Comment on How do you isolate a printer in your homelab?
spaghettiwestern@sh.itjust.works 1 day ago
You’re overthinking this with 2 & 3. All you need is to block all Brother Internet traffic.
Set up a static DHCP IP for the printer in Openwrt and create firewall rules to drop all WAN packets to/from that IP.
If you want to see evidence those packets are being dropped in real time use tcpdump. When watching LAN traffic you will see the printer sending packets to the WAN interface but will never see a response directed back to the printer.
I have a Brother printer (plus cameras & TVs) and an Openwrt router set up that way and have had zero issues.
i_am_not_a_robot@discuss.tchncs.de 1 day ago
1 is enough if the hardware manufacturer is currently trustworthy at the time you put the firewall rules in place. Brother is AFAIK trustworthy. I have a Brother printer which is on my main network with no special firewall rules, but my printer is old enough to drink. It never connected to any cloud services and could never update itself to introduce new anti-features.
For both 2 and 3 you probably want a Raspberry Pi or other server to make the printer accessible to devices on your main network. Unless it’s a Facebook or Amazon or LG printer or something you should be fine with just 1.
spaghettiwestern@sh.itjust.works 1 day ago
What’s your concern with a new printer? In case 1, once set up and working how is a company going to introduce malicious features when the printer has absolutely no Internet access?
i_am_not_a_robot@discuss.tchncs.de 12 hours ago
New printers can be okay. I don’t know of any specific problems with new printers except those ones with the ink subscription services. I’m saying my printer is old because it’s from another time. The only reason you’d isolate your networked printer in 2005 would be if you didn’t want other people to access your printer. Devices in your home automatically, deliberately making themselves worse on command from a cloud service was not a thing. The biggest danger with devices this old is that they probably have unpatched security vulnerabilities exploitable by anything else that gets on your network.
I have a VR headset from Facebook that is on its own VLAN because it defaults to randomizing its MAC address by default and this allowed it to bypass the firewall, phone home, and nonconsensually install new anti-features after being blocked because the setting got reset back to random when changing something. Recent LG TVs and other devices with worse preinstalled malware have been known to make requests to other devices on your network, but I’ve never heard of them using those other devices to get around network restrictions, at least not directly.
spaghettiwestern@sh.itjust.works 12 hours ago
That is infuriating and I’d do the same.
Plenty of reports of devices like LG TVs acting as gateways to external devices and LG in particular seems to be a privacy nightmare. I bought a couple of appliances that advertised their smart features only to find LG’s app was required, so LG actually required both Internet access AND my exact location at all times for the app to work at all.
You may be right to be concerned even about printers though. At some point we’re going to be reading about some built-in AI hacking other network devices for Internet access and transmitting our private information to the world.