iCloud Private Relay / firewall blocks AirPrint — working exceptions
Joe B.
Expert ★★★★★ 27,853 satisfied customers
Specialities: Windows 11/10, macOS (Sonoma/Ventura/Monterey), Printers, Networking, Office Equipment
AirPrint not discovering printers on iOS/iPadOS or macOS — iCloud Private Relay, firewall/VLANs, Bonjour (mDNS), IPP 631
Technician
• Are you printing from iPhone/iPad (iOS/iPadOS) or Mac?
• Same Wi‑Fi/VLAN as the printer, or is it on another subnet/guest network?
• Any VPN, Private DNS, or client isolation enabled on the router or SSID?
This helps me set the right Bonjour (mDNS) and IPP exceptions so AirPrint shows your HP/Epson/Canon/Brother again.
Technician
• Private Relay or a VPN forces private DNS and blocks local multicast.
• Firewall or AP isolation drops mDNS between devices or across VLANs.
• IGMP snooping or multicast filtering stops _ipp._tcp / _ipps._tcp / _printer._tcp announcements.
Plan: allow UDP 5353 and TCP 631 between the phone/Mac and the printer, enable a Bonjour gateway or mDNS reflector across VLANs, and set device‑level exceptions when Private Relay is used.
Technician
1) Discovery — allow Bonjour/mDNS between user VLAN and printer VLAN:
• UDP 5353 multicast to 224.0.0.251 (IPv4) / ff02::fb (IPv6).
• Services:
_ipp._tcp, _ipps._tcp, _printer._tcp, _universal._sub._ipp._tcp.• If using multiple VLANs, enable a Bonjour Gateway / mDNS reflector (UniFi, Aruba, Cisco) instead of opening full multicast.
2) Printing — allow IPP on TCP 631 from clients to the printer (or CUPS/print server). If you enforce HTTPS, expose IPPS (TCP 631 over TLS).
3) Blocklists — keep all other inbound blocked; no need to open RAW 9100 for AirPrint. These rules are narrow and audit‑friendly.
Technician
• Settings → Wi‑Fi → (i) the SSID → toggle Private Relay Off for that network.
• Ensure Local Network permission is allowed for AirPrint (and the browser/app you print from).
• If using VPN or security apps, disable for local networks or add split‑tunnel to permit 224.0.0.251/UDP 5353 and the printer’s IP.
This restores local discovery without disabling Private Relay system‑wide.
Technician
• Enable an mDNS/Bonjour service and publish _ipp._tcp (and _ipps._tcp) from the printer VLAN to the user VLAN.
• Keep client/AP isolation off for SSIDs that must discover printers.
• If you run a CUPS or print server, advertise it via _printer._tcp and allow IPP 631 to the server only for tighter control.
Technician
• Turn on AirPrint / Bonjour and IPP/IPPS services.
• Assign a static IP or DHCP reservation; disable Wi‑Fi Direct if you don’t use it.
• For TLS, install a cert and enable IPPS so iOS/macOS can use encrypted printing on TCP 631.
These changes improve discovery and reduce “AirPrint printer not found” loops.
Technician
• In Chrome/Gmail → share → Print (opens the iOS print panel).
• If the list is empty, toggle Wi‑Fi off/on, then re‑open print panel (forces mDNS refresh).
• On macOS, use System Settings → Printers & Scanners → Add Printer → Default (AirPrint) or IP with IPP.
Technician
Technician
Quick answer: the accepted fix
Accepted fix when AirPrint printers are not discovered: allow Bonjour/mDNS UDP 5353 and IPP/IPPS TCP 631 between clients and printer/print server; use a Bonjour gateway to bridge VLANs; turn iCloud Private Relay or VPN off for the SSID (or split‑tunnel); ensure AirPrint/IPP is enabled on the device.
AirPrint blocked after enabling iCloud Private Relay, VPN, or strict firewall rules
When discovery breaks after a privacy or security change, review: Local Network permission, SSID client isolation, IGMP snooping, Bonjour gateway config, and rules for UDP 5353 and TCP 631. Allow only _ipp._tcp/_ipps._tcp across subnets for a minimal, auditable exception set.
