Linux network technician providing live chat help for mDNS and Avahi

Joe B.

Expert ★★★★★ 27,853 satisfied customers

Specialities: Linux networking, firewalld & iptables, UFW, Avahi mDNS / DNS-SD, .local name resolution, AirPrint & network printer discovery

Fix “Linux firewall blocks mDNS” — allow multicast DNS, unblock Avahi, and restore .local / printer discovery

Technician avatar Technician
Hey there — we can definitely help when a Linux firewall blocks mDNS and Avahi stops discovering printers or other devices.

On most Linux distros, multicast DNS (mDNS) traffic goes over UDP port 5353 to 224.0.0.251. If your firewalld, iptables, or UFW rules block that traffic, Avahi or systemd-resolved can’t see your .local hosts, AirPrint printers, Chromecast, etc.

To steer you in the right direction, I need to narrow the situation a bit: which distro are you on (Ubuntu, Debian, Fedora, RHEL, openSUSE, something else), and which Linux firewall are you using — firewalld, UFW, raw iptables/nftables, or a cloud security group? Also, what exactly is broken: .local hostname resolution, Avahi service discovery, or just one specific mDNS-based network printer that isn’t showing up?
Customer
I’m on Ubuntu Server running some containers and a few network printers. For discovery we use Avahi so the printers and a couple of Raspberry Pis show up via mDNS. Everything worked until I hardened the server and turned on the UFW firewall. After that, hostname.local stopped resolving from other machines and the AirPrint printers disappeared from our Macs and iPads. If I disable the Linux firewall, mDNS and Avahi work again. So it’s definitely “Linux firewall blocks mDNS” at this point — I just don’t know the exact rules to add.
Technician avatar Technician
Thanks, that’s a really common pattern: UFW or firewalld breaks Avahi mDNS right after you lock things down.

mDNS is a bit special because:
• It uses multicast UDP to 224.0.0.251:5353 instead of regular unicast DNS.
• It’s often both incoming and outgoing: your host sends queries from a random source port and also needs to listen on UDP 5353 for replies and advertisements.
• Tools like Avahi-daemon, nss-mdns and systemd-resolved rely on that multicast traffic to publish and resolve .local names and services.

When a hardened Linux firewall blocks mDNS, a few things happen:
• UDP packets to 224.0.0.251:5353 never reach Avahi, so service discovery is empty.
• Replies coming back from other hosts are dropped because the firewall doesn’t permit them.
• In some configurations, multicast and broadcast traffic is blocked entirely unless you explicitly allow it.

The good news: we can fix this cleanly by adding a small set of Avahi mDNS rules to UFW or firewalld and then testing with tools like avahi-browse and getent hosts hostname.local.
Customer
That lines up with what I’m seeing. UFW is in deny-by-default mode with only a few TCP ports open. I never touched UDP or multicast manually. When I run avahi-browse -a on the Ubuntu box, it only shows local stuff, and from my laptop I can’t resolve the server’s .local name at all. I’m guessing I need some UFW mDNS rules for Avahi, but I’m not sure whether to allow just 5353 or also some ephemeral ports. I also have a Fedora box here that uses firewalld, so I’m curious about the equivalent commands there.
Technician avatar Technician
Great, let’s tackle both UFW and firewalld since they’re the most common when a Linux firewall blocks mDNS.

For UFW on Ubuntu, the typical approach is:
• Allow UDP 5353 on your LAN interface:
sudo ufw allow in proto udp to 224.0.0.251 port 5353
or simply:
sudo ufw allow in 5353/udp (on a trusted LAN).
• Optionally allow outgoing UDP 5353 if you’ve locked outbound too.

For firewalld on Fedora/RHEL/openSUSE, there’s already a built-in mdns service definition you can enable in the right zone:
sudo firewall-cmd --permanent --add-service=mdns
sudo firewall-cmd --reload
That opens the mDNS port and lets Avahi or systemd-resolved talk multicast DNS. If you’re using zones, we’ll make sure the interface is in “home” or another zone that has mdns allowed.

