Comment on How do you isolate a printer in your homelab?
lemmyvore@feddit.nl 1 hour ago
If it’s a networked printer it needs to be able to broadcast to the LAN if you want IPP to work – which you probably do, since it’s well supported by all OS and lets you autodiscover the printer and print directly from most of your devices.
This means you can’t isolate it fully from the LAN, so solution 2 is out.
Solution 1 is good if you can trust the thing not to change or disguise its MAC address. I’ve heard of devices that have a 3rd dynamic MAC in addition to the wifi and ethernet MACs, that they use to bypass such restrictions. 🤪
In order to do (1) properly you should create a firewall zone specifically for the printer, and deny that zone access to WAN. Then associate that zone with either a wifi access point created specifically for the printer, or with a specific switch plug if connected via Ethernet. This way the printer can’t bypass the restriction because it comes packaged with the only way it has of getting any connectivity.
Solution 3 seems best if you want to fully isolate it as well as retain IPP capability. That’s what I did with my printer, I connected it with USB to the server and I run CUPS + Avahi in a docker container that uses an ipvlan network to broadcast.
Your comment about #2 is not true. VLANs can be fully isolated from other subnets on the LAN - sure. But they can also NOT be isolated. I have one fully isolated VLAN, and the rest are not isolated.
With a savvy user, you can also tehnically isolate VLANs form only specific other VLANs. I’ve never needed to do this, but know it’s possible.
rearview@lemmy.zip 55 minutes ago
Damn, I didn’t know devices do these dynamic MACs, but yeah it’s not a trusted field to begin with.
By IPP autodiscovery, do you mean mDNS? If so, does the router needs to install avahi as well for single-network discovery to work? Or just the client?
Avahi on the router for multi VLAN discovery seem to be a nice idea, I’ll look into it and maybe try to hook it up to solution 2. I’ve thought users could just manually input the IP addresses (and the non-tech users will just simply be onboarded by me anyways), but having it advertised by default may just be less of a hassle for them.