VLAN for IoT printers — route only what’s needed (secure & working)

Joe B.

Expert ★★★★★ 27,853 satisfied customers

Specialities: Network segmentation, VLANs, Firewalls, Windows Server/AD, macOS/iOS, Printers (HP/Epson/Canon/Brother), Zero Trust

Printer VLAN design for HP, Epson, Canon, Brother — AirPrint across VLAN, IPP/RAW/SMB, mDNS/Bonjour

Technician

Hey! We’ll put your printers on an IoT VLAN, then route only what’s needed so users can still print while the devices stay isolated. Tell me: switch/firewall brand, whether you need AirPrint/Bonjour across VLANs, which print protocols you use (RAW 9100, IPP/631, LPR/515, SMB 445), and whether scan-to-email or admin web UI should be allowed.

Customer

Small office, mixed HP and Brother printers. We want a dedicated printer VLAN with internet blocked, but users on the staff VLAN must print from Windows and Macs. iPhones/iPads should AirPrint across VLAN. We use scan-to-email.

Technician

Perfect. A VLAN for IoT printers reduces risk (older firmware, weak TLS, default SNMP). The plan:
• Put devices in VLAN 30: PRINTERS with a non-routable RFC1918 range (e.g., 10.30.30.0/24).
• Apply ingress/egress ACLs to allow only print flows from user VLANs and traffic needed for scan to email (SMTP/587 or 465).
• Provide Bonjour gateway/mDNS reflector (AirPrint requires _ipp._tcp, _ipp-usb._tcp, _printer._tcp announcements) instead of opening all multicast.
• Optional web UI: restrict to IT subnet; block the rest (tcp/80,443).
• SNMP read-only from your monitoring subnet; block write (161/162 RO only).

Customer

What exact firewall rules should we create? We use FortiGate and Aruba switches with IGMP snooning on.

Technician

Start with a default deny from PRINTERS → any. Then add precise allows:
User VLANs → PRINTERS (stateful allow):

• TCP 9100 (RAW/JetDirect) — if used by Windows ports.
• TCP 631 (IPP/IPPS) — best choice for macOS & modern Windows.
• TCP 515 (LPR/LPD) — legacy.
• TCP 445 (SMB) — only if print server shares queues; avoid direct SMB to printer if possible.

PRINTERS → SMTP relay:

• TCP 587 or 465 to your mail relay for scan to email.

IT subnet → PRINTERS (admin UI & SNMP RO):

• TCP 80/443 to device web pages (optional, limit to IT).
• UDP 161 (SNMP read-only) & UDP 162 (traps to NMS).

Block all internet egress from PRINTERS except to mail relay and (optional) vendor NTP. Enable IGMP snooping on the switches.

Customer

How do we make AirPrint across VLANs work without opening multicast to everyone?

Technician

Use a Bonjour/mDNS gateway (FortiGate Bonjour Gateway, Aruba AirGroup, Cisco mDNS, or an Avahi reflector on a small Linux VM). It selectively forwards only required service records:
• _ipp._tcp, _ipps._tcp, _printer._tcp for printing.
• Scope it so only Staff VLAN sees printers; guests do not. Keep mDNS (5353/udp) blocked at L3 otherwise.

Customer

We run a Windows print server. Should clients print through the server or direct to the printer VLAN?

Technician

For control and logging, route clients to the print server and let the server talk to PRINTERS over IPP or RAW 9100. Pros: driver centralization, quotas, auditing, easy migration. For small sites without a server, allow direct IPP/9100 from users, but keep ACLs tightened and use static DHCP reservations.

Customer

Any tips for DHCP, naming, and firmware on a printer VLAN?

Technician

Yes — secure & predictable matters for IoT:
• Use a dedicated DHCP scope with reservations; add Option 42 (NTP) and local DNS.
• Standardize names (PRN-HP-M404-01) and set reverse DNS. Disable unused protocols (FTP/Telnet/Web Services).
• Lock admin password, disable Wi-Fi Direct, set SNMPv3 if supported; otherwise RO community unique to the VLAN.
• Schedule firmware updates; block outbound internet to force uploads via IT only.

Customer

Can we keep the printers off the domain but still allow scan-to-network SMB to a NAS share?

Technician

Absolutely. Create a NAS share accessible via a dedicated “scanner” account with limited rights and strong password. Allow PRINTERS → NAS on TCP 445 only; deny PRINTERS to the rest of the LAN. Many shops prefer scan-to-email via the SMTP relay to avoid SMB exposure entirely.

Customer

What about 802.1X or MAC Authentication Bypass on the switch ports?

Technician

If you run NAC, configure 802.1X with MAB fallback. Unknown MACs land in a quarantine VLAN, known printer MAC OUIs get dropped into PRINTERS VLAN. This prevents rogue devices from using the port.

Customer

After we apply the ACLs, how do we verify everything works but stays locked down?

Technician

Test matrix:
1) From a Windows client: print via IPP 631 or RAW 9100; confirm spool completes.
2) From macOS and iOS: see devices via the Bonjour gateway; print a test PDF.
3) From PRINTERS to SMTP relay: send a scan-to-email. All other internet egress should be blocked.
4) Attempt web UI from a non-IT PC — it should fail. From IT subnet — it should work.
5) Run an nmap from user VLAN to one printer: only approved ports should be reachable.

Customer

Looks good. Can you summarize the secure printer VLAN recipe we’ll implement?

Technician

Summary: Put printers into a dedicated IoT printer VLAN, use ACLs to allow only printing protocols (IPP/9100/LPR via users or print server), enable Bonjour gateway for AirPrint, allow SMTP relay for scans, restrict web UI/SNMP to IT, and block internet for everything else. That’s a secure & working design. Need help applying rules on your FortiGate/Aruba? Open the chat.

Quick answer: the accepted design

Accepted approach for a VLAN for IoT printers: isolate devices in a dedicated subnet, use ACLs/Firewall to allow only IPP 631, RAW 9100, LPR 515, optional SMB 445 to a print server or NAS, enable a Bonjour/mDNS gateway for AirPrint across VLANs, permit SMTP 587/465 to your relay for scan-to-email, allow SNMP RO from monitoring, and block all other internet egress.

FAQ

Step-by-step (firewall/VLAN deployment)

1. Create VLAN 30: PRINTERS and DHCP scope with reservations; enable IGMP snooping.
2. Add ACLs allowing user VLANs to PRINTERS on IPP/9100/LPR; deny all else.
3. Permit PRINTERS to SMTP relay (587/465) and optional NTP/DNS; block internet egress.
4. Restrict admin: IT subnet only to 80/443 and SNMP RO; disable unused services on devices.
5. Deploy a Bonjour gateway to publish printers to macOS/iOS; test from iPhone/iPad.

Step-by-step (client experience)

1. Windows: add printers via IPP or via the print server; avoid SMB direct when possible.
2. macOS/iOS: discover via AirPrint through the Bonjour gateway; print a test PDF.
3. Verify scanning: send a scan to email through the SMTP relay; confirm external egress is blocked.

Sources

• Vendor docs — Fortinet Bonjour Gateway, Aruba AirGroup, Cisco mDNS/Bonjour Gateway
• Apple Platform Deployment — AirPrint & Bonjour fundamentals
• Common printer protocols — IPP, JetDirect 9100, LPR/LPD, SMB

Matt ● replies in < 1 min

Technician Expert

⭐⭐⭐⭐⭐ Trusted by 27,000+ customers

Alex · Expert's Assistant

Start Chat

5 Tech Support Specialists are online right now.