After we add these Avahi mDNS rules, we’ll test again with avahi-browse and by seeing whether network printers and .local hostnames reappear.
Customer
OK, that sounds manageable. One thing I’m not clear on: if I just open UDP 5353, is that enough for all mDNS traffic, or do I need extra rules for the ephemeral source ports you mentioned? I’ve seen some posts about firewalld blocking mDNS responses because the reply comes from 5353 back to a random local port. I’d like to be precise without opening more than needed.
Technician avatar Technician
Good question — this is where a lot of Linux firewall + mDNS guides get fuzzy, so let’s spell it out.

On a typical host that both sends and receives mDNS:
• Your machine listens on UDP 5353 for multicast packets to 224.0.0.251.
• It sends mDNS queries from either port 5353 (common) or from an ephemeral port to 224.0.0.251:5353.
• Other hosts do the same, and they may send replies back to your 5353 listener.

That means two main firewall requirements:
1. Allow inbound UDP 5353 to your host on the LAN interface so Avahi/systemd-resolved can receive mDNS queries and responses.
2. Allow outbound UDP 5353 if you restrict outgoing traffic, so your host can send its own mDNS traffic.

State-tracking in UFW, firewalld, nftables takes care of the reverse flows for replies, so you don’t need separate rules for random source ports. The built-in mdns service in firewalld and a simple “allow 5353/udp” in UFW are usually enough to fix “Linux firewall blocks mDNS” without over-exposing your system.
Customer
That clarifies a lot. On the Ubuntu side we’re using systemd-resolved plus Avahi, and on Fedora it’s Avahi plus NetworkManager. Does it matter which one is providing mDNS? I’ve also seen mention of nss-mdns for .local lookups. I just want to make sure the firewall rules will work with both Avahi and systemd-resolved so we don’t end up with a half-working setup.
Technician avatar Technician
Great that you brought that up — a lot of Linux environments are mixed now.

• Avahi-daemon is a classic mDNS / DNS-SD implementation on Linux. It listens on UDP 5353 and publishes services (printers, SSH, HTTP, etc.) and can resolve them via avahi-browse.
• systemd-resolved also has an mDNS responder now. It can handle .local hostnames, and together with nss-mdns it plugs into glibc so commands like ping hostname.local work.

Regardless of which component is doing the mDNS work, they both rely on the same multicast DNS port and group: UDP 5353 to 224.0.0.251 (IPv4) and ff02::fb (IPv6). So the firewall rules for mDNS don’t really change:
• Allow UDP 5353 on your LAN zone / interface.
• Don’t block multicast/broadcast at layer-3/4 if you expect discovery to work.

Where Avahi vs systemd-resolved matters is more in name resolution order (nsswitch.conf) and whether you want both running. From a “Linux firewall blocks mDNS — Avahi rules” perspective, we just have to make sure 5353/udp is open in the right direction and the right zone.
Customer
Makes sense. Our main pain point is actually printer discovery: we have a couple of AirPrint-capable printers, and after tightening the firewall, users can’t see them from iOS or macOS, and Linux desktops don’t auto-discover them in CUPS anymore. I suspect that’s all mDNS too. Will adding these Avahi mDNS firewall rules also help with the printers, or do we need anything additional for IPP / IPP Everywhere?
Technician avatar Technician
You’re exactly right — modern network printers, AirPrint, IPP Everywhere, and DNS-SD all lean heavily on mDNS.

When a printer announces itself, it usually:
• Advertises services like _ipp._tcp, _ipps._tcp, _printer._tcp over mDNS.
• Exposes its queues over IPP on TCP 631 and sometimes on HTTPS.

So to make Linux printer discovery happy you typically need:
1. mDNS allowed through the firewall (Avahi/systemd-resolved side) so the services show up at all.
2. IPP/HTTP(S) ports open between clients and the printer or CUPS server so jobs can actually be sent.