How to verify AirPrint discovery works
From iPhone open a PDF → Share → Print → printer list should show within 3–5 seconds. On macOS, add the printer as AirPrint or as IPP by IP; print a test page. If discovery is intermittent, check multicast rate limits and make sure the Bonjour gateway advertises _ipp._tcp to the correct VLAN.
AirPrint networking — troubleshooting tips
Most AirPrint issues stem from blocked mDNS or missing IPP 631 pathways.
Quick path: verify printer IP → enable AirPrint/IPP → allow UDP 5353 and TCP 631 → bridge VLANs with a Bonjour gateway → test without Private Relay/VPN → re‑enable security with targeted exceptions.
Disclaimer: This information is AI-generated and intended for general guidance only. For advice specific to your environment, please consult a verified expert on Whizz-Tech before making decisions.
Getting Started Is Easy
Ask for help, 24/7
Members enjoy round-the-clock access to 12,000+ verified Experts, including tech support, mechanics, vets, and more.
Expert will respond in minutes
We match you with an Expert who specializes in your situation. Talk, text, or chat — whichever you prefer.
Save time & money
No scheduling hassles or expensive consults. Membership can save you significant time and money each month.
FAQ
Which ports/protocols does AirPrint need?
Bonjour/mDNS discovery on UDP 5353 and IPP/IPPS printing on TCP 631. Across VLANs, use a Bonjour gateway and allow only those services.
Does iCloud Private Relay block AirPrint?
It can. Private Relay and some VPNs limit local multicast. Turn Private Relay off for the SSID or add split‑tunnel rules permitting 224.0.0.251:5353 and the printer/IPPS endpoint.
AirPrint over VLANs — is it secure?
Yes. Advertise only _ipp._tcp via a Bonjour gateway and allow TCP 631 to a print server or specific printer IPs. Keep all other inbound blocked.
Our SSID uses client isolation — can AirPrint work?
Not directly. Disable isolation for the printing SSID or use a gateway/reflector that bridges mDNS to the printer VLAN while keeping clients isolated from each other.
Do we need RAW 9100 or LPD for AirPrint?
No. AirPrint uses IPP/IPPS (631). Keep RAW 9100 and LPD closed unless your workflow requires them.
| Symptom | Likely cause | Quick fix |
|---|---|---|
| “No AirPrint Printers Found” | mDNS blocked; Private Relay/VPN active | Allow UDP 5353; disable Private Relay for SSID or split‑tunnel; enable Bonjour gateway |
| Printer visible, jobs fail | IPP (TCP 631) blocked; TLS mismatch | Allow TCP 631 to printer/server; enable IPPS with valid cert |
| Works on Mac, not on iPhone | App not using System Print; Local Network permission off | Use Share → Print; enable Local Network for the app |
| Intermittent discovery | IGMP snooping or multicast rate limits | Tune multicast, verify Bonjour gateway scopes, avoid AP isolation |
Step‑by‑step (network & device)
- Enable AirPrint/Bonjour and IPP/IPPS on the printer; set a static IP.
- On the router/Wi‑Fi, allow UDP 5353 and TCP 631 between user and printer networks; turn on a Bonjour gateway for VLANs.
- On iOS/macOS, disable Private Relay for the SSID or configure VPN split‑tunnel for local subnets and 224.0.0.251.
- Add the printer as AirPrint or as IPP by IP; print a test page.
Sources
- Apple Platform Deployment — AirPrint overview
- Apple — About iCloud Private Relay
- RFC 6762 — Multicast DNS (mDNS)
Filed under: Network security / VPN / office policies (advanced)
Related articles
- Windows Hello PIN login blocks legacy printer auth — policy path fix
- Box Drive secure viewer blocks printing — policy toggle
- Printer won’t print prescriptions or medical reports — it’s urgent and nothing comes out
- Chrome managed profile watermark prints wrong — policy override checks you can do safely
- Ricoh “Hold Print” enabled by AD — disable policy
- Ricoh SMB scan works but print fails — AES signing mismatch
- Android VPN blocks printer discovery — split tunnel rule (work profile)
- Android “Secure print only” — enterprise toggle: setup, policy, fixes