Network printing & VPN technician providing live chat help

Joe B.

Reviewed for technical accuracy

Specialities: VPN & split tunneling, IPP (Internet Printing Protocol), Windows & macOS printing, SSL/IPsec VPN clients (AnyConnect, FortiClient, OpenVPN), local printer routing & network exemptions

Fix “VPN split tunnel fails for IPP” — restore local IPP printing, add a VPN local exemption, and keep your printer working while connected

Technician avatar Technician
Hey there — we can definitely help with the case where a VPN split tunnel fails for IPP printing and your local printer stops working as soon as you connect to the corporate VPN. This usually comes down to how the VPN split tunneling and local exemption rules are configured and where your IPP printer (port 631) sits in relation to those routes.

To point you in the right direction, I need to narrow things down a bit: are you printing to a home or office network printer via IPP (for example, an AirPrint / IPP Everywhere device), or is it a classic TCP/9100 printer? What VPN client are you using — Cisco AnyConnect / Secure Client, FortiClient, OpenVPN, Zscaler, or something else? And finally, when the VPN is up, can you still ping the printer’s local IP address (like 192.168.1.50), or does it go completely offline until you disconnect the VPN?
Customer
It’s a home IPP printer on my local network (192.168.1.x). On Windows it’s added as an IPP printer, and my Mac also sees it via AirPrint. Once I connect to the office VPN, the printer either shows as offline or the job just hangs. The VPN profile says split tunneling is enabled, but IPP still fails, so I guess the VPN split tunnel for IPP traffic isn’t working the way it should.
Technician avatar Technician
Thanks, that’s exactly the kind of detail I needed. When a VPN split tunnel fails for IPP printers, what’s usually happening is this:

1) The VPN client installs routes that override your default gateway, so even though “split tunneling” is technically enabled, all or most RFC1918 local subnets still get forced into the tunnel.
2) Your IPP queue is trying to talk to the printer on TCP port 631, but because the VPN doesn’t have a local exemption for your home subnet, that IPP traffic gets sent into the VPN instead of staying on the LAN. The printer never sees it, so jobs hang or show as “printer offline”.

A proper fix usually means configuring the VPN so that traffic to your local printer’s IP (or home subnet) is explicitly excluded from the tunnel — a true local LAN exemption for IPP, not just a generic “split tunnel for internet sites”. We’ll walk through what you can change on your side and what you might need your VPN admin to adjust.
Customer
The admin said it’s already a split-tunnel VPN and “only corporate subnets go through the tunnel”. But in practice, the second I connect, I can’t print or even ping 192.168.1.40 (my printer). Disconnect the VPN and IPP works instantly again. So it feels like the split tunnel exemption for my local IPP printer is missing or misconfigured.
Technician avatar Technician
You’re spot on — just because the VPN profile is labelled as “split tunnel” doesn’t mean your local LAN and IPP printer subnet are actually excluded correctly.

On many SSL/IPsec VPNs (AnyConnect, FortiClient, WatchGuard, etc.), the split tunnel list only covers what goes into the VPN (corporate networks). Anything not listed there should stay local, but:
• Some profiles still push a 0.0.0.0/0 route or disable “local LAN access”, killing access to home printers.
• Others block multicast / mDNS discovery, so the printer vanishes from discovery but works if you print by direct IP/IPP.

When a customer tells me their IPP printer fails only when VPN is up, I usually check two things:
1) The routing table while the VPN is connected (to see what routes point to the VPN adapter).
2) Whether we can reach the printer directly by IP — ping 192.168.1.40, then test an IPP queue to that IP and port 631 instead of a discovered name. That tells us if we just need a split tunnel exemption for the local subnet or a more specific fix.
Customer
When VPN is disconnected, I can ping 192.168.1.40 and print fine. With VPN connected, ping times out and the print queue just says “Can’t reach printer”. This happens on both Windows and Mac. So I’m guessing the VPN client is hijacking traffic for my 192.168.1.0/24 network, and the split tunnel for IPP isn’t really split for my local subnet.
Technician avatar Technician
Exactly — that’s classic “VPN kills local printer even though split tunneling is supposedly on”. The fix is usually to explicitly allow your home subnet to bypass the tunnel.

