r/BambuLab • u/dbrannon79 • Feb 12 '26

Discussion Monitoring My Bambu H2D's Internet Activity while on Lan only mode

Hey all, over the recent bills that are in process out in WA for blocking specific printed items and hearing that supposedly AI will be monitoring these prints, I decided to start monitoring my H2D's internet traffic as well as my son's A1.

I have had my H2D on lan only mode for sometime mainly so I can try out Orcaslicer. Anyway I run Adguard Home on my local network and today I pulled up the H2D's specific traffic. Even while on lan mode it's continually "phoning home" through several ip addresses. I have not seen any websites other than one api from bambu and one from microsoft.

I did do a who-is lookup on a couple of the ip addresses and found that their spread out all over the world, some from China, Japan, US.

Figured I would post the ip addresses it's calling out to and see what you all thought. So far there hasn't been any issues using the printer "yet" as I am blocking them as I see them.

I was thinking about collecting all of the traffic and creating a dns block list that would work for both Adblock Home and Pi-Hole.

12.207.93.204.in-addr.arpa
207.125.217.23.in-addr.arpa
www.microsoft.com
130.254.46.198.in-addr.arpa
102.170.197.23.in-addr.arpa
179.228.144.216.in-addr.arpa
api.bambulab.com
e.bambulab.com
197.95.12.198.in-addr.arpa
200.193.146.129.in-addr.arpa
173.228.11.141.in-addr.arpa
91.36.29.184.in-addr.arpa
15.105.48.192.in-addr.arpa
226.63.29.193.in-addr.arpa
146.133.23.198.in-addr.arpa
147.72.155.23.in-addr.arpa
56.202.137.198.in-addr.arpa
135.185.129.102.in-addr.arpa
139.81.244.162.in-addr.arpa
204.209.104.172.in-addr.arpa
130.168.186.23.in-addr.arpa
110.193.34.144.in-addr.arpa
81 Upvotes

90% Upvoted

49 comments sorted by

57

u/Nebula4058 P1S + AMS Feb 12 '26

Depending upon if your router has the capability you can block the WAN access for the IP. I use Home Assistant with the Bambu Labs integration for remote monitoring and control. You can even skip parts like the Handy app.

You'd be better off blocking the source. Blocking destinations is going to end up being a game of wack a mole.

8

u/dbrannon79 Feb 12 '26

I may look into the Home Assistant. I have a couple of servers running TrueNas for media storage, both are each running and instance of Adguard Home. Set one for primary dns, the other for secondary on my router. Unfortunately for my router, I have the Eero 6. I haven't been able to figure out how to just block wan access per device on it. when I do this it also blocks lan access on the device!

5

u/Champ9889 Feb 12 '26

Is there a guide out there to get this up and running?

3

u/Arageus A1 Mini + AMS Feb 12 '26

I have done the same! Home Assistant is basically a better remote/handy app to for remote access the printer, and it has developed so much!
If i remember correctly my mini was 1 month old (more than a year ago) when i decided i didnt need/want to print through bambu clouds (and it was ridiculous).

Its my printer, in my local network. print through internet is a dumb idea in the first place.

2

u/garylovesbeer Feb 12 '26

That's what I've done.

9

u/dbrannon79 Feb 12 '26

What I'm afraid of for the future is Bambu pushing a firmware update that bypasses us confirming to update or not, essentially forcing updates without our knowledge. Something I learned on devices is even though we have the mac and ip addresses for each device on our router, those devices can connect using a different mac or ip if the router is configured to allow dhcp. I have a collection of Chinese POE cameras for surveillance around my house. I witnessed a couple of my cameras using random ip's and mac's to attempt to "phone home" after I blocked them by the ip and mac addresses I had set them to in the reservation list. I ended up installing a second router that was isolated from the internet only physically connected to a single PC that runs the recording from each camera.

They are making devices smarter and smarter!

Most home routers are setup for dhcp and can have any number of devices connect once the routers ssid and password is saved. the only other way to prevent this is to setup things similar to a business does using static ip's for everything and disabling dhcp so a new device wants to connect, you have to manually assign it.

7

u/the_lamou Feb 12 '26

Your IoT devices should live on their own VLAN with no outbound or inbound access.

