Blocking an printer from the internet.



  • Hello everyone,

    I recently upgraded my old USB printer to an Wi-Fi enabled printer. I am an bit concerned about it having acces to the internet because some printers dont have the best security. So what i want to do is block it from the internet but so i can still print from it of the local network. (I cant setup VLAN's and sorry for my english).



  • Give it a static IP address. Create a new Alias and put all local, non-internet IP address ranges in that alias. Then, finally, create a firewall rule on the same subnet as the printer and deny it access to any network besides those in the alias from above.

    If you need the exact steps, let me know, I have them all typed out in detail somewhere here already.

    Jeff





  • @akuma1x am i doing it correctly or not, i cant check it from the printer it self. (printer_enzo are the computers) alt text



  • Let's go thru the steps in more detail:

    1. Set a static IP address for the printer. You have to do this in pfsense, not on the printer. From your screenshot, this looks like you gave it IP address 192.168.1.88, and that looks good.

    2. Create an alias for all the private networks, there are only 3.
      Screen Shot 2019-03-31 at 3.19.08 PM.png

    3. Create a blocking firewall rule using the alias and the printer.

    In your screenshot, I'm not sure what you mean by the "printer_enzo" alias. You say computers are in there, but the alias should look like my screenshot, in step 2. It's not actually computers that should be in there, but instead the private networks. See more info here: https://whatismyipaddress.com/private-ip

    This will be a tough rule to actually check - your printer may never, even all by itself, communicate out to the internet.

    Hope that helps.

    Jeff



  • @akuma1x said in Blocking an printer from the internet.:

    Set a static IP address for the printer. You have to do this in pfsense, not on the printer.

    It should also be possible to use static DHCP mapping, to assign a static address to a MAC address.


Log in to reply