🌱 This how-to guide provides the very fundamental configuration to get a (Brother) IPP network printer working in Qubes OS.
What is IPP Everywhere™ (driverless printing) and why should I pick a IPP printer? What printer supports IPP?
For the ease of use and to avoid typing errors, I do not put all command in dom0 to benefit from copy & paste some code lines directly to the templateVM and appVM. To keep things minimal and avoid messing up your default templates, we are going to use a Debian minimal template as a baseline (the 'deb-12-m-printer' will be a clone of it).
There are additional printer features to discover (i.e. IPPS encrypted printing) and more Qubes OS configuration you can do (i.e. disposable printer qube). Feel free to extend this guide with additional configuration options. 🤝
Software: ✅ Qubes OS 4.2.2 ✅ Debian 12 (debian-12-minimal) ✅ cups 2.4.2
Hardware: ✅ Brother-HL-L2375DW with 'Generic IPP Everywhere Printer [en] recommended' printer driver (available in cups package) ✅ ...
With a very high probability, it should also work with newer versions and other IPP-compliant hardware. Feel free to add additional printers and update new software versions if you have successfully configured your printer based on this guide.
Login to your router admin console and set a fix IP address for your printer. (i.e. 192.168.178.1) Restart your printer and verify that the IP is properly set and it is accessible within your local network (send pings, open the browser web-interface etc.).
Open a dom0 terminal (and keep it open):
dxy=$(qvm-template list --available | grep -Eo "debian.*minimal" | tail -n 1 | grep -Eo "[0-9]+")
src="debian-${dxy}-minimal"
tpl="deb-${dxy}-m-printer"
app="printer"
qvm-template install ${src}
qvm-clone ${src} ${tpl}
qvm-create ${app} --template ${tpl} --label red
open the deb- * -m-printer (template) terminal from the dom0 terminal:
qvm-run --pass-io --user root ${tpl} xterm
apt update && apt upgrade --yes
apt install --no-install-recommends qubes-core-agent-passwordless-root qubes-core-agent-networking qubes-core-agent-nautilus qubes-pdf-converter qubes-img-converter qubes-app-shutdown-idle cups system-config-printer nautilus evince eog xfce4-notifyd dunst pdftk --yes
exit
qvm-shutdown ${tpl}
qvm-service ${app} cups on
You must ensure that you have access to your local (printer) network either by routing your 'printer' qube to a separate (local) network qube or by a VPN split tunnel configuration.
qvm-prefs ${app} netvm <sys-firewall-local-network>
open the printer (appVM) terminal from the dom0 terminal:
qvm-run --pass-io --user user ${app} xterm
sudo mkdir --parents /rw/config/qubes-bind-dirs.d
sudo mkdir --parents /rw/bind-dirs/etc/cups/
sudo cp --recursive /etc/cups/* /rw/bind-dirs/etc/cups/
echo binds+=\( \'/etc/cups/\' \) | sudo tee /rw/config/qubes-bind-dirs.d/50_user.conf
exit
qvm-shutdown ${app}
open the printer (appVM) terminal from the dom0 terminal:
qvm-run --pass-io --user user ${app} xterm
printer_name="Brother-HL-L2375DW" # modify to your configuration!
printer_IP="192.168.178.1" # modify to your configuration!
ping -c 1 -q ${printer_IP}
--- 192.168.178.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
ping test failed :man_facepalming:
--- 192.168.178.1 ping statistics ---
1 packets transmitted, 0 received, 100% packet loss, time 0ms
sudo usermod -aG lpadmin user
sudo systemctl restart cups.service
systemctl status cups
If an error or failure is displayed check the printer appVM qube Settings: Tab 'Services'. Cups should be listed and checked.
sudo lpadmin -p ${printer_name} -E -v ipp://${printer_IP}/ipp/print -m everywhere
qvm-shutdown ${app}
Back to the Q-menu: printer qube and launch Printer Settings You should see your printer (icon and printer name), right-click on it, make your final configurations (page size / format, dpi ...) and run a test page.
Troubleshooting: If you are facing issues to make the final printer configuration, i.e. a request to enter your username and password, launch the Printer Settings with sudo from the terminal:
sudo system-config-printer
Happy IPP printing :partying_face:
Limit the printer appVM to access the printer device only.
app="printer"
printer_IP="192.168.178.1" # modify to your configuration!
qvm-firewall ${app} del accept
qvm-firewall ${app} add accept dsthost=${printer_IP}
qvm-firewall ${app} add accept specialtarget=dns
qvm-firewall ${app} add accept proto=icmp
qvm-firewall ${app} add drop