Access my home network printer while I am using VPN to connect to work

Question

When I work from home, I am connected to the resources in my company via VPN. In my home network there is a network printer in the same local network.

The problem is that when I open VPN to my company, I cannot access my home network printer any more. So whenever I need to print, I have to disconnect VPN, print, reconnect the VPN. It's extremely annoying.

Is there any solution how to configure the stuff so I can access both the VPN and the home network printer at the same time?

While on VPN, I can normally print to the company printers and access public internet resources.

My network configuration (ipconfig) is like that:

Ethernet adapter Local Area Connection:

IPv4 Address. . . . . . . . . . . : a.b.c.d // my company IP address
Subnet Mask . . . . . . . . . . . : 255.255.255.255
Default Gateway . . . . . . . . . : 0.0.0.0

Wireless LAN adapter Wi-Fi:

IPv4 Address. . . . . . . . . . . : 10.0.0.101
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 10.0.0.138

And I can ping the local gateway 10.0.0.138, however I cannot ping my printer on 10.0.0.3. How is that possible?

Answer 1

What's happening here is that the VPN client is setting your default gateway to the VPN server. This means that all your LAN-destined network traffic is routed through the VPN, and the VPN server will dump the traffic since it is for a private, non-routable subnet (likely 192.168.x.x).

All you need to do is update your routing tables to send LAN traffic to your typical local gateway (i.e. your router). You would probably need to do this every time you disconnected & reconnected the VPN.

You would use the 'route print' command to view routing tables after connecting to the VPN. You would expect to see the default gw (0.0.0.0) destination as your VPN endpoint.

Making this change could indeed bypass some security 'policy' the IT department is attempting to enforce. I would also advise contacting your IT dept. to see if there is any issue with manually modifying the configuration on the system. No point in getting in trouble for something so minor.

[EDIT - additional info as requested]

[DISCLAIMER: modifying routing tables can mess up your access to the Internet or other networks. Changing settings related to a corporate VPN may violate company policy and result in disciplinary action. You've been warned, etc.]

After connecting to the VPN, confirm routing to your printer by running tracert MY_PRINTER_IP. If the routing hops go through the VPN endpoint, you've confirmed traffic for the printer is being routed there, and this is the issue.

route print would display existing routing tables, where you would expect to see the 0.0.0.0 (default gw) entry being directed to the VPN endpoint.

You would use the route ADD command to add an appropriate routing command for your printer. For example, to add an entry for just a single IP that you want to keep on the LAN, you could use:

route ADD MY_PRINTER_IP MASK 255.255.255.255 MY_LAN_ROUTER_IP

You may need to adjust metric on the route to ensure it is chosen first, although a more specific route generally always takes precedence. Repeating the tracert after the change should verify if routing has been updated and is working as expected. If all is good, you could add the routing rule as a static one with a '-p' flag on the ADD command, otherwise the rule is temporary and will be discarded on reboot. The VPN client may also nuke & rewrite all routing rules every time it is connected.

Answer 2

Although it may be possible to achieve this, using Split Tunnelling, it will almost certainly break your terms and conditions of use for the work network. In extreme cases, you could lose you job over things like that.

Remember that a VPN provides a secure link from your local machine or network to the remote LOCAL Area Network. This means that your machine behaves as though it were directly connected to the work LAN.

So allowing other local facilities to work is a security issue.

Your best bet is a direct (USB) connection to your computer from the printer.

UPDATE:

You could make your printer public by exposing it's interface via your router. But don't forget that, while on the VPN, it is most likely that your Internet access goes via the corporate firewall & gateway so printer ports are almost certainly blocked there. Again, allowing printing to the Internet is a massive security hole.

It is also possible to have a local printer on the VPN but only if your VPN endpoint is in your router rather than your PC (unlikely) making your local network part of the corporate network. Of course, in that case, you wouldn't need to do anything else since the printer would now be visible to the PC. This is unlikely to be allowed by your work, again because it opens up many opportunities for security issues.

Sorry but the most likely best bet is still to physically connect your PC to the printer the old fashioned way!

Answer 3

I have the same problem when working from home. My work provided a docking station that I can connect to the printer through USB so as long as I'm docked at my home desk I can easily print.

When I want to print and I'm not docked, I'm able to email the document to my HP computer through a specific email address that was given to me in the set-up process. Those seem to be the only "safe" solutions besides putting everything I want to print in a "to print" folder on my desktop and waiting to print them until I disconnect from VPN. (my VPN is very finicky and connecting/disconnecting multiple times has locked me out of my network before so I try to disconnect as minimaly as possible)

Answer 4

Install the printer using it's IP address. Windows allows you to do this under advanced printer options. Then your PC should still be able to locate the printer whether it is logged on to your local internet connection or to your VPN.

Answer 5

One way I was able to work around this without messing with routings or changing subnets was install the printer on another local PC at home, share the printer, install that shared printer on the laptop used for VPN. Set that shared printer as the default and then the printing worked successfully.

(This work around requires another computer to be on your local network)

Answer 6

Some modern printers can support two or more connection types at once (e.g. Samsung C3010dw): e.g., Ethernet and USB. If the printer is close enough to the local computer, you can create two logical printers (one for the network connection and one for the USB connection) for the printer. The USB printer can be used while vpn connection is active (or not), but remain available (via the Ethernet connection) to other computers on the local network.

In theory, though I have not tested, the IOGEAR GUWH104KIT can be used for the USB connection if distance is an issue or you can add additional GUWH104 receivers if you need to connect via USB to multiple computers.