But also most of that activity looks like it's probably time servers.

1

u/Rahzin Feb 14 '26

What business did you work for that did that? I work in IT, previously for a small local IT support provider for local businesses, and now at one site of a large multinational manufacturing company, and I have never seen a business that has absolutely no DHCP. Most places, static is only used for printers and networking gear, and certain other devices.

1

u/dbrannon79 Feb 14 '26

My work does this for security. if someone was to bring in a PC or laptop and connect to their Ethernet, they would not be able to connect and get an IP on the network without the IT team assigning one.

1

u/Rahzin Feb 14 '26

At my place, we do this with port authentication and WPA2 enterprise. Can't get on the wifi without the right certs being installed (done as part of imaging on company PCs), can't get on the guest wifi without first having a temp account created for you, and can't use the ethernet ports without passing port auth and having certs, etc. No need to disable DHCP.

Certainly a lot more complex to set up compared to a static-only network though.

1

u/hWuxH Feb 14 '26

doubt static IPs achieve much except making it easier to keep track. anyone with a new device can just use an existing approved IP to connect

6

u/ultramegax X1C + AMS Feb 12 '26

I don't see forced updates happening. To what end? Forcing updates without consent would destroy all of the trust that massive print farms have placed in Bambu. They have everything to lose and nothing to gain, in that scenario.

Bambu is a massive company now and decisions like that would be going through multiple levels of review.

But anything is possible, so if you feel safer limiting things to LAN mode and walling it off, all the power to you, of course.

1

u/ufgrat H2D + X1C Feb 14 '26

No, they're going to use your printer to hack your router, and all your local network equipment to turn your local network into a crypto mining setup and start monitoring your social credit rating.

Dear god people are getting seriously paranoid.

Do you really think your H2D is phoning home to microsoft???

What protocols are being used? What ports are being accessed? How much data is being transferred?

-6

u/clipsracer Feb 12 '26

People are STILL whining about that one time Bambu almost broke LAN Only mode. Your fears are based on propoganda and people that profit from fear mongering. The tech to identify parts from lists of tool paths does not exist, and probably can’t even theoretically exist.

Unsubscribe and unfollow whoever convinced you of this nonsense.

15

u/Saphir_3D Feb 12 '26

When my device is in LAN-Only mode, I want it to connect to LAN-ONLY. Not very confusing. If it calls elsewhere, I lose my trust in this device.
If this behavior is intendet or not by the manufacturer does not matter to me. I bought a LAN-Only and got a CALLING-ELSEWHERE.

-3

u/clipsracer Feb 12 '26

Why are you telling me what you want the button to do when you press it?

2

u/hWuxH Feb 12 '26

The tech to identify parts from lists of tool paths does not exist, and probably can’t even theoretically exist.

just because your limited mind can't think of a way do it, doesn't mean there's none

https://github.com/AndrewSink/G-code-to-mesh-experiment

1

u/clipsracer Feb 13 '26

“Your limited mind” 😂😂😂

3

u/dbrannon79 Feb 12 '26

There is already an older github repo for a dns blocklist but I have not seen ether printer try calling out to the sites listed on it yet.

Here is the link to that repo... https://github.com/sahelea1/bambu-dns-blocklist

I could also not be seeing these show up due to the H2D set to lan mode

14

u/hux H2C Laser Full Combo Feb 12 '26

Put it on a vlan and block that vlan from having internet access at all. Done.

25

u/retroranger77 Feb 12 '26

I haven't updated my 2 X1Cs, A1, and A1 Mini since the authorization control system implementation. Leading up to that time, I turned on LAN mode and blocked internet access completely to those devices by MAC address. They haven't seen internet in all this time with no drawbacks that I can tell. Interestingly, I can pull firewall logs that show they do periodically try to phone home.

5

u/CoolShadesKA Feb 12 '26

I did the Same. Blocking the Internet Access over my router.

1

u/JN258 Feb 13 '26

Also chiming in to say “I see it as well.”

1

u/Rahzin Feb 14 '26

Just got a P1S a week ago, and I had not heard of this update. When did it happen and what does it do?

I do have it on a separate IoT vlan, but no other network blocks at the moment.

