Which IP ports to allow

Bambu Lab Software
1

Grumpy old security-concerned European here again…

On my firewall (which happens to be an OPNsense but this does not really matter) I usually block all ports unless needed. This means for example for web browsing a client inside the network only needs ports 443 (and maybe 80). This gives a bit of additional security against a device inside the firewall not acting ad part of a bot net or whatever.
From what I already found with my default settings my P1P cannot establish a connection. And in a live view of blocked actions I see attempts using ports 8883 and 2021 (one of them TCP and the other UDP). Although I already opened these ports, So for the time being I set up an additional network zone plus Wi-Fi where the printer is allowed to use whatever port it wants. This is not an acceptable permanent solution for me.

Is there an overview which ports one has to open for the various softwares (Slicer, Handy, printer) in order to work? As the “LAN mode” does not work over the boundaries of one zone to another and I like to use different zones for different device classes I am more or less dependant on using “Cloud mode”.

2

I did a port scan of my X1C and it is using 1883 for MQTT protocol (although perhaps if you see 8883 in use that means MQTT is in use over SSL). Port 3000 is also open but not sure why. FTP over port 21 was being used but I think this was LAN only mode.

3

Using Tryda as a vpn and I didn’t have to even look at my router to get remote access to the X1. Can connect from anywhere using my phone and my laptop at home.

4

Has Bambu provided a port listing? I am uncomfortable opening MQTT ports since I use MQTT internally on my network for other devices.

5

At least I did not find one. As for opening, is your firewall able to restrict opening ports only for dedicated IP addresses (after setting your DHCP server to always assign the same address to your BBL printer/s)?

6

My apologies, I meant to type Tailscale not tryda.

7

the is a list of ports in the Bambu Lab Wiki. See: Printer Network Ports | Bambu Lab Wiki

The best solution would be:

  1. assign the printer a fixed IP address by using a reservation or fixed address in your DHCP server. This makes the DHCP server assign the same IP address to the printer.
  2. create outbound firewall rules with the fixed IP address and the ports listed on the Wiki. You only need to use the ports mentioning cloud.
  3. If your firewall supports rules which filter on established outbound connections, use that option to allow the traffic from the cloud back in.

NEVER allow unconditional traffic in. Traffic should only allowed in if there is an outgoing traffic stream.

Kind regards,
Gwenda