Short answer: A connected VPN and a reachable printer or NAS use different network paths. A VPN app may block local-network traffic by design, the device may be reachable only by IP because local name discovery is unavailable, or the client and device may be on different Wi-Fi/VLANs. First identify whether this is a device VPN client connecting outward or a remote connection to a VPN server at home; the checks differ. Do not change firewall or VPN policy on a managed device.
Identify which VPN setup you are using
- VPN app on the same device as the printer/NAS: You are probably trying to reach another device on the Wi-Fi or wired LAN where your computer or phone is connected. Look for the VPN app's documented setting for local network or LAN access