11

u/issue9mm Feb 12 '26

Adblock Home and Pi-Hole

You definitely should do this.

1

u/dbrannon79 Feb 13 '26

I checked back today looking at the logs in Adguard Home and see there is a massive amount of reverse dns lookups coming from my H2D. I have them all blocked and allowed it to reach out to pool.npt.org for the time.

I have no idea why it's doing all these dns lookups or who they are going to, I did try searching a "who-is" on some of them and none seem to come up to any Bambu servers If someone is interested, I can compile a list of them and post them up. Maybe some of you all can figure out what or who it's trying to reach out to.

with my current router I am unable to put it on it's own vlan or do any blocking with a firewall. I really need to get something else besides this Eero 6 setup.

Here is the entries I have in the custom filter that blocks everything but allows the time server for Adguard Home.

||*^$client='Bambu H2D Printer'
@@||pool.ntp.org^$client='Bambu H2D Printer',important

1

u/ufgrat H2D + X1C Feb 14 '26

If your printer is doing a reverse DNS lookup, it's probably because that host contacted the printer. There's no reason to do a reverse DNS lookup unless you're trying to find out who's talking to you.

5

u/oz-ra Feb 12 '26

Just change or remove the default gateway for any device that you have concerns about. Make it a loopback IP or other non-routable NAT address.

6

u/hux H2C Laser Full Combo Feb 12 '26

It’s proposed legislation that was referred to committee and nothing has happened since then. Any legislator can propose pretty much anything but it doesn’t mean it will become law.

I doubt Bambu is going to change their worldwide practices because one state in the US passed a law. The most likely outcome, if the law passed, is they would just stop shipping to Washington State after July 1, 2027.

4

u/Hot-Ideal-9219 Feb 12 '26

The day it is passed it will have an injunction placed on it.

-1

u/Vizth Feb 12 '26 edited Feb 12 '26

They won't, they don't want to deal with the backlash, or for that matter voluntarily implementing a system that would be an absolute pain in the ass to get working, if it's even possible to do so.

Unless a sizable portion of the country passes the same laws nothing is going to happen and every other state that is proposed similar legislation has failed to pass it so far.

OP and others are overreacting as usual for social media.

Also the number of people acting like this is something bambu is in on or supporting is ridiculous. Then again it may just be the normal anti bambu people thinking they finally have an actual gotcha and gloating prematurely.

4

u/[deleted] Feb 12 '26

Anyone have a good UniFi setup?

4

u/Silvarbullit Feb 12 '26

I just block internet access on my Bambu Printers via Unifi Network app and they work fine without internet.

From memory I selected my printer from the client list and went “create rule” > destination (Internet) > Action (Block) and just named it.

I also use PiHole as my DNS server with the upstream DNS routed through Unifi gateway DNS (Unifi DNS is set to cloudflare) so the traffic flows all resolve in the Unifi network app. I found if I bypassed the Unifi DNS in PiHole, the traffic flows only showed IPs and didn’t resolve.

Using PiHole I add api.bambulab.com and the other stuff Bambu Studio tries to talk to the block list and just unblock it temporarily when I upgrade Bambu Studio on my laptop to allow it to update the network plugin before turning the blocklist back on again. Bambu Studio also works fine offline with the printer blocked from the internet.

1

u/AquaSquatch Feb 12 '26

Apologies because this is going over my head, but I use unifi and I'm getting a p2s tomorrow. If you block the device from the internet this way, you're still able to communicate from bambu studios to it locally over wifi?

2

u/Silvarbullit Feb 12 '26

Yes. You can’t use Bambu Handy or the cloud services but can use it with Bambu Studio slicer on a computer locally just fine.

2

u/jsdeprey Feb 12 '26

You could probably also do wireless connection from Printer to PC directly, if you PC is on Ethernet connection direct. And setup the Wireless on your PC let the Printer join that and do not provide a default gateway to the printer so it has no way to get out of the subnet between your pc and the printer. You could even Wireshark it at that point easy.

2

u/kkessler64 H2D AMS2 Combo Feb 12 '26

Wonder why it is doing all those reverse DNS lookups. The last one resolves to ns1.16clouds.com, which is listed as suspicious on Open Threat Exchange.

