443; RAW/JetDirect TCP 9100; LPD/LPR TCP 515; SMB/CIFS TCP 445 (legacy 139).
Status/management: SNMP UDP 161 (read‑only recommended).
On the Windows Defender Firewall and your network firewall, create inbound/outbound rules scoped to the local subnet (e.g., 192.168.1.0/24). On macOS, allow Printer Sharing or the specific app (HP Smart, Epson Utility), and ensure mDNS is not filtered by the router.
Technician 1) Open Windows Defender Firewall with Advanced Security → Inbound Rules → New Rule….
2) Choose Port → UDP 3702; repeat for TCP 5357 and optional 5358, and for TCP 9100 if you use RAW.
3) Allow the connection; scope to Private profiles and Local subnet only (custom scopes).
4) In Outbound Rules, mirror the same entries (some environments block outbound).
5) If discovery still fails, temporarily add UDP 5353 and TCP 631 for IPP testing, then keep what you use.
Technician • Ensure the router allows mDNS (Bonjour) UDP 5353 between Wi‑Fi and Ethernet/VLANs; disable “client isolation” or add a Bonjour gateway if you use VLANs.
• macOS Application Firewall: System Settings → Network → Firewall → Options → allow Printer Sharing, HP Smart/Epson Utility/Canon IJ, or set to “Allow incoming connections.”
• If IPP fails, allow TCP 631; for encrypted queues use IPPS over 443/TCP.
• Then add the printer: System Settings → Printers & Scanners → Add Printer → Default tab (look for AirPrint or IPP).
Technician Technician • Restrict rules to your LAN/VLAN subnets (no Internet).
• Only open protocols you use (e.g., IPP 631 + mDNS 5353 for AirPrint, or WSD 3702/5357 for Windows).
• Prefer IPPS (443/TCP) instead of cleartext IPP when available.
• Keep SNMP read‑only (UDP 161) and block from guest networks.
• On mesh/APs, disable client isolation and allow multicast to unicast for Bonjour/WSD across SSIDs.
Technician • A Bonjour/mDNS gateway feature on your firewall/Wi‑Fi controller.
• Static queues by IP: add printers via IPP 631 or RAW 9100 using the printer’s IP address; no multicast needed.
• Some enterprise gear supports WSD relay; otherwise prefer IPP/JetDirect by IP across VLANs.
Technician Technician WSD: UDP 3702, TCP 5357–5358 · AirPrint/IPP: UDP 5353, TCP 631 (IPPS 443) · SMB: TCP 445 (legacy 139/137/138) · RAW/JetDirect: TCP 9100 · LPD: TCP 515 · SNMP: UDP 161 · Optional SLP: UDP/TCP 427.
Need hands‑on help applying rules on your hardware? Open the chat.
Quick answer: the accepted fix
Accepted fix when firewall blocks WSD/SMB/IPP printing on Windows 10/Windows 11/macOS: Allow discovery (WSD UDP 3702, TCP 5357–5358; Bonjour UDP 5353), open the printing protocol you use (IPP TCP 631 or IPPS 443, SMB 445, RAW 9100, LPD 515), and scope rules to your LAN/VLAN. Enable SNMP 161/UDP for status if required.
“Printer not found” after firewall change — Windows/macOS exact ports
After a firewall rollout, discovery breaks because multicast traffic is blocked. Re‑enable WSD (UDP 3702, TCP 5357) for Windows and Bonjour/mDNS (UDP 5353) for AirPrint/IPP. Then allow TCP 631 or 443 for IPP/IPPS, TCP 445 for SMB shares, or TCP 9100/515 for RAW/LPD. Limit all rules to the local network.
How to verify printing works
Add the printer by IP or discovery, then print a 1‑page PDF. If discovery works but jobs fail, the data port is blocked — open the protocol you selected (631/443/445/9100/515). If status shows offline, allow SNMP 161/UDP.
Firewall + printers — troubleshooting tips
Most printer issues come from blocked discovery (mDNS/WSD) or a missing data port (IPP/RAW/SMB).
