Help with setting up an "IOT" network so my printer can't access the Internet

callmesteve · January 3, 2026, 11:30pm

Hello!

I have a new project I’m having trouble with. I have a network printer that recently got firmware updates that bricked my third party cartridges and I’d like to isolate it so it can only talk to my LAN.

I could fairly easily set up a traffic rule to block its MAC address, but I wanted to futureproof things by creating a network for it and my new KVM switch. I followed OneMarcFifty’s tutorial (How to configure OpenWrt as Firewall for your home network and Guest Wifi and IPTables explained - YouTube) but had to forward the IoT zone back to LAN or the printer wouldn’t work at all.

I have done this, but the printer can now only be detected manually and the scanner (Gnome simple-scan) won’t work now (it’s an older HP MFP - the company sucks now, but at the time it was and remains a good machine). I’m also looking to upgrade, maybe to a Canon or Brother, so using HPLIP to enable scanning is a short-term solution.

Can you take a look at my networking configs and let me know where I’ve gone wrong, or if I need something else? I suspect it has something to do with discovery, mDNS, or maybe asymmetric networking (but the zones are forwarded to each other??)… I don’t know how to fix it.

I am fairly sure I should be able to have these be in the same subnet as long as the DHCP addresses don’t overlap, or maybe reuse the LAN DHCP server for the IoT network (akin to a bridged AP, but on the same device?), but every time I’ve tried to change this further, I get locked out of the router and the network goes down, so clearly my understanding is lacking.

Thanks!

-Call Me Steve

/etc/config/network


config interface 'loopback'
	option device 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option ula_prefix '1234:5678:9abc::/48'
	option packet_steering '2'

config device
	option name 'br-lan'
	option type 'bridge'
	list ports 'lan1'
	list ports 'lan2'
	list ports 'lan3'
	list ports 'lan4'

config interface 'lan'
	option device 'br-lan'
	option proto 'static'
	option ipaddr '192.168.1.1'
	option netmask '255.255.255.128'
	option ip6assign '60'

config interface 'wan'
	option device 'wan'
	option proto 'dhcp'

config interface 'wan6'
	option device 'wan'
	option proto 'dhcpv6'

config interface 'IoT'
	option proto 'static'
	option device 'IoT'
	option defaultroute '0'
	list ipaddr '192.168.1.128/25'

config device
	option type 'bridge'
	option name 'IoT'
	option bridge_empty '1'

/etc/config/firewall


config defaults
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option synflood_protect '1'
	option flow_offloading '1'

config zone
	option name 'lan'
	list network 'lan'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'
	option masq_allow_invalid '1'

config zone
	option name 'wan'
	list network 'wan'
	list network 'wan6'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option masq '1'
	option mtu_fix '1'

config forwarding
	option src 'lan'
	option dest 'wan'

config rule
	option name 'Allow-DHCP-Renew'
	option src 'wan'
	option proto 'udp'
	option dest_port '68'
	option target 'ACCEPT'
	option family 'ipv4'

config rule
	option name 'Allow-Ping'
	option src 'wan'
	option proto 'icmp'
	option icmp_type 'echo-request'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-IGMP'
	option src 'wan'
	option proto 'igmp'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-DHCPv6'
	option src 'wan'
	option proto 'udp'
	option dest_port '546'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-MLD'
	option src 'wan'
	option proto 'icmp'
	option src_ip 'fe80::/10'
	list icmp_type '130/0'
	list icmp_type '131/0'
	list icmp_type '132/0'
	list icmp_type '143/0'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Input'
	option src 'wan'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	list icmp_type 'router-solicitation'
	list icmp_type 'neighbour-solicitation'
	list icmp_type 'router-advertisement'
	list icmp_type 'neighbour-advertisement'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Forward'
	option src 'wan'
	option dest '*'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-IPSec-ESP'
	option src 'wan'
	option dest 'lan'
	option proto 'esp'
	option target 'ACCEPT'

config rule
	option name 'Allow-ISAKMP'
	option src 'wan'
	option dest 'lan'
	option dest_port '500'
	option proto 'udp'
	option target 'ACCEPT'

config zone
	option name 'IoT'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'
	list network 'IoT'
	option masq_allow_invalid '1'

config forwarding
	option src 'lan'
	option dest 'IoT'

config forwarding
	option src 'IoT'
	option dest 'lan'

