# PrintDoc — sample OpenWrt (fw4) configuration: isolated printer segment
# Tested on OpenWrt 23.05 / 24.10. Merge into /etc/config/network and
# /etc/config/firewall by hand, then: /etc/init.d/network reload && fw4 reload
# Adjust subnets and the VLAN/bridge port to match your hardware.

# ---- /etc/config/network ----------------------------------------------
config interface 'printers'
	option proto 'static'
	option device 'br-lan.30'
	option ipaddr '192.168.30.1'
	option netmask '255.255.255.0'

# ---- /etc/config/dhcp -------------------------------------------------
config dhcp 'printers'
	option interface 'printers'
	option start '100'
	option limit '50'
	option leasetime '24h'

# ---- /etc/config/firewall ---------------------------------------------
config zone
	option name 'printers'
	list network 'printers'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'

# printers may use DNS and NTP on the router
config rule
	option name 'Printers-DNS'
	option src 'printers'
	option dest_port '53'
	option proto 'udp'
	option target 'ACCEPT'

config rule
	option name 'Printers-NTP'
	option src 'printers'
	option dest_port '123'
	option proto 'udp'
	option target 'ACCEPT'

# staff can print (IPP + raw)
config rule
	option name 'LAN-to-Printers'
	option src 'lan'
	option dest 'printers'
	option dest_port '631 9100'
	option proto 'tcp'
	option target 'ACCEPT'

# only the admin workstation reaches the printer web panel
config rule
	option name 'Admin-to-Printer-Panel'
	option src 'lan'
	option src_ip '192.168.1.10'
	option dest 'printers'
	option dest_port '443'
	option proto 'tcp'
	option target 'ACCEPT'

# no forwarding from printers to lan or wan (zone default REJECT covers it);
# add a narrow rule here if you use scan-to-email:
# config rule
#	option name 'Printers-SMTP'
#	option src 'printers'
#	option dest 'wan'
#	option dest_ip '<mail relay IP>'
#	option dest_port '587'
#	option proto 'tcp'
#	option target 'ACCEPT'