Printer Network Ports: 9100, 631, 515 and What to Allow

Most people never think about printer network ports, and on a normal home network they do not need to. But when a printer shows up and then refuses to print, when a firewall or security suite is involved, or when you are setting up a printer by hand, it helps to know which port does what. This guide explains the handful of ports printers actually use, how they map to the setup methods on this site, and what to allow when something is in the way.

The short list

These figures come from the CUPS project’s firewall documentation and from Canon’s port table for its printers; other makers use the same standard numbers.

Port	Protocol	Used for
TCP 631	IPP / IPPS	Printing and status with the Internet Printing Protocol (AirPrint, Mopria, IPP Everywhere, CUPS)
TCP 9100	Raw (AppSocket / JetDirect)	Sending print data straight to the printer; CUPS lists 9100 to 9102
TCP 515	LPD / LPR	Older line printer protocol, still offered by many printers
UDP 5353	mDNS (Bonjour)	Finding printers on the network by name
UDP 3702	WS-Discovery	Device discovery for WSD printing in Windows (listed by Canon)
UDP 161	SNMP	Status queries such as ink, toner and errors
TCP 80 / 443	HTTP / HTTPS	The printer’s web settings page; CUPS also lists 443 for encrypted IPP
TCP 139 / 445	SMB	Printing to a printer shared from a Windows computer

The standard assignments for these numbers are kept in IANA’s port registry, which lists “ipp” on 631, “printer” (the LPD spooler) on 515, “pdl-datastream” on 9100 and “mdns” on 5353.

Which setup uses which port

• Automatic setup on Windows 11, Mac, iPhone, Android and Chromebook. Devices find the printer with mDNS on UDP 5353 (and Windows can also use WS-Discovery), then print over IPP on TCP 631. That is the path in our guides to adding a printer in Windows 11 and printing from iPhone.
• Adding by IP address in Windows. A Standard TCP/IP port usually uses raw printing on TCP 9100. Microsoft’s Add-PrinterPort creates this kind of port; it can also create LPR ports. See add a printer with PowerShell.
• Adding by IP address on a Mac. Apple’s IP tab lets you pick IPP, HP Jetdirect (Socket, which is 9100) or LPD (515).
• Linux with CUPS. ipp:// URIs use 631 and socket:// URIs use 9100; see add a printer from the Linux command line.
• Printer web page. Your browser connects on 80 or 443; see access a printer’s web interface.

When ports actually matter

On a single home network with a normal router, all of these ports are reachable between your devices and you have nothing to configure. Port problems usually come from one of these:

• A firewall or security suite on the computer that blocks outgoing connections or multicast discovery.
• A guest network or VLAN that keeps the printer on a different network segment. See let guests print on a guest Wi-Fi network.
• A protocol switched off on the printer. Canon notes that some printers have security settings that can prohibit certain protocols, so allowing a port in a firewall does nothing if the printer itself has that protocol disabled.
• Two routers in a row (double NAT), which splits the home into two networks. Our mesh Wi-Fi printer guide covers this.

What to allow in a firewall

If you manage a firewall between a computer and a printer, the CUPS documentation lists the outgoing ports a client needs to reach network printers. In practice:

• Discovery: UDP 5353 (mDNS) both ways on the local network.
• Printing: TCP 631 for IPP, or TCP 9100 for raw printing, or TCP 515 for LPD, depending on how the printer was added.
• Status: UDP 161 if your printer software reads ink or error status with SNMP.
• Sharing a printer from a computer: CUPS lists inbound TCP 631 on the sharing computer, plus mDNS. A Windows shared printer uses SMB ports instead; see share a printer on a network.

Keep rules as narrow as you can: allow these ports to the printer’s IP address only. Reserve that address in the router so the rule stays correct; find a printer’s IP address shows how to look it up.

Do not expose the printer to the internet

Never set up port forwarding from your router to a printer. A printer reachable from the internet can be found by anyone scanning for open ports, and CISA’s advice on network devices is to limit who can reach and manage them. If you need to print while away, use the maker’s cloud printing service or a VPN to your home network instead.

Checking a port from a computer

To see whether a printing port is reachable, PowerShell on Windows has a built-in test:

Test-NetConnection 192.168.1.20 -Port 631

Replace the address with your printer’s. TcpTestSucceeded : True means the port is open. On a Mac or Linux, nc -vz 192.168.1.20 631 does the same where nc is installed. A closed port usually means the protocol is disabled on the printer or something is blocking it.

Turning off ports you do not use

Most printers let you switch protocols off in their web settings, often under Network, Protocol or Services. Turning off what you never use, such as LPD or FTP printing, reduces what is reachable on the network. Leave IPP and Bonjour/mDNS on if you print from phones, Macs or Chromebooks, because their automatic printing depends on them. Print a test page from each device after any change.