/etc/config/dhcp


config dnsmasq
	option domainneeded '1'
	option localise_queries '1'
	option rebind_protection '1'
	option rebind_localhost '1'
	option local '/lan/'
	option domain 'lan'
	option expandhosts '1'
	option cachesize '10000'
	option authoritative '1'
	option readethers '1'
	option leasefile '/tmp/dhcp.leases'
	option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
	option localservice '1'
	option ednspacket_max '1232'

config dhcp 'lan'
	option interface 'lan'
	option start '2'
	option limit '100'
	option leasetime '12h'
	option dhcpv4 'server'
	option dhcpv6 'server'
	option ra 'server'
	list ra_flags 'managed-config'
	list ra_flags 'other-config'

config dhcp 'wan'
	option interface 'wan'
	option ignore '1'

config odhcpd 'odhcpd'
	option maindhcp '0'
	option leasefile '/tmp/hosts/odhcpd'
	option leasetrigger '/usr/sbin/odhcpd-update'
	option loglevel '4'
	option piofolder '/tmp/odhcpd-piofolder'

config dhcp 'IoT'
	option interface 'IoT'
	option start '129'
	option limit '100'
	option leasetime '12h'
	option ra 'server'
	option dhcpv6 'server'
	option force '1'

/etc/config/wireless (unfortunately, some of my devices, including the printer, don’t support wpa3)


config wifi-device 'radio0'
	option type 'mac80211'
	option phy 'wl0'
	option band '2g'
	option channel 'auto'
	option htmode 'HT20'
	option cell_density '0'
	option country 'US'

config wifi-iface 'default_radio0'
	option device 'radio0'
	option network 'lan'
	option mode 'ap'
	option ssid 'LANSSID'
	option encryption 'psk2'
	option key 'LANPASS'
	option wpa_disable_eapol_key_retries '1'

config wifi-device 'radio1'
	option type 'mac80211'
	option phy 'wl1'
	option band '5g'
	option channel 'auto'
	option htmode 'HE80'
	option cell_density '0'
	option country 'US'

config wifi-iface 'default_radio1'
	option device 'radio1'
	option network 'lan'
	option mode 'ap'
	option ssid 'LANSSID'
	option encryption 'sae'
	option key 'LANPASS'
	option ocv '0'
	option wpa_disable_eapol_key_retries '1'

config wifi-iface 'wifinet2'
	option device 'radio0'
	option mode 'ap'
	option ssid 'IOTSSID'
	option encryption 'psk2'
	option key 'IOTPASS'
	option wpa_disable_eapol_key_retries '1'
	option network 'IoT'

Mijzelf · January 4, 2026, 7:39am

option ipaddr '192.168.1.1'
option netmask '255.255.255.128'

list ipaddr '192.168.1.128/25'

You basically created 2 subnets, 192.168.1.0/25 and 192.168.1.128/25. Those are as different as 192.168.0.0/24 and 192.168.1.0/24. mDNS doesn’t cross subnets, so your printer is basically isolated. You could try to run an avahi-daemon.

lleachii · January 4, 2026, 11:35am

I doubt MAC address will dissappear in the [near] future. Nonetheless, this is an interesting endeavor.

callmesteve · January 6, 2026, 10:13pm

MAC is both fakeable (do I think it likely? no, but…) and I’d like if this entire Wi-Fi network were isolated rather than needing to manually configure clients (especially if I later change how I connect them).

Right, I was beginning to suspect it was mDNS - but I did (or think I did?) set it to use the same broadcast address for both networks though. I’ll look into the Avahi daemon, but…

At risk of asking a stupid question, is there a way to do this with one subnet? I’d like to understand better what’s going on or the limitations here, and why what I’ve tried has failed so excitingly. I’m not super familiar with what things “just work” in networking or why things are the way they are.

…I’ve tried using the same subnet with different DHCP server IP ranges and start addresses (got locked out), or ignored DHCP server, or even the IoT interface as DHCP client (I presumed in both cases I could get it from the forwarded LAN zone), but neither of those latter attempts let me get an IP address on the IoT network.

I’ve also heard of Policy-Based Routing as a solution mentioned in one forum post about scanner issues with SANE, but I don’t quite fully understand how to configure it or what makes it different.

I see there’s the “Prioritize Local Subnets” guide, but… what does it do?

callmesteve · January 7, 2026, 12:40am

Okay, I’ve read the Avahi article, but I have a question about the OpenWRT package names.

Apparently, the plain “avahi-daemon” isn’t available anymore.

Am I looking at “avahi-dbus-daemon” since the article mentions also enabling dbus?