How to allow Printer Access from isolated segment?
Hi all,
Rookie question here...My work systems are on one port of the Firewalla Gold with it's own IP and no rules, except No Local Access. I have a printer on my home network which I need to also be able to print to from my work system.
How is the best way to set this up, where I can print, yet prevent access to the rest of my Home network? Same question would apple to guests being able to print, but they are segmented off via VLAN, but the AP is still connected to the same port as my home network. Not sure if provisioning for one would be different than the other, but thought I'd ask both questions just in case the solution was different.
Thanks!
-
@rj834,
So say you have two networks A and B. There are multiple things yo can do here:
- Allow no traffic between A and B.
- Allow traffic from A > B but disallow traffic from B > A.
- Allow traffic from B > A but disallow traffic from A >B.
For all of them, start with a rule that says BLOCk traffic to and from all Local networks. Apply this to each network.
For 2 and 3, add a rule that says ALLOW traffic from [network of your choosing] apply this to the network receiving the request. This might be the network with the printer in your case.
-
So, I created a rule blocking all traffic to and from local LANs, since there’s more than work and home. I then created a rule to allow work > home, but block home > work. Printer immediately went offline, so there’s definitely two way communication there to validate the printer status.
I guess I should have added some context. I already can’t print from work system to home printer. That’s never worked. I can see the print queue, but it never goes through. If I connect to my home WiFi, it prints immediately. Shouldn’t this be more of a NAT setting?
-
So, I created a rule blocking all traffic to and from local LANs, since there’s more than work and home.
Perfect.
allow work > home, but block home > work.
So this is tricky. There are often two ways to do rules;
"allow traffic from" or "allow traffic to". Worth playing with this. But again there should just be one block and one allow required here.
So some printers use mDNS for notification. You could turn that on for the relevant networks.
Please sign in to leave a comment.
Comments
7 comments