In your case, the symptom “printers disappeared after enabling the firewall” is classic Linux firewall blocks mDNS. Opening UDP 5353 and the mdns service usually restores discovery, and then we can double-check that TCP 631 (IPP) and/or 443/80 are allowed where needed.
Customer
Understood. Another thing I’ve seen mentioned is firewalld zones and putting the interface in “home” vs “public”. On the Fedora box, I set the interface to the “public” zone when I locked it down. Do I need to move it to another zone for mDNS to work, or can I just add the mdns service to whatever zone the interface uses? I’m a bit confused how that interacts with Avahi.
Technician avatar Technician
Great question — zones are exactly where firewalld can silently block mDNS even when Avahi is running.

• Each interface is assigned to a zone (public, home, trusted, etc.).
• Each zone has specific services (like ssh, http, mdns) and ports that are allowed.

For mDNS, you have two options:
1. Keep the interface in the “public” zone but explicitly run:
sudo firewall-cmd --zone=public --permanent --add-service=mdns
sudo firewall-cmd --reload
2. Or, if it’s truly a trusted LAN, move the interface to “home” and make sure mdns is enabled there.

The mdns service definition in firewalld already knows which multicast port to open. Once that’s on in the right zone, Avahi and systemd-resolved can send and receive mDNS on that interface, and your .local devices should re-appear.
Customer
That’s very clear now. I’d like to avoid just disabling the firewall whenever I troubleshoot mDNS. Ideally, I want a tiny, well-documented rule set that says “allow Avahi mDNS and printer discovery, everything else stays locked down”. Can you summarize the steps and specific commands you’d recommend for a typical Linux firewall blocks mDNS — Avahi rules fix, and maybe help me test it one-on-one?
Technician avatar Technician
Absolutely — here’s the minimal, practical recipe I use when a Linux firewall blocks mDNS and Avahi:

1) On UFW / Ubuntu, allow mDNS on the LAN interface:
sudo ufw allow in 5353/udp
and, if outbound is restricted:
sudo ufw allow out 5353/udp.

2) On firewalld (Fedora/RHEL/openSUSE), enable the built-in mDNS service in the active zone:
sudo firewall-cmd --permanent --add-service=mdns
sudo firewall-cmd --reload

3) Make sure Avahi or systemd-resolved with mDNS enabled is running, and that nss-mdns or the appropriate resolver is configured so .local lookups actually use mDNS.

4) Test with avahi-browse -a, ping hostname.local, and by checking whether network printers and other Bonjour devices show back up in CUPS, macOS, and iOS.

If you’d like, I can walk through your exact UFW / firewalld rules, Avahi config, and printer discovery live, based on terminal output and screenshots. Open the chat and we’ll turn “Linux firewall blocks mDNS” into a clean, reproducible Avahi rule set that just works.

Quick answer: the accepted fix

Accepted fix when a Linux firewall blocks mDNS: open UDP port 5353 for multicast DNS on your LAN interface (or enable the mdns service in firewalld), ensure Avahi or systemd-resolved is configured for mDNS, and verify that .local hostnames and printers are visible again. Keep the rest of the firewall locked down while explicitly allowing only the Avahi mDNS rules you need.

Why your Linux firewall blocks mDNS and breaks Avahi

Most modern distros ship with Avahi or systemd-resolved ready to handle multicast DNS, but a strict Linux firewall often blocks that traffic by default. Because mDNS uses multicast UDP 5353 instead of standard DNS ports, rules that only allow TCP 80/443/22 and DNS 53 will still drop multicast packets to 224.0.0.251. The result: avahi-browse -a shows nothing from the network, .local names don’t resolve, and Bonjour / AirPrint printers vanish from your clients. The fix is to add explicit mDNS / Avahi firewall rules so that UDP 5353 is allowed on the appropriate zone or interface while everything else remains protected.