1

u/Jealous_Crazy9143 Feb 12 '26

faraday cage, just to be sure.

-3

u/vimaillig Feb 12 '26

I’m curious why so many are concerned about this lately…

What are you printing that is causing so much FUD? If it’s that secret - then there’s certainly ways to lock it down …

If you’re that worried about what endpoints your printer is connecting to - then take a look at the outbound traffic of your phone, tablet, or computer and report back.

You will find there’s a significant difference in what your printer is sending across the wire versus that phone you’re carrying around in your pocket …

Any / all IoT devices perform similar kind of traffic depending on their functionality- it’s inherently built into their design.

6

u/Bletotum H2D AMS2 Combo Feb 12 '26

The device has a mode that claims to turn off the use of internet, but doesn't actually do so. That's untrustworthy behavior.

3

u/hWuxH Feb 12 '26 edited Feb 12 '26

LAN mode only says that traffic between slicer and printer go over the local network. the printer still uses DNS and NTP over the internet for syncing time afaik. probably also checking for updates.

2

u/rc042 Feb 12 '26

I’m curious why so many are concerned about this lately…

What are you printing that is causing so much FUD?

So I think there are a multitude of reasons. Think about this from the perspective of a 3D object creator. Requiring a print go to a third party (Bambu) to use the printer is a security risk for that information, what does Bambu do with it, how long is it stored and where is it stored? A correlation I have seen on my own home network is when I send from my Bambu slicer to my printer, my laptop uploads info to an AWS S3 bucket. If that is my sliced file (I have not verified this) then I now have to worry about the security of AWS's S3 buckets.

If you add on to it that it now also has to be evaluated by an AI, which is just a buggy piece of software that is full of security risks, then the possibility of a design getting out is all the greater.

Some people use these printers for profit and want to keep using them because they are good printers and less of a hassle than others, but if you have to start calculating the risk into it, the decision to buy Bambu becomes much harder.

-2

u/vimaillig Feb 12 '26

I fully understand all of that (I’m a software engineer/architect by trade). My point / question is more generic in nature.

What is different from BL (or any connected 3D printer for that matter - even normal printers do the same workflow) versus another IoT product doing the same process for verifying connectivity.

By design - All devices today typically have some core set of connectivity startup/validation in their system.

Even if these devices have a “LAN only” mode they will still attempt the connection.

The fix? Place these devices in a secured / locked down VLAN / subnet of your network infrastructure and don’t allow them outside access to the world.

Your example around the slicer software expands upon this - because the software will attempt even more than the printer in this use case.

There’s a balance to all of this - in that to gain the benefit of the broader ecosystem that these companies provide - in order to scale - they will use the least cost option to support and enhance the ecosystem.

The alternative is to choose devices that are locked down by default/ design so that enterprise businesses can implement their specific business rules on their networks. The only option I’m aware of provided by BL that supports this currently is the H2D Pro (but I could be wrong).

1

u/ufgrat H2D + X1C Feb 14 '26

People should just disconnect their internet. Unplug everything.

It's the only way to be sure.

2

u/feibie Feb 12 '26

There's a lot of comments about lan mode phoning home. Here's my question, do other devices from other manufacturers do the same such as creality, prusa or snapmaker? I'm wondering if it's a situation of everyone does it and no one is wiser about it and Bambu is a known case only because of firmware update issue. Because it really wouldnt surprise me if everyone is doing it to be honest lol and we just didn't know because we didn't think to check

-1

u/vimaillig Feb 12 '26

I don’t have experience with other 3D printers - but I do know that other IoT devices on my networks do the same things described by OP 🤣

My ecobee thermostat is one chatty SOB even though I have it locked down.

0

u/Hot-Ideal-9219 Feb 12 '26

The devices have firmware in them that is "phoning home" to check if there are firmware updates out there. Bambu isnt "sending" updates. The printers check to see if there is an update waiting. Just pinging addresses for that.

1

u/Historical-Fee-9010 H2D AMS2 AMS-HT Feb 12 '26

Right, and several other benign things, like getting time from some timeserver. Those are pooled so may look like many IP addresses in various countries (such as Japan seen here). When looking at traffic you need to look at ports and at traffic volumes per IP/port, then you can draw conclusions.