Printer on a Different Subnet or VLAN: How to Print Across

Splitting a home or small office into separate networks is good practice: a guest network for visitors, an IoT network or VLAN for smart plugs and cameras, or a second router for a home office. Then the printer disappears. Laptops cannot find it, phones show “No AirPrint printers found”, and yet the printer is clearly online. This guide explains why a printer on a different subnet cannot be discovered, and the three ways to make printing work across networks without undoing your security.

This is an independent guide. We are not affiliated with any router, network or printer maker.

Why the printer disappears

Modern printers and devices find each other with multicast DNS (mDNS, also called Bonjour) and DNS-SD service discovery. RFC 6762, the standard for multicast DNS, says these queries go to the link-local multicast address 224.0.0.251 (and FF02::FB on IPv6) on UDP port 5353, and that names ending in .local are meaningful only on the link where they originate.

In plain terms: discovery messages stay on one network segment. A router connecting two subnets or VLANs does not forward them, so a device on network A never hears the printer on network B announce itself.

The important point is that only discovery stops at the boundary. The actual print job is ordinary network traffic (IPP on TCP 631, or raw printing on TCP 9100), which a router can route between networks if its rules allow it. That is why the first fix is so effective.

Common situations that create two networks

• IoT or smart home VLAN. Many routers and mesh systems now offer a separate network for smart devices. A printer placed there is invisible to laptops on the main network.
• Guest network. Guest Wi-Fi is usually isolated on purpose. Our guest Wi-Fi printing guide covers the safe ways to let visitors print.
• A second router or an extender in router mode. Two routers in a row create two subnets with double NAT. See printer on mesh Wi-Fi and printer with a Wi-Fi extender.
• Office VLANs. Small offices often separate staff, guests and devices. The fixes are the same, but ask whoever manages the network.

To check, compare IP addresses. On a typical home network, if your computer is 192.168.1.x and the printer is 192.168.20.x, they are on different subnets. Our guide to finding a printer’s IP address shows where to look.

Fix 1: add the printer by IP address (computers)

This works for Windows, Mac, Linux and Chromebook, and needs no special router feature.

1. Reserve the printer’s address in the router’s DHCP settings so it never changes.
2. Allow the traffic. If your router has rules between networks (common with VLANs and IoT networks), allow your computers to reach the printer’s IP address on TCP 631 for IPP, or TCP 9100 if you will use raw printing. Allow the replies too; most routers do this automatically for established connections. Our printer network ports guide lists what each port is for.
3. Test the connection. On Windows, Test-NetConnection 192.168.20.15 -Port 631 should report TcpTestSucceeded : True.
4. Add the printer manually on each computer:
   • Windows 11: Add device, then Add manually, then add by IP address. See add a printer in Windows 11.
   • Mac: Add Printer, the IP tab, protocol IPP. See add a printer on Mac.
   • Linux: lpadmin with an ipp:// address and the IPP Everywhere model. See add a printer from the Linux command line.

Once added, printing works exactly as before. Scanning from the computer may also need the printer’s web ports (80 or 443) allowed, because driverless scanning and the printer’s settings page use them.

The double NAT case

With two routers in a row, the direction matters. Devices behind the second router can usually reach a printer on the first (outer) network by IP address, because their traffic goes out through the second router like any other connection. Devices on the outer network cannot reach a printer behind the second router without port forwarding on it. If you can, put the printer on the outer network, or switch the second router to access point or bridge mode so there is only one network.

Fix 2: reflect discovery between networks (phones and tablets)

Phones are the hard part. AirPrint finds printers through Bonjour discovery, and iPhones and iPads have no option to type in a printer’s IP address. Android’s Mopria and default print services also rely on discovery. For them, discovery has to cross the boundary.

The tool for this is an mDNS reflector (also called an mDNS repeater or proxy). Many routers, firewalls and mesh systems have it as a setting, often named mDNS, Bonjour gateway, multicast DNS reflector or similar. On a Linux machine connected to both networks, the Avahi daemon offers the same thing. Its manual describes the enable-reflector option as reflecting incoming mDNS requests to all local network interfaces, allowing clients to browse mDNS/DNS-SD services on all networks connected to the gateway. It defaults to off, and the manual warns not to run multiple reflectors between the same networks.

Two practical rules:

• Reflection only restores discovery. You still need the firewall rule from Fix 1 so that devices can send the print job to the printer.
• Limit what you reflect. Avahi’s reflect-filters option can restrict reflection to named services; routers often let you choose which networks to bridge. Reflect only between the networks that need the printer.

After enabling it, test with print from iPhone and print from Android.

Fix 3: put the printer where the people are

If the networks were split for convenience rather than security, the simplest fix is to move the printer onto the main network, by changing its Wi-Fi network or the switch port it uses. Our guide to connecting a printer to a new Wi-Fi network covers this. Everything then works automatically again.

Security notes

Isolating devices is sensible, and printers are network devices with their own software and web pages. CISA’s guidance on network devices is to limit who can reach and manage them. When you open a path to the printer:

• Allow only the printing ports, and only to the printer’s single IP address.
• Change the printer’s admin password and keep its firmware up to date.
• Never forward printer ports from the internet to the printer.

Quick troubleshooting

• Computers print, phones do not see the printer: mDNS reflection is missing or blocked.
• Phones see the printer, but jobs fail: reflection works, but the firewall blocks TCP 631 to the printer.
• Worked yesterday, not today: the printer’s address changed. Reserve it in the router.
• Everything fails: check that the router actually routes between the networks; some guest networks are fully isolated and cannot be opened at all.