Here’s the general recipe that works across most vendors when a VPN split tunnel fails for IPP and local printing:
1) Give the printer a static IP address (for example, 192.168.1.40) so we have a stable target for the exemption.
2) On the VPN side, add a local exemption / split tunnel bypass for either:
  • The entire home subnet (e.g., 192.168.1.0/24), or
  • Just the printer’s IP (192.168.1.40/32).
3) Make sure the client is allowed to access local LAN while connected. In Cisco Secure Client there’s literally a checkbox “Allow local (LAN) access when using VPN (if configured)”; FortiClient and others have similar options.
4) On Windows and macOS, add the printer by IP/IPP (http(s)://192.168.1.40:631 or an IPP Everywhere queue) instead of relying only on auto-discovery, since VPNs often block the discovery traffic but still allow direct TCP/IPP once the route is correct.

Once that local exemption is in place, your IPP traffic stays on the LAN while everything corporate still uses the VPN, which is exactly what split tunneling for printers is supposed to do.
Customer
I don’t control the VPN gateway — IT manages it. All I can see is the VPN client and a “split tunnel” description. What should I tell them specifically so they understand I need a local exemption for my IPP printer and not just general internet split tunneling?
Technician avatar Technician
Great question — wording the request clearly makes life easier for your VPN admin. Here’s roughly what you can send them when a VPN split tunnel fails for local printing:

• Mention that you have a local IPP printer on 192.168.1.40 that becomes unreachable (no ping, no print) only when VPN is connected.
• Ask them to exclude 192.168.1.40/32 or your entire 192.168.1.0/24 subnet from the VPN tunnel so that traffic to that IP stays on your local LAN.
• If they’re using Cisco AnyConnect / Secure Client, ask them to enable the “Allow local (LAN) access when using VPN (if configured)” option for your profile.
• For FortiClient, WatchGuard, Palo Alto, etc., they should create a split tunneling rule that routes only company networks into the tunnel and leaves your local network as “direct”.

You can literally say: “My IPP printer on 192.168.1.40 stops working when the VPN is up. Could you please add a split-tunnel/local LAN exemption for that IP (or my 192.168.1.0/24 subnet) so IPP traffic to my printer stays local?”
Customer
That helps. Are there any security risks with asking for split tunneling just for my IPP printer? I don’t want them to reject the request because “split tunneling is dangerous”.
Technician avatar Technician
Good that you’re thinking about that. Full split tunneling can introduce risk because the machine is on the internet and the corporate network at the same time. But what you’re asking for is a very narrow local exemption that many security teams already allow for printers and trusted LAN devices.

Typical compromise looks like this:
• Corporate subnets (for example, 10.0.0.0/8, 172.16.0.0/12) + any SaaS ranges still go through the VPN and are fully inspected.
• A small local range such as 192.168.1.0/24, or even just 192.168.1.40/32, is allowed to stay outside the tunnel so IPP traffic can reach your printer.
• The endpoint still runs antivirus and host protection, and the VPN client remains in control of everything else.

