I’m using an HP printer and currently am using the USB cable to connect to my PC to print. I’m running out of USB ports and (for some reason) when I use a USB hub with it, my PC fails to read it.
Instead, I wish to connect the printer to my local network, BUT I don’t want it connected to the internet. I’ve seen how dangerous it is to expose your printer to the internet, so I wish to prevent that (plus I don’t want the printer to auto-update).
How can I connect my printer to my local network so I can print wirelessly without allowing internet access to it?
If it’s important:
- My PC is ArchLinux
- My printer is a HP ColorJet Pro MFP (I dont know the model #/what series it is)
- I do have cups and hp-lip installed on my system
Also: A guest network does not work on my network for some reason, but that’s a separate issue unrelated to this.
Two options:
- In the printer manual set the IP and mask but do not set the gateway.
- in the router set DHCP for that Mac address with a fix IP. In the firewall menu block traffic to that IP.
My printer is a HP ColorJet Pro MFP (I dont know the model #/what series it is)
So, if you have it visible via USB at the moment, you can probably have the Arch Linux PC tell you with
lsusb. That’ll list all attached devices.But, as to the general problem, if you’re fine with using USB other than running short on USB ports, I’d probably try one of two things:
-
Your USB hub might not support a new enough version of USB. I think that devices are supposed to fall back gracefully, but I definitely have seen the occasional device that does wonky, probably non-standard things with different versions of USB. I have a phone, for example, that will tether using a USB-2-capable cable but not with nicer USB-3-capable cables.
-
Just put the other USB devices that you’re plugging into the computer on the hub, rather than the printer.
That’s simple, you know it works already, and it solves the security issue.
If you want to do the WiFi route, that’s going to be entirely dependent upon your wireless access point (you likely have an all-in-one “router” that acts as a broadband modem, router, and wireless access point). There isn’t going to be a standard way to do this, and I can’t even guarantee that the router is going to be capable of it, but if it has a management interface, probably Web-based, it’ll likely have some list of devices, probably sorted by DHCP lease or MAC address, that have paired with the WAP. If it’s in there, it’ll have some option to cut off access, but again…I can’t tell you what it’d look like, since it’d depend on the system.
If that doesn’t work (like, you can’t make your router do that, or you have multiple devices that you want to be able to print to the thing and don’t want to keep your PC on), you may be able to take another PC, connect it to the printer (e.g. via USB) and set it up as a print server running CUPS. That way, there’s absolutely no way for the printer to reach the network, and you have control of the device serving the printer to the network.
If you definitely want to go the WiFi route and your router cannot block Internet access to a device that it gives an address to, then you may be able to throw the router into “bridge” mode and set up your own router hooked up to it running OpenWRT or something similar, and have that be the wireless access point for your whole network, and have that disallow access to the Internet to that particular device.
-
The simplest way is to just connect it to your network normally, and block its internet access at your firewall (the all in one wifi/router/switch that most people have).
If that isn’t an option for you for whatever reason, you can do something like connect it to a raspberry Pi via USB, and have that device act as a print server.
Maybe there are better ways to do this but I’d put it in a VLAN configured how you want. Any device that gets less trust than your PC belongs in a separate VLAN I think, just as a matter of basic security.
Vlans rarely provide security people think they do. If you want to print, your pc needs to have access to the vlan the printer is in which means you have a hole in your security that anything else can go through.
A vlan is no different than creating a separate network with a firewall. If something can break the firewall to get to your PC, it can break the firewall to get to the printer.
Only a hole for the print services with specific port mappings to the printer itself.
That’s at least the best you can do. Otherwise fully isolated vlans are pretty good.
Only a hole for the print services with specific port mappings to the printer itself.
Which is the same as if there was no vlan. It’s not like any router forwards port 631 unless you specifically open it up. And without port 80 open on the vlan, your PC can’t get to the printer settings. But if your vlan has 80 open so you can use the printer, then there was no point in putting it in a vlan.
You could statically assign an IP to the printer (if it has WiFi/ethernet) and not set a default gateway. It then won’t know how to communicate with the internet but still be accessible on the same local subnet.
A more advanced route would be separate VLANs with routing rules between your main vlan and the printer vlan, while blocking all outbound traffic from the printer vlan.Or you could set up something like a raspberry pi or similar as a print server. The printer connects to it via USB only, so has no access to any networks. And the raspberry pi is the device you configure and trust, which does the translation from network based printing to USB based printing.
This is the easiest answer.
Vlans are not the easiest answer.
As someone else suggested blocking the printer at the router is easier.
Sorry, I meant just doing a static IP and not giving it a gateway.
Is the gateway something like 192 168 255 255?
Yes, usually the gateway address is the ip address of your router. You may leave it empty or modify it in a way that it points to a dead address.
What kind if switch/router are you using? You should be able to set up a firewall rule to block a device from accessing the internet. Of course, the steps depend entirely on your hardware and router OS, but essentially:
- give printer a static ip on you main network
- tell firewall that any traffic originating from printer static IP on the internal network destined to the ISP is not allowed, and vice versa
- assuming printer mac address doesnt change, you can also apply the same rule to the mac address.
I have a PiHole setup that my router uses as a DNS server. Can I just block it there?
If your router supports it you can provide the printer a bogus default gateway and DNS. That should prevent it from having internet access. You could also likely do this in the printer if it has a way to configure it directly.
A firewall rule that blocks access would be better but will depend on what you have available.
VLAN without internet access is a step above that.
A Raspberry pi print server will work as well by bypassing any network connection whatsoever
Or you could just use a long usb cable and not deal with any of it.
