MFP M283cdw - How to completely restrict access to Embedded Web Server

[jasonjam]

My printer (LaserJet Pro MFP M283cdw) is on a network with multiple VLANs. I would like to allow all VLANs to scan, print and FAX, but limit which VLANs/PCs can access the device's embedded web management pages through a browser.  I've established an admin password on the web page, but I'd like the pages to be completely inaccessible to chosen VLANs.  Is there any way I can provide normal device operations (printing, etc.) to a PC/PC Group but completely deny browser access to it?

My original intent was to selectively block port 80 and 443 on my network firewall, but I discovered that the printer performs its primary operations (printing, scanning, etc.) over these ports.  I see settings for ACL and Firewall in the printer's embedded web server, but I don't have documentation on the implications of these settings, so it isn't clear if they will help solve my concern.

Thank you.

[Garp_senchau]

@jasonjam, Welcome to HP Support Community,

Thank you for posting your query; I’m here to help by guiding you through steps to resolve this issue

Understand Printer Ports and Services

• Ports for Printing and Scanning: The printer uses ports 80 (HTTP) and 443 (HTTPS) for its web interface, but printing, scanning, and faxing services generally use other ports.
  • Printing: Typically operates over port 9100 (RAW printing), port 515 (LPR), or port 631 (IPP).
  • Scanning: Generally uses ports like 137-139 (NetBIOS), 445 (Microsoft SMB), or ports for specific protocols (like FTP, SFTP, or WSD).
  • Faxing: Over a phone line, independent of the network ports.

By blocking port 80 and 443 on certain VLANs, you prevent browser-based access but allow print and scan functionality to continue over other ports.

Use Access Control Lists (ACLs) on the Printer

The LaserJet Pro MFP M283cdw printer has an embedded web server where you can configure certain access settings, including using ACLs (Access Control Lists). You can restrict HTTP and HTTPS access via ACLs, while still allowing printing, scanning, and faxing to continue.

1. Log in to the printer’s web interface using the admin credentials.
2. Go to the Security settings.
3. Look for Access Control or Firewall Settings in the web interface.
4. Here, you will find options to define IP address ranges or VLANs allowed or denied access to the printer’s embedded web management interface.
   • Deny specific VLANs/PCs: You can deny access to the web management pages by specifying IP address ranges (for specific VLANs/PCs) that should not have access.
   • Allow all VLANs except those specified: If the printer’s firewall or ACL settings allow you to configure access based on IP address ranges, you can specify which VLANs (or individual devices) should be denied access to the web management pages while allowing others.

Make sure the web interface is accessible only to trusted VLANs (e.g., management VLAN) while keeping others restricted.

Configure Network Firewall to Block Web Management Ports

While your printer's primary functions like printing and scanning happen on other ports, you can block HTTP (port 80) and HTTPS (port 443) for the specific VLANs that shouldn’t access the embedded web server.

Set Up VLAN-specific firewall rules:

• Block ports 80/443 for the VLANs/PCs that shouldn't access the web interface.
• Allow other ports used by the printing and scanning functions (such as port 9100, 515, or 631 for printing).

Test connectivity after applying the firewall rules to ensure that:

• The restricted VLANs can still print and scan.
• The blocked VLANs cannot access the printer's web interface.

[Garp_senchau]

Check Firewall Settings on Printer Embedded Web Interface

The LaserJet Pro MFP M283cdw allows you to configure a firewall from the printer’s web management interface, which can further restrict which IP addresses or IP ranges can access certain services. You can configure this as follows:

1. Log into the printer’s Embedded Web Server.
2. Navigate to Security or Network Security.
3. Look for a section on Firewall settings.
   • Enable Firewall: This allows you to block access from certain IP ranges.
   • Configure ACLs: If you want to block access to the web interface (ports 80/443) for certain IP ranges while allowing printing and scanning, configure the firewall to block HTTP and HTTPS for those ranges but allow other ports.

Test the Configuration

Once you’ve set up the access control lists (ACLs) and firewall rules on the printer and the network firewall:

Test print and scan functionality:

• From a PC on a restricted VLAN: Ensure that printing, scanning, and faxing still work, but the web interface cannot be accessed.
• From a PC on an allowed VLAN: Confirm that the user can access both the printer’s web management interface and perform printing, scanning, and faxing operations.

Verify access to the web interface:

• From a restricted VLAN: Try accessing the printer's web management pages via a browser (both HTTP and HTTPS). They should be blocked.
• From an allowed VLAN: Confirm that the web interface is accessible with the proper admin credentials.

Review Documentation

If you're uncertain about the firewall or ACL settings, you can refer to the printer's user guide for detailed instructions on how to configure these settings properly.

I hope these steps help resolve the issue

Please feel free to reply here if you have any questions or if you need further clarification on any of the steps. 

Take care and have a good day. 

Problem solved? 🎉 Awesome! Mark this as the Accepted Solution to help the next person find their way faster. 🧭 And if it was helpful, click 'yes'—you’ll make someone’s search journey that much easier (and give this reply some well-deserved street cred 🏅)

Regards,