Many vendors (Fortinet, Cisco, etc.) even use the IPP/printing example when they document VPN split tunneling, because local printers are one of the most common reasons to allow a tightly scoped local LAN exemption.
Customer
Understood. Does it matter that I’m using Windows 11 and macOS at the same time? On Mac the printer shows up as AirPrint/IPP, on Windows it’s added as an IPP device using the printer’s hostname. Does the fix for a VPN split tunnel failing for IPP differ by OS?
Technician avatar Technician
Great question. The core fix is the same (route IPP traffic locally, not through the VPN), but there are a few OS-specific tips:

• On macOS and iOS, AirPrint/IPP uses discovery plus IPP over TCP 631. Even if discovery breaks when VPN connects, the printer usually works if the Mac can still reach the IP address and port 631 over your LAN.
• On Windows 10/11, I recommend adding the printer explicitly as an IPP or TCP/IP printer using the IP address (192.168.1.40) rather than a mDNS name. That way, once the split tunnel local exemption is in place, Windows sends traffic straight to that IP, bypassing the VPN.
• If name resolution is an issue, you can also make a simple hosts file entry that points the printer’s name to the correct local IP — again, only once the routing is fixed so it stays local.

So the recipe is: fix the VPN routing / local exemption first, then on both Windows and macOS, make sure the printer is added as a direct IP or IPP queue that talks to the printer’s local address.
Customer
Makes sense. I’ve also seen terms like “local LAN access”, “full tunnel VPN”, and “split tunnel with exclusions”. How do those relate to my problem where IPP printing fails over VPN?
Technician avatar Technician
Perfect, let’s quickly decode those terms in the context of a VPN split tunnel failing for IPP:

• Full tunnel: 100% of your traffic (internet + everything else) goes through the VPN. In this mode, local printers almost always break unless the admin deliberately allows local LAN access.
• Split tunnel (basic): Only corporate subnets go into the tunnel, and everything else stays local. If it’s configured properly, your IPP printer on 192.168.1.x keeps working.
• Split tunnel with exclusions / local exemption: The admin can explicitly say, “send these ranges into the VPN, but never tunnel this specific IP or subnet.” This is what you want for a local printer exemption.

In your case, the VPN is probably marketed as “split tunnel”, but the practical effect is closer to a full tunnel (or a restricted split) that doesn’t honour local LAN access. That’s why your VPN split tunnel appears to fail for IPP traffic until the admin adds an explicit exemption for your local printer network.
Customer
Got it. For my specific case — home IPP printer, VPN split tunneling, but no local LAN access — can you summarize the exact steps I should follow so I can send a clear plan to IT and test it myself?
Technician avatar Technician
Absolutely — here’s the practical fix when a VPN split tunnel fails for IPP and local printers:

1) On your router and printer, assign the printer a static IP (for example, 192.168.1.40) so it doesn’t move around.
2) Ask IT to exclude 192.168.1.40/32 or your 192.168.1.0/24 subnet from the VPN tunnel, and to enable “allow local LAN access when VPN is connected” for your profile.
3) On Windows and macOS, re-add the printer as an IPP/TCP printer by IP address (http(s)://192.168.1.40:631 or similar), not just by auto-discovery.
4) Reconnect the VPN, confirm you can ping the printer, then send a test IPP print job. If the split tunnel exemption is correct, the job should complete without disconnecting the VPN.

If you’d like, I can go through your exact VPN client settings, routing table and printer config step by step. Open the chat and we’ll debug your IPP split tunnel and local exemption live, so you can print while staying securely connected to work.

Quick answer: the accepted fix

Accepted fix when a VPN split tunnel fails for IPP: give your IPP printer a static IP, then configure the VPN so traffic to that local IP or subnet is exempt from the tunnel (local LAN access). Add the printer as a direct IPP queue on port 631, reconnect the VPN, and confirm you can ping and print to the printer while the rest of your corporate traffic continues to use the VPN.

Why your VPN split tunnel fails for IPP printers

When a VPN split tunnel fails for IPP and your local network printer stops responding, the root cause is almost always routing. IPP uses TCP port 631, and the printer typically lives on a private LAN range like 192.168.x.x. If the VPN profile pushes routes that override your home subnet, or disables local LAN access, then IPP traffic meant for the printer gets sent through the VPN tunnel instead of going to your switch or Wi-Fi router. The result: jobs stuck in the queue, AirPrint devices disappearing, and “printer offline” messages whenever the VPN is active.

