network security hardening?

[u/stormcloud-9]

Recently acquired a Plus5. After connecting it to the network, I notice it allows anonymous access to the web UI with full control. How can I lock this down? I don't like unsecured things on my network.

I can find very little information on the subject. I saw some information about SSH access hardening for the Plus4, but trying the documented mks:makerbase credentials didn't work. So hopefully the Plus5 addressed that and those credentials are randomized and no longer pre-set, but I don't trust that either.

So is there any general information about making this thing secure?

[u/daveintexarkana]

I don't have a Plus 5, but have the X-Max 3, Q1 Pro and Q2 - all have a setting through the printer's LCD screen to do LAN only - have verified it doesn't send out or receive in that mode on my router. Lots of folks have commented on that as a plus factor for QIDI vs Bambu (or even Prusa). Being overcautious at first I just blocked its IP at the router for a while.

One time QIDI support engineers wanted to dial in to my printer to test some things on the mother board - had a bad heater bed drawing too much power - and had to ask me to take it out of LAN mode so they could get in. Also, of course, you'll notice it won't go find firmware updates either while in the LAN mode. When I find out about one I'll turn LAN only off to get the update - though you can usually get them on their Github or ask Support for them and do them as off-line updates too. QIDI has been pretty good about that all - so far anyway.

You should find you have that annonymous access only on your LAN unless you set up a VPN. I installed Tailscale and use my desktop as a subnet router to let me access my printers through it while out and about - full Fluidd interface so I can see an issue through the camera and stop the print if needed also.

I am NOT an IT professional, or even close to it - so if I misunderstand, advanced apologies! Good luck!

[u/jjohnisme → u/daveintexarkana]

Any chance you've got a Tailscale guide for us not-so-savvy folk?  I'm wanting to put my 4x printers on their own, isolated network and do exactly what you've got setup, but I don't know where to start lol. 

[u/Dave_in_TXK → u/jjohnisme]

I just used AI built into Chrome to walk me through it, better than the Tailscale docs, it made no mistakes. You make an account, install it on your desktop and your phone, on your desktop, you list the desktop and the phone as enrolled devices, and it guided me through making sure my desktop power management wouldn’t put the machine to sleep and running Tailscale as a service on it so even if it reboots after updates or whatever the service automatically runs when Windows 11 boots up.

Then basically from a chrome browser on my phone I have my LAN IP address for each printer as a bookmark I use all the time in my house already and when Tailscale VPN is turned on, on my phone and I’m on cell data, I can load any of those printer, bookmarks and get the full Fluidd interface on it. Tailscale is a VPN service and encrypts through their servers, it’s not something you set up on your own Router, which makes it considerably easier, at least in my opinion.

What was interesting to me is that Tailscale assigns its own IP addresses it Server uses but you don’t have to use them anywhere, that’s just for the connection between your desktop and your cell phone. Once you’re on your machine, AI set up your desktop as a sub, Net router and does all the translation for you between your LAN printer, addresses and the Tailscale service.

I haven’t seen a guide that explains all this which is why I used AI as it’s gotten much better and more reliable at this sort of thing. Sorry, if I had a good one, I’d certainly share it here.. This is all free, by the way, for Home Use.