FortiGate mDNS across VLANs — helper/reflector configuration
Joe B.
Expert ★★★★★ 27,853 satisfied customers
Specialities: FortiGate firewall, mDNS/Bonjour across VLANs, AirPrint & AirPlay, multicast policies, secure printer/Wi-Fi segmentation
FortiGate mDNS across VLANs — Bonjour helper, multicast policy, AirPrint & AirPlay discovery between subnets
Technician
Quick topology check so I can give you the right FortiGate mDNS helper/reflector config:
• Which FortiGate / FortiOS version are you on (e.g. 7.0, 7.2, 7.4)?
• What subnets/VLANs do your clients and Bonjour devices live on — for example, Users 192.168.10.0/24, Printers/Apple TV 192.168.20.0/24, IoT 192.168.30.0/24?
• What exactly isn’t showing up: AirPrint printers, AirPlay/Apple TV, Chromecast, or all mDNS services?
• From the user VLAN, can you ping the printer or Apple TV IP, or are you blocked completely?
Technician
Bonjour / AirPrint / AirPlay all use multicast DNS (mDNS), which sends queries to
224.0.0.251:5353/UDP. That address is link-local multicast, so by design it does not get routed between subnets. Your FortiGate routes unicast just fine (ping, HTTP to printer), but it’s dropping or ignoring the multicast mDNS traffic between VLAN 10 and VLAN 20.To fix discovery between VLANs you usually need three pieces on a FortiGate:
1) A proper Bonjour/mDNS multicast address object (224.0.0.251).
2) Multicast policies or a Bonjour profile/helper that knows how to reflect mDNS between interfaces.
3) Regular firewall policies that allow the unicast printing/streaming ports (IPP 631, AirPlay, etc.) once devices are discovered.
We’ll walk through that step-by-step so “AirPrint across VLANs on FortiGate” is stable, not flaky.
Technician
Step 1 — Confirm / create the Bonjour multicast address on FortiGate
1) In the GUI: Policy & Objects → Addresses. Look under Multicast for an address called Bonjour or 224.0.0.251.
2) If it doesn’t exist, create a new Multicast Address:
• Name:
Bonjour• Type:
Multicast• Start IP / End IP:
224.0.0.251Step 2 — Build a FortiGate multicast policy to pass mDNS between VLANs
3) Go to Policy & Objects → Multicast Policy (enable it under System → Feature Visibility if you don’t see it).
4) Create a policy from VLAN 10 (Users) to VLAN 20 (Printers/Apple TV) with:
• Source: VLAN 10 subnet
• Destination: Bonjour multicast address
• Service: ALL (for initial test) or a custom service for
UDP/53535) Add a second multicast policy in the opposite direction (VLAN 20 → VLAN 10) so replies can flow back.
This basically acts as an mDNS reflector on the FortiGate, letting Bonjour packets hit the router and be forwarded between your internal VLANs.
Technician
Step 3 — Make sure IPv4 policies allow AirPrint / Bonjour flows
• In Policy & Objects → Firewall Policy, confirm you have an IPv4 policy from VLAN 10 (Users) to VLAN 20 (Printers) that permits the relevant services.
• For testing, you can temporarily allow ALL services, but for long-term security it’s better to create custom services like:
– IPP (TCP 631) for AirPrint
– PDL/RAW (TCP 9100) if your printers use raw socket printing
– AirPlay/RAOP ports if you care about Apple TV/Screen Mirroring as well
• Make sure the policy is above any deny/block rules and that logging is temporarily enabled so we can see hits while you test.
With FortiGate mDNS across VLANs you basically need: multicast policy for discovery, IPv4 policy for the actual print/stream, and sometimes a Bonjour profile/helper on FortiAP if the wireless side is doing extra isolation.
Technician
Step 4 — Check the FortiGate Bonjour profile for your SSID
1) In the FortiGate GUI go to WiFi & Switch Controller → WiFi Network and edit the SSID your iPhones use.
2) Look for a Bonjour profile or mDNS section. If it’s set to “block” or “same VLAN only”, AirPrint and AirPlay discovery may be getting filtered before it even reaches the firewall.
3) Create or edit a Bonjour profile that:
• Allows mDNS service types you care about (e.g.
_ipp._tcp for AirPrint, _airplay._tcp / _raop._tcp for Apple TV).• Forwards those Bonjour services from the Wi-Fi VLAN toward the printer VLAN (FortiGate acts like an mDNS helper / reflector).
4) Apply that Bonjour profile to the SSID and push changes to the FortiAPs.
