VPN client disables local printer — allow local resources setting

Joe B.

Expert ★★★★★ 27,853 satisfied customers

Specialities: Windows 11/10, macOS (Sonoma/Ventura/Monterey), Printers, Networking, Office Equipment

VPN blocks local printing on Windows 10/Windows 11 or Mac — AnyConnect, GlobalProtect, FortiClient, Zscaler

Technician

Hey! We’ll fix “VPN client disables local printer”. Tell me your VPN (e.g., Cisco AnyConnect, GlobalProtect, FortiClient, Zscaler, WireGuard) and your OS (Windows 11/10 or macOS). Also share your printer brand (HP, Canon, Epson, Brother) and whether printing fails only on VPN or always. We’ll enable Allow local resources / local LAN access and, if needed, set up split tunneling so the printer’s subnet bypasses the tunnel.

Customer

Windows 11 laptop, HP LaserJet on my home Wi-Fi. When I connect to GlobalProtect, the local printer disappears and jobs say “offline”. Disconnect VPN — it prints fine. RDP to a server works, but I need to print locally.

Technician

Got it. When VPN blocks local printers, the tunnel often disables access to your Local LAN or forces all traffic through the corporate gateway. Common causes:
• “Block local LAN” or disable local resources is enabled in the VPN profile.
• No split tunneling; your printer’s IP/subnet (e.g., 192.168.1.0/24) isn’t excluded from the tunnel.
• DNS for the printer hostname resolves only inside corporate DNS; use the printer’s static IP on your local network.
• RDP printer redirection conflicts with VPN policy (redirected printers show, but physical local printer is blocked).
Plan: enable Allow local resources / Allow Local LAN Access, add printer subnet to split tunnel excludes, and verify Windows/macOS firewall rules for local subnet printing.

Customer

Where do I find that “Allow local LAN access” option in GlobalProtect on Windows?

Technician

Enable local printing on Windows 10/11 while on VPN:
1) Ask IT (or if you manage it, open the portal) to enable Allow Local LAN Access / Allow local resources for your profile. In many clients it’s a checkbox in the agent or enforced via policy.
2) Configure split tunneling: exclude the printer’s subnet (e.g., 192.168.1.0/24) or the printer’s static IP from the VPN route list.
3) In Control Panel → Devices and Printers, set the printer via TCP/IP port pointing to its local IP (not hostname that resolves to corporate DNS).
4) If the VPN injects a restrictive firewall, add an allow rule for mDNS/Bonjour (UDP 5353) and Windows File and Printer Sharing on Private networks.
If your org uses AnyConnect, look for “Allow Local (LAN) Access when using VPN (if configured)”; FortiClient uses “Allow access to local subnets”.

Customer

What about my MacBook on Sonoma? With AnyConnect connected, my AirPrint HP isn’t found.

Technician

Enable local resources on macOS:
• In your VPN profile, turn on Allow local LAN access (AnyConnect) or the equivalent setting in GlobalProtect/FortiClient/Zscaler.
• Add a manual IP printer in System Settings → Printers & Scanners using the HP’s local IP (e.g., 192.168.0.45) via Line Printer or IPP. AirPrint discovery uses mDNS, which many VPNs block.
• If corporate DNS overrides local names, avoid hostnames and use the IP; ensure the Mac network is set to Private and macOS firewall allows Printer Sharing traffic.
• For RDP sessions from Mac, keep “Redirect printers” on, but printing to your physical local device requires that LAN access be allowed by the VPN.

Customer

We use Zscaler and sometimes RDP to a server. The redirected printer shows, but my home HP still doesn’t. Anything else?

Technician

Right — RDP redirection and VPN policy can clash. Steps:
• Keep Redirect printers enabled inside RDP only if you need server-side printing; for true local printing while on VPN, allow LAN access and target the printer’s local IP from your workstation, not from the server.
• In Zscaler/GlobalProtect, add an exclude route for your home LAN (e.g., 10.0.0.0/24). This is classic split tunnel printing.
• Some security stacks block SMB/IPP multicast. Use a static TCP/IP port and disable WSD discovery for reliability on Windows.

