Kernaali ToolsIf a printer or media device appears on its own VLAN but disappears from another, check discovery and the later service connection separately. An mDNS proxy can make a service visible; it does not automatically authorize the client to use the advertised address and port.
Applies to: UniFi Network application with a supported UniFi Gateway mDNS proxy and routed client/device VLANs. Current Help Center configuration modes are used; older application interfaces may differ. This is an mDNS workflow, not a universal solution for SSDP, vendor cloud discovery or every casting protocol.
Validation: documentation-checked on . No device or lab test is claimed. Version references identify the documentation checked, not a firmware upgrade recommendation.
Establish a same-VLAN control test
Use one authorized client and one service device. Confirm discovery and the actual application work on the device VLAN before changing inter-VLAN policy. If they already fail locally, inspect Wi-Fi client isolation, device service settings and local multicast transport first. A cross-VLAN proxy cannot repair a device that does not advertise its service.
Synthetic topology: a trusted client is in 192.0.2.0/24 and a printer in 198.51.100.0/24. Identify the exact service type and the address/port it advertises. Keep the test’s device identifiers private.
Choose the smallest discovery scope
The official mDNS proxy guide describes Auto, Off and Custom modes. Auto shares broadly across networks; Custom selects participating networks and services. Include only the trusted client VLAN and required device VLAN. Do not include Guest merely to make a test pass.
Check the service identifier in the documented form, such as _service._protocol.local, against the actual device advertisement. Advertising an unrelated service type will not make the desired function appear. Verify your gateway’s documented proxy limits rather than assuming every model supports the same number of networks.
Follow the discovery result to the application
| Observation | Next branch |
|---|---|
| No query or advertisement on the source VLAN | Check local service and multicast/client-isolation behavior |
| Local discovery works; no remote advertisement | Check proxy mode, selected networks/services and VLAN transport |
| Remote service appears but connection times out | Inspect the advertised address/port, routed policy and return traffic |
| Only one feature of the device works | Identify that feature’s separate discovery or service dependencies |
| Guest unexpectedly sees the device | Remove unintended discovery participants and review access policy |
Capture only the relevant short discovery exchange if needed. A visible name can advertise an unreachable address, including an address from the wrong interface. Test the selected service from the actual trusted client, not only a ping from the gateway.
Permit the required service without expanding trust
If discovery succeeds but the application is blocked, add only the intended controller-to-device destination and service to the active policy model, with the required return-state handling. The existing isolation guide explains how gateway rules, switch ACLs and AP client isolation act at different places. Do not remove every IoT restriction or assume a reverse new-session permit is required for replies.
Record the old proxy mode, network/service selection and each edited rule. Change one layer at a time with independent management access. Restore those exact values if discovery leaks into unintended networks or the service still fails. Stop temporary captures after testing.
Verify useful access and retained isolation
Print a test page or complete the intended media transaction. Then verify that a Guest client cannot discover or use the service when that is the policy, and that the IoT device cannot initiate unrelated connections into the trusted network. These negative tests matter as much as seeing a device name in a menu.
Choose the right isolation control · Read the source/destination zone policy · Verify client VLAN transport
Technical references
Found an issue? Send a correction with a reproducible example.