The printer is not found

The printer is on, has an address and prints a test page. But it is not in the list on the laptop, or it is there and says "offline". Often it started right after you introduced VLANs, or after the printer moved to another socket and another network port.

What it usually is not: the printer itself. If you can open its web page on its IP address, the device is fine and this is a network question. If you cannot open that page, it is an addressing or routing question and this is still the right chapter, you just start at step 2.

The quick checks, in order

1. What address does the printer have, and which network is it from? /ip dhcp-server lease print on the router. If the printer is on 192.168.20.30 and your laptop on 192.168.10.45, they are in two networks and that is your answer.
2. Can you reach it by typing the address? Ping from the laptop, or from the router itself: /ping 192.168.20.30. A good answer is simply an answer. If the router can and the laptop cannot, the firewall is blocking traffic between the two networks.
3. Does the printer's own page open? If http://192.168.20.30 works in a browser but Windows or macOS does not find the printer by itself, this is not a reachability problem but a discovery problem. That is the most common case and the subject of this chapter.
4. Is anything being dropped? /ip firewall filter print stats. You are looking for a drop rule whose counter rises while you try to print. Rules the tool generates for traffic between VLANs carry a comment starting with matrix:.
5. Is the printer on the port you think it is? /interface bridge host print where mac-address=..., or find it with /ip arp print. A printer on a port with the wrong untagged VLAN is a classic.

The usual causes, most common first

The printer is in a different VLAN from the laptop

By far number one. Printing itself goes over a TCP port and crosses a network boundary quite happily, but finding the printer happens with mDNS (Bonjour, AirPrint) or WSD, and those are multicast and broadcast messages, which by definition are not routed. Inside one network it works, across the boundary it does not.

Three fixes, easiest first: put the printer in the same VLAN as the people who print; or add the printer by hand on its IP address, with a fixed address so it keeps working; or run an mDNS relay on a machine that sits in both networks. The router does not do that last one for you.

The firewall does not pass traffic between the networks

Even with a manually configured IP address the router still has to forward it. In a setup with VLAN isolation a network may reach the internet and not its neighbours by default. You need a rule that allows the office network to reach the printer network.

The printer is on Wi-Fi with client isolation on

Client isolation means devices on that SSID cannot see each other. A printer on a guest or IoT network with isolation is invisible to everyone, including devices on the same SSID.

The printer got a new address

A printer on DHCP that has been switched off for a while can come back with a different address. The laptop is still looking for the old one. Always give network printers a fixed lease.

The VLAN does not reach the printer

The switch the printer hangs on does not carry the VLAN, or the port is a trunk where it should be an access port. Then the printer gets power and no network, or an address from the wrong range.

What the configurator does about it

• The Firewall section has Traffic between VLANs. Set to "matrix" you get a table where you tick, per pair, who may start connections to whom. That is where you give the office network access to the printer network. The generated rules are recognisable by their matrix: comment.
• Each VLAN in the VLANs section has an Isolated tick. With that on, the network talks only to the internet. A printer in an isolated VLAN is unreachable on purpose.
• The tool reports it as an error when the first VLAN in the site table is marked isolated, because wired ports default to that first VLAN. Your whole wired network, printer included, would land on the guest network.
• Draw the cabling on the network board and put the printer on it as a client node with a VLAN, and the check reports it when the switch it is cabled to does not carry that VLAN. The same check reports a VLAN that stops at a cable because the device on the far end does not know it.
• The firewall the tool writes deliberately leaves multicast on the LAN alone. The bogon rule that drops 224.0.0.0/4 is applied on the WAN side only, precisely because the same rule on every interface kills mDNS, SSDP and therefore printer discovery on the LAN.
• Client isolation is a per-SSID toggle in the Wi-Fi section.

The honest limits

The tool has no mDNS repeater and no relay for Bonjour or WSD, and RouterOS does not have one in the main package either. Discovery across a VLAN boundary is therefore something you solve with fixed addresses or a separate piece of software, not with a tick box. Beyond that, the printer can be its own obstacle: some models sleep so deeply that they miss a discovery request, and a printer driver that insists on going through the manufacturer's cloud gains nothing from your network at all.

Read on: Recipe: network printer, VLANs and Firewall.