Customer

Can you list client-specific tips for AnyConnect, GlobalProtect, and FortiClient?

Technician

Client-specific fixes:
• Cisco AnyConnect: enable Allow Local LAN Access in the profile; add Network List / Exclude for your printer subnet; ensure Always-On doesn’t force full tunnel for private subnets.
• GlobalProtect: set Access Route Exclusions (split tunnel) for 192.168.x.x/24; allow Internal Host Detection exception for home LAN if used.
• FortiClient: toggle Allow access to local subnets; add routes in Split Tunneling; verify FortiGate policy doesn’t block local traffic.
• Zscaler / WireGuard: exclude local RFC1918 ranges; disable Tunnel All or add Allowed LAN list; confirm DNS split for printer hostnames.

Customer

After policy changes it works, but sometimes Windows loses the port and shows “Printer offline” only when VPN is on.

Technician

Do this once for reliability:
• Assign the printer a static IP on your home router and recreate the Windows port as Standard TCP/IP (disable WSD).
• In the VPN client, keep Allow local resources enabled and confirm the exclude route is permanently in your profile.
• Update the vendor driver (HP/Epson/Canon/Brother). Some universal drivers rely on discovery protocols that VPNs block; a direct IP port avoids that.

Customer

Any app-specific gotchas? We print from Word, Chrome, and Acrobat; sometimes Google Docs can’t see the printer on VPN.

Technician

• Office/Word: choose the IP-based queue you created; avoid “Web Services” printers over VPN.
• Adobe/Chrome/Google Docs: open the System Dialog (Ctrl+Shift+P / Cmd+Option+P) to access the OS printer list; cloud print popups may not enumerate during VPN sessions.
• If you use RDP, select your local IP printer from the client OS, not the server session, unless redirection is required.

Customer

Great — printing works on VPN now. Anything else to keep it stable?

Technician

Best practices: keep a static printer IP, prefer an IPP/TCP port, persist split-tunnel excludes for 192.168/10.0 subnets, and always enable Allow Local LAN Access in your VPN profile. That combination prevents “VPN disables local printer” from coming back after client updates.

Customer

Perfect — local printing works even with GlobalProtect connected. Thanks!

Technician

Summary: If VPN client disables local printer, enable Allow local resources / local LAN access, configure split tunneling and exclude your printer’s subnet, then add the printer by static IP (IPP/TCP). These steps fix local printing on Windows 11/10 and macOS across AnyConnect, GlobalProtect, FortiClient, Zscaler, WireGuard. Need hands-on help? Open the chat.

Quick answer: the accepted fix

Accepted fix when VPN blocks local printing (Windows 10/Windows 11/Mac): enable Allow Local LAN Access / Allow local resources in your VPN client, configure split tunneling and exclude the printer’s IP/subnet from the tunnel, then install the printer via static IP (IPP or Standard TCP/IP port). If DNS breaks discovery, use the printer’s IP instead of hostname.

FAQ

Step-by-step (Windows 10/11)

1. Ask IT to enable Allow Local LAN Access / Allow local resources in your VPN profile.
2. Configure split tunneling and exclude your printer subnet (e.g., 192.168.1.0/24).
3. Create a Standard TCP/IP port to the printer’s static IP (avoid WSD).
4. Verify Windows Firewall allows File and Printer Sharing on Private networks.

Step-by-step (macOS)

1. Enable Allow local resources in the VPN client (AnyConnect/GlobalProtect/FortiClient/Zscaler).
2. Add the printer via IP → IPP using its local IP; set it as default.
3. If still hidden, confirm the home LAN is in the VPN’s exclude routes.

Sources

• Microsoft — VPN & split tunneling concepts
• Cisco AnyConnect — Allow Local LAN Access
• Palo Alto GlobalProtect — Split Tunnel Exclusions
• FortiClient — Allow access to local subnets
• Apple — Add a printer on Mac

Matt ● replies in < 1 min

Technician Expert

⭐⭐⭐⭐⭐ Trusted by 27,000+ customers

Alex · Expert's Assistant

Start Chat

5 Tech Support Specialists are online right now.