How to test Avahi after opening mDNS in the Linux firewall

Once you’ve allowed mDNS through UFW or firewalld, it’s important to verify that your Linux mDNS configuration actually works. From the affected host, run avahi-browse -a and confirm that services like _ipp._tcp and _ssh._tcp appear. Try ping hostname.local or getent hosts hostname.local to make sure nss-mdns or systemd-resolved can resolve .local names. On client devices, check your printer list or AirPrint dialog to confirm that network printers discovered via mDNS have returned. If some subnets still don’t see each other, you may need additional routing or an Avahi reflector, but the basic “Linux firewall blocks mDNS — Avahi rules” issue should be resolved at this point.

Linux mDNS & Avahi — quick firewall tips

Before you blame Avahi, check whether your Linux firewall is silently dropping multicast DNS.

Quick path: confirm which firewall you use (UFW, firewalld, or iptables) → open UDP 5353 on your LAN interface or enable the built-in mdns service → make sure Avahi or systemd-resolved is configured to use mDNS for .local → then test printer and host discovery from multiple devices. A handful of well-placed Avahi mDNS rules often turn a “Linux firewall breaks Bonjour” situation into a stable, secure network where discovery just works.

Disclaimer: This information is AI-generated and intended for general guidance only. Always follow your distribution’s official firewall documentation and the Avahi / systemd-resolved manuals. For advice tailored to your environment, please consult a verified expert on Whizz-Tech before applying firewall changes to production systems.

Getting Started Is Easy

Ask for help, 24/7

Members enjoy round-the-clock access to 12,000+ verified Experts, including Linux network engineers, firewall specialists, and Avahi / mDNS troubleshooters who deal with multicast DNS issues every day.

Expert will respond in minutes

We match you with an Expert who specializes in Linux firewalls, Avahi configuration, systemd-resolved, and mDNS-based printer discovery so you can quickly restore .local lookups and network services.

Save time & money

Avoid hours of guesswork and broken discovery. We’ll help you design safe Linux firewall rules for mDNS, keep Avahi working, and make sure printers and services show up reliably across your network.

FAQ

Why does my Linux firewall block mDNS and Avahi?

Most Linux firewalls block all unsolicited inbound traffic unless you explicitly allow it. Because mDNS uses multicast UDP 5353 instead of traditional DNS ports, rules that only allow web, SSH, and DNS do not cover Avahi. As a result, multicast packets to 224.0.0.251:5353 never reach Avahi or systemd-resolved, so .local names and Bonjour services disappear until you add specific mDNS firewall rules.

Which port and protocol does mDNS use on Linux?

Multicast DNS uses UDP port 5353 on IPv4 address 224.0.0.251 and IPv6 address ff02::fb. To fix “Linux firewall blocks mDNS” issues, you must allow UDP 5353 on the LAN interface or zone where Avahi or systemd-resolved is listening, usually via UFW rules or the mdns service in firewalld.

How do I allow mDNS through firewalld or UFW?

On firewalld-based systems, run firewall-cmd --permanent --add-service=mdns followed by firewall-cmd --reload, making sure the interface is in a zone where mdns is enabled. On UFW, a common rule is sudo ufw allow in 5353/udp (and optionally ufw allow out 5353/udp if outbound is restricted). Both approaches open the mDNS port while leaving other services filtered.

Will opening mDNS make my Linux server insecure?

Allowing mDNS (UDP 5353) on a trusted LAN for Avahi and printer discovery is generally low risk, especially compared to exposing services to the Internet. You should still limit mDNS to the appropriate interface or zone, avoid enabling it on untrusted networks, and keep Avahi/systemd-resolved up to date. A few targeted Avahi rules in the Linux firewall let discovery work without turning your host into an open relay.

Sources

Matt Verified Icon
Matt ● replies in < 1 min
Technician Expert
⭐⭐⭐⭐⭐ Trusted by 27,000+ customers
Avatar
Alex · Expert's Assistant
5 Tech Support Specialists are online right now.