Hi all, I’ve gotten a Brother machine (DCP series) that can do wifi printing/scanning over their proprietary app. However, I’d like to lock it down from my network, because having it on the same LAN as my other devices and the ability to phone out to the internet seem like room for mischievious activities.
For context, I have OpenWRT on my router, and my clients can access the Brother using their iPrint&Scan app and AirPrint on wifi, as well as the traditional USB port. But I’m not good in networking. In my research, I drafted out the following solutions:
- Create a firewall rule to block the printer itself from making outbound requests. Seems simple, but I’m not sure if this can persist after IP changes or not.
- Create a VLAN for “IoT devices” that cannot send outbound requests to my normal VLAN nor the internet. Inspiration from this video, I’d need to manage a new SSID but it may come in handy for more IoT devices later.
- Hook the Brother up to a Raspberry Pi via USB, and install CUPS + SANE on the Pi. Assuming the Pi cannot “phone home” on behalf of the printer, this makes it a local-only “print+scan service” on my normal network and doesn’t require an extra VLAN.
I’d like to ask: which solution above is best for “neutering” the Brother? Or are there any alternatives/details I might’ve missed? I’m not sure if blocking outbound requests this way is enough of a security hardening for an untrusted device, and if there are any usability issues I’ve overlooked so far.
Thanks for any advice, and please share any printer/scanner setup you have in your networks as well. So hopefully I can get more inspiration!
What’s your concern with a new printer? In case 1, once set up and working how is a company going to introduce malicious features when the printer has absolutely no Internet access?
New printers can be okay. I don’t know of any specific problems with new printers except those ones with the ink subscription services. I’m saying my printer is old because it’s from another time. The only reason you’d isolate your networked printer in 2005 would be if you didn’t want other people to access your printer. Devices in your home automatically, deliberately making themselves worse on command from a cloud service was not a thing. The biggest danger with devices this old is that they probably have unpatched security vulnerabilities exploitable by anything else that gets on your network.
I have a VR headset from Facebook that is on its own VLAN because it defaults to randomizing its MAC address by default and this allowed it to bypass the firewall, phone home, and nonconsensually install new anti-features after being blocked because the setting got reset back to random when changing something. Recent LG TVs and other devices with worse preinstalled malware have been known to make requests to other devices on your network, but I’ve never heard of them using those other devices to get around network restrictions, at least not directly.