PrintLinkDeployment topology
What to do when the printer is not on the user's computer: the three connection paths, their risks, and how to choose.
Last updated
PrintLink is installed on the computer with the printer. That is usually the user's own computer, in which case no deployment decision exists. This page is about the other case.
Remember one thing first
A web app on the public internet ≠ PrintLink exposed to the internet. The
user opens https://erp.example.com in a browser; the page reaches PrintLink on
the same computer over 127.0.0.1, and paper comes out locally. That most
common "internet business app + local printing" case needs no topology decision
at all.
The three paths
| Path | Listen scope | Typical scenario | Risk |
|---|---|---|---|
| Local (default) | Local connections only | The page and the printer are on the same computer | Low; no network port exposed |
| LAN | An explicitly chosen private address + source allow-list | One workstation holds the printers; computers on the same subnet share the output (warehouse, store, production line) | Medium; reachable from the subnet |
| Controlled remote | A public address, or reached through a VPN / reverse proxy | Central print nodes, managed enterprise networks | High; transport protection and identity control required |
LAN and remote both include the local path (which always works); they widen access step by step.
How to choose
Is the printer on the user's own computer?
Yes → use the default local path with no configuration. Whether the page is
hosted publicly, on an intranet or locally, it connects over 127.0.0.1. Done.
No → continue.
Is the printer's computer on the same LAN as the user?
Yes → install PrintLink on that computer and follow LAN print workstation; point the page's endpoint at that workstation.
No → continue.
Can you provide a VPN or an HTTPS reverse proxy?
Yes → deploy as described in controlled remote access. Prefer having remote terminals join the LAN over a VPN and use the LAN path; only open the public internet if that is genuinely impossible, and then the proxy must provide TLS.
No → do not open the public internet. Instead put a computer running PrintLink where the printers are and have the operator open your web app on that computer (back to the default path), or wait until a controlled option is available.
Do not open the public internet as a first move
"Bound successfully" only means the local listener started — it does not mean the service is reachable from the internet, nor that any page has been granted printing. PrintLink provides no built-in TLS, so the public scope means plaintext connections; port forwarding, firewalls, certificates and DNS are all the deployer's responsibility.
Common combinations
| Where the app runs | Where the printer is | Recommended |
|---|---|---|
| Public SaaS | The operator's computer | Default local path |
| Intranet ERP | The operator's computer | Default local path |
| Public or intranet page | A shared warehouse workstation | LAN on the workstation + source allow-list |
| Head-office system | A branch print node | Join the branch network over VPN, then use LAN |
| A remote service process (Node / Java / .NET) | Anywhere | Not supported yet, see controlled remote access |
What applies on every path
Widening network reachability does not skip any other check; four layers are independent:
- Listen scope — which addresses the service accepts connections on (console Settings);
- Source allow-list — which subnets may connect (console Security & sites);
- Pairing — which pages are allowed to call at all (the user confirms on the computer);
- Interface permissions — what that page may actually do (print / preview / read…).
Adding 192.168.1.0/24 to the allow-list, for example, still requires those pages
to be authorised and to hold the print permission. See
security.
Next steps
HTTP interface
Using printlink.v1 over HTTP: POST /rpc shares one port and one message shape with the WebSocket, for mobile apps, native desktops and servers.
LAN print workstation
One machine holds the printers and computers on the same subnet share the output: configuration, browser limits and rollback.