Combined with the multicast policies we built earlier, this gives you a proper FortiGate Bonjour gateway: FortiAP forwards mDNS to the FortiGate, and the FortiGate reflects it between VLANs.
Technician
A few hard-won tips:
• In the Bonjour profile, allow only the service types you need (AirPrint, AirPlay, maybe Chromecast) instead of “all mDNS”. Less chatter → fewer timeouts.
• Keep multicast policies limited to the VLANs that truly need mDNS: typically Users ↔ Printers/AV, not every internal interface or VPN.
• Give printers and Apple TVs static DHCP reservations so their IPs don’t move between reboots; Bonjour advertisements will stay consistent.
• Avoid using
.local as your FortiGate DNS domain because that collides with Bonjour’s own .local zone, which can confuse mDNS resolution.• On the switches, make sure IGMP snooping isn’t aggressively dropping multicast for 224.0.0.251, or add an IGMP querier on the VLAN if required.
After those tweaks, AirPrint and AirPlay across VLANs through FortiGate tend to be as reliable as a flat network, but with the security of per-VLAN policies.
Technician
On the FortiGate you can do this cleanly:
• Keep the multicast policies limited to the Bonjour multicast address (224.0.0.251) and UDP 5353 only; that’s for mDNS discovery.
• In regular IPv4 policies, replace “ALL” with a set of very specific services: IPP 631, maybe 9100, AirPlay ports, and nothing else.
• Use address groups for only the printer and Apple TV IPs as destinations. Users can’t hit other hosts in that VLAN even if they know the IP.
• Leave management interfaces and SMB/FTP/RDP ports blocked by default between VLANs, and use an admin-only jump host if you need to reach them.
That way, the FortiGate mDNS helper/reflector does its job for discovery, but your segmentation model (Users, IoT, Servers) still holds up.
Technician
• Put the guest SSID on its own Guest VLAN with strict Internet-only access by default.
• Create a small address group with only the one printer IP guests are allowed to use.
• Add multicast policies between Guest VLAN ↔ Printer VLAN for the Bonjour address (UDP 5353) so mDNS can cross.
• In IPv4 policies from Guest → Printer VLAN, allow only IPP 631 to that printer address group.
• Optionally, apply a dedicated Bonjour profile to the guest SSID that only exposes the AirPrint service type, not AirPlay or everything else.
That gives you “FortiGate AirPrint from guest Wi-Fi” while keeping the rest of your internal network completely hidden from guests.
Technician
• Define a Bonjour multicast address (224.0.0.251).
• Create multicast policies for UDP 5353 between user VLANs and printer/AV VLANs.
• Enable a Bonjour/mDNS helper profile on FortiAP SSIDs that should forward AirPrint/AirPlay services toward the FortiGate.
• Add tight IPv4 policies for IPP and AirPlay ports so only print/stream traffic crosses VLANs, not full access.
Need help mapping this to your exact FortiOS version and VLAN layout? Open the chat and mention “FortiGate mDNS across VLANs”.
Quick answer: the accepted fix
Accepted fix when FortiGate breaks mDNS/Bonjour across VLANs: create a Bonjour multicast address (224.0.0.251), add multicast policies for UDP 5353 between the user and printer/AV VLANs, and enable a FortiGate/FortiAP Bonjour profile or mDNS helper that forwards AirPrint/AirPlay services between those interfaces. Then lock down IPv4 policies so only IPP 631 and required streaming ports cross VLANs.
Why mDNS and Bonjour stop working when FortiGate segments your network
Protocols like AirPrint, AirPlay, HomeKit and many smart-home or AV systems use multicast DNS (mDNS) to advertise services. mDNS sends queries to the link-local multicast group 224.0.0.251:5353/UDP and expects devices on the same subnet to respond. When you introduce FortiGate VLANs and layer-3 interfaces, that link-local multicast traffic is no longer flooded everywhere — it stops at the firewall boundary.
Out of the box, FortiGate happily routes unicast IP traffic between those VLANs but does not act as an mDNS reflector. So users on one VLAN can ping a printer or Apple TV by IP, yet the Bonjour service entries never show up. Enabling a Bonjour profile on FortiAP, defining the Bonjour multicast address, and adding multicast policies between internal interfaces turns your FortiGate into a controlled mDNS helper across subnets, restoring discovery while preserving segmentation.