How to verify the IPP split tunnel and local exemption fix

After your VPN admin adds a local exemption for your printer IP or subnet, reconnect the VPN and run a few quick tests. First, ping the printer’s IP while the VPN is connected. If split tunneling is working correctly for IPP, pings to 192.168.x.x should succeed. Next, send a small test job to an IPP queue on that printer and watch the job complete without errors. On macOS and iOS, confirm your AirPrint/IPP device reappears; on Windows, verify that an IPP or TCP/IP printer added by IP keeps working even with the VPN on. If all of that passes, your VPN split tunnel and IPP local exemption are configured correctly.

VPN split tunneling & IPP printers — quick tips

Before you blame the printer, check how your VPN routes local traffic and whether there’s a proper IPP exemption for your LAN.

Quick path: confirm which VPN client and profile you’re using → note your printer’s static LAN IP → ask IT to add a split tunnel exemption or local LAN access for that subnet/IP → on every device, re-add the printer as an IPP or TCP/IP printer that talks directly to the printer’s IP address and port 631. This approach resolves the majority of cases where VPN split tunneling is enabled on paper but IPP printing to local printers still fails.

Disclaimer: This information is AI-generated and intended for general guidance only. Always follow your organization’s VPN and security policies, and consult your network team before requesting or changing split tunneling rules. For advice tailored to your exact VPN client, firewall and printer setup, please talk to a verified expert on Whizz-Tech.

Getting Started Is Easy

Ask for help, 24/7

Members enjoy round-the-clock access to 12,000+ verified Experts, including VPN specialists, network printing pros, Windows & Mac admins, and IPP/AirPrint technicians.

Expert will respond in minutes

We match you with an Expert who specializes in VPN split tunneling, IPP over port 631, and local printer exemptions so your printing works the same with VPN on or off.

Save time & money

Avoid disconnecting VPN every time you print or losing work because the printer goes offline. We’ll help you fix VPN split tunnel issues for IPP and set up a reliable, secure local printing workflow.

FAQ

Why does my IPP printer stop working when I connect to a VPN, even with split tunneling enabled?

When an IPP printer stops working with VPN on, it’s usually because the VPN routes override your local subnet or block local LAN access. Even if the profile says “split tunnel”, your 192.168.x.x traffic may still be sent into the tunnel. Without a proper local exemption for your printer IP or subnet, IPP packets never reach the printer, so jobs fail or show as “offline”.

How do I configure a VPN local exemption so split tunneling works for my IPP printer?

Give the printer a static IP, then ask your VPN admin to exclude that IP or your local subnet from the tunnel. On clients like Cisco Secure Client, this is done by enabling local LAN access and adjusting the split tunneling list; on others, it’s a route or policy that keeps traffic to 192.168.x.x local. Once the exemption is in place, add the printer as a direct IPP/TCP printer by IP and port 631, then test while the VPN is connected.

Is it safe to enable split tunneling or local LAN access just for a printer?

Allowing full split tunneling can be risky, but many organizations permit a limited local exemption for trusted devices like home printers. The key is keeping corporate networks and sensitive SaaS ranges inside the VPN, while only your local printer IP or subnet is allowed to stay outside the tunnel. Always follow your security team’s guidance when requesting a printer exemption.

Should I route only IPP (port 631) outside the VPN, or my entire home subnet?

Most VPN platforms handle split tunneling by IP/subnet, not by port. In practice, that means excluding your home subnet (for example, 192.168.1.0/24) or just the printer IP (192.168.1.40/32) from the tunnel. IPP traffic on port 631 will then follow that local route automatically, allowing VPN split tunneling to work for IPP printers without complex port-based rules.

Sources

Matt Verified Icon
Matt ● replies in < 1 min
Technician Expert
⭐⭐⭐⭐⭐ Trusted by 27,000+ customers
Avatar
Alex · Expert's Assistant
5 Tech Support Specialists are online right now.