Why your printer should not share a network with your laptops
A modern multifunction printer runs a full operating system, stores scanned documents on an internal disk and often has an email account configured for scan-to-mail. It also rarely receives updates. In our audits it is the most overlooked device on the network.
Give printers their own segment
Create a separate VLAN or a dedicated LAN interface for printers. Staff devices may reach the printers on printing ports only; printers may not start connections to staff devices at all.
- Allowed from staff to printers: IPP (631/tcp), raw printing (9100/tcp), the web panel (443/tcp) for administrators only.
- Allowed from printers outward: DNS, NTP, the vendor's update server, and your mail relay if you use scan-to-email.
- Everything else: blocked.
Sample rules for OpenWrt (fw4/nftables) and a generic firewall are in our downloads.
Never expose printing ports to the internet
Check the router's port-forwarding table and UPnP leases for 9100, 515, 631 and 161. A printer reachable from outside can be made to print, can leak stored jobs and, on some models, can be reflashed.
Switch off what nobody uses
- Telnet, FTP and TFTP — almost never needed.
- SNMP v1/v2c with the community string
public— change it or move to SNMPv3. - WSD, Bonjour and LLMNR on segments where nobody needs discovery.
- Wi-Fi Direct on printers that are already cabled.
Lock the printer's own admin panel
Set an administrator password on the printer's embedded web server, restrict it to HTTPS and, where supported, to the administrators' IP addresses. Enable secure erase of stored jobs if the model has a disk.
Keep its firmware current
Printer vendors do ship security fixes — they just do not install themselves. Add printers to the same update schedule as your router: see Firmware updates without surprises.