How to verify FortiGate mDNS reflection is working across VLANs
Once you’ve created the Bonjour multicast address, multicast policies, and Bonjour profile, test from a client on the user VLAN. Connect an iPhone/iPad to the Wi-Fi SSID, open Safari or Mail, tap Print, and pull down to refresh the list. If the FortiGate mDNS helper is working, AirPrint printers from the other VLAN should appear within a few seconds and remain visible while you stay on the network.
For deeper validation, use a Bonjour browser app or the dns-sd command on macOS to list services like _ipp._tcp and _airplay._tcp while connected to each VLAN. You can also run a short diag sniffer packet any 'host 224.0.0.251 and port 5353' 4 on the FortiGate CLI to confirm that mDNS packets are hitting the firewall and being forwarded between interfaces according to your multicast policies.
FortiGate mDNS across VLANs — quick configuration tips
Most “AirPrint/AirPlay not working behind FortiGate” cases come down to mDNS being link-local, missing multicast policies, or a misconfigured Bonjour helper.
Quick path: define the Bonjour multicast address on the FortiGate → create multicast policies for UDP 5353 between your user and printer/AV VLANs → enable a Bonjour profile on FortiAP SSIDs that should forward AirPrint and AirPlay → add narrow IPv4 policies for IPP and streaming ports only. This gives you reliable mDNS across VLANs on FortiGate while keeping IoT, guest and internal networks properly segmented.
Disclaimer: This information is AI-generated and intended for general guidance only. For advice specific to your environment, please consult a verified expert on Whizz-Tech before making decisions.
Getting Started Is Easy
Ask for help, 24/7
Members enjoy round-the-clock access to 12,000+ verified Experts, including tech support, mechanics, vets, and more.
Expert will respond in minutes
We match you with an Expert who specializes in your situation. Talk, text, or chat — whichever you prefer.
Save time & money
No scheduling hassles or expensive consults. Membership can save you significant time and money each month.
FAQ
Why does FortiGate break mDNS/Bonjour when I move printers or Apple TV to another VLAN?
Bonjour and AirPrint use multicast DNS (mDNS) to advertise services to 224.0.0.251:5353/UDP. That traffic is link-local and not routed between subnets. When you segment your network with FortiGate VLANs, unicast traffic (ping, HTTP) can still cross, but mDNS packets don’t unless you configure a Bonjour/mDNS helper and multicast policies to reflect them across interfaces.
How do I configure FortiGate as an mDNS helper or Bonjour reflector across VLANs?
Create a Bonjour multicast address object for 224.0.0.251, then add multicast policies that allow UDP 5353 between your user and printer/AV VLANs. If you use FortiAP, apply a Bonjour profile to the SSID that forwards AirPrint/AirPlay service types toward the FortiGate. Combined, this lets the firewall act as a controlled mDNS reflector across subnets while keeping VLANs logically separate.
Which firewall rules are required on FortiGate for AirPrint and AirPlay across VLANs?
On top of multicast policies for UDP 5353, you need IPv4 policies that allow users to reach printer and Apple TV IPs on specific ports. At minimum, permit IPP (TCP 631) and any required RAW/PDL ports for printing, plus AirPlay/RAOP ports if you use screen mirroring. Keep other services (SMB, RDP, admin ports) blocked so mDNS across VLANs doesn’t turn into full lateral access.
Can I use FortiGate mDNS across VLANs and still keep guest or IoT networks isolated?
Yes. Multicast policies and Bonjour profiles can be scoped to specific VLANs and service types. You can allow only AirPrint from Guest → Printer VLAN or only AirPlay from Users → Apple TV VLAN by limiting the Bonjour profile and IPv4 policies to those devices and ports. Everything else on the guest or IoT network remains segmented by your normal FortiGate firewall rules.
Sources
- Fortinet Community — Extending AirPlay and AirPrint communication through FortiGate
- FortiGate: How to set up AirPrint with multicast and Bonjour
- Fortinet Guru — Multicast addresses (including Bonjour 224.0.0.251)
Filed under: Network security / VPN / office policies (advanced)
Related articles
- mDNS Not Propagating Across VLANs — Reflector Config Guide
- Printer won’t print prescriptions or medical reports — it’s urgent and nothing comes out
- Chrome managed profile watermark prints wrong — policy override checks you can do safely
- Ricoh “Hold Print” enabled by AD — disable policy
- Ricoh SMB scan works but print fails — AES signing mismatch
- Android VPN blocks printer discovery — split tunnel rule (work profile)
- Android “Secure print only” — enterprise toggle: setup, policy, fixes
- Android corporate work profile can’t print — MDM policy exemption