Quick path: confirm protocol → open discovery (mDNS/WSD) → open data port (IPP/SMB/RAW/LPD) → optionally SNMP for status → test across subnets or use IP queues. Use IPPS for encrypted printing.
Disclaimer: This information is AI-generated and intended for general guidance only. For advice specific to your environment, please consult a verified expert on Whizz-Tech before making decisions.
Getting Started Is Easy
Ask for help, 24/7
Members enjoy round-the-clock access to 12,000+ verified Experts, including tech support, mechanics, vets, and more.
Expert will respond in minutes
We match you with an Expert who specializes in your situation. Talk, text, or chat — whichever you prefer.
Save time & money
No scheduling hassles or expensive consults. Membership can save you significant time and money each month.
FAQ
Which ports do I open for Windows WSD printers?
Allow UDP 3702 for WS‑Discovery and TCP 5357–5358 for WSD connections. Scope to the local subnet only.
What ports are needed for AirPrint/IPP on macOS and iOS?
UDP 5353 (Bonjour/mDNS) for discovery and TCP 631 for IPP jobs (TCP 443 for IPPS). Some networks also need SNMP 161/UDP for status.
Printing to a Windows share fails — which SMB ports?
Open TCP 445 between client and file/print server. Legacy environments may also require TCP 139 and UDP 137/138.
Do I need RAW 9100 or LPD 515?
Only if your queue is configured for those protocols. TCP 9100 (JetDirect/RAW) and TCP 515 (LPD/LPR) are common on HP/Brother devices and many print servers.
Discovery doesn’t cross VLANs — how do I fix that?
Use a Bonjour gateway on your firewall/WLAN controller, or add printers by IP with IPP 631 or RAW 9100 to avoid multicast dependency.
| Symptom | Likely cause | Ports to allow |
|---|---|---|
| Windows can’t find printers | WSD discovery blocked | UDP 3702, TCP 5357–5358 |
| AirPrint not showing on Mac/iPhone | Bonjour/mDNS filtered | UDP 5353 and IPP TCP 631 (or IPPS 443) |
| Jobs time out to HP/Brother | RAW/LPD blocked | TCP 9100 (RAW), TCP 515 (LPD) |
| SMB printing fails | SMB/CIFS blocked | TCP 445 (legacy 139/137/138 if needed) |
| Status shows Offline | SNMP blocked | UDP 161 |
Step‑by‑step (Windows 10/11)
- Create Inbound and Outbound rules for needed ports: WSD UDP 3702, TCP 5357–5358; IPP TCP 631; RAW TCP 9100; SMB TCP 445.
- Scope rules to Private profile and your local subnet/VLAN.
- Ensure APs/firewall don’t block multicast; allow mDNS 5353/UDP if using AirPrint.
- Optionally allow SNMP 161/UDP for printer status.
Step‑by‑step (macOS)
- In your router/WLAN, permit Bonjour (mDNS) UDP 5353 and IPP 631/TCP (or IPPS 443/TCP).
- In macOS Firewall, allow Printer Sharing and vendor apps (HP Smart/Epson/Canon IJ).
- Add the printer via Printers & Scanners → Default (AirPrint) or IP (IPP/JetDirect by IP).
Sources
- Microsoft — WSD/WS‑Discovery port usage
- Apple — About Bonjour and mDNS (AirPrint)
- IETF — IPP (RFC 8010/8011)
- Microsoft — Create Windows Firewall rules
Filed under: Printer won’t print
Related articles
- Printer blocks printing of official documents — what can I check safely?
- Printer says “Offline” and won’t print — what should I check first?
- My printer “forgot” my Wi-Fi — the saved network is gone
- Printer Wi-Fi settings reset by itself — why did it forget my network?
- My printer keeps popping up “Set up Wi-Fi” again — why won’t it stay connected?
- Why does my printer need Wi-Fi setup again? It was working yesterday.
- My printer Wi-Fi setup keeps failing — what am I doing wrong?
- Printer Wi-Fi setup is confusing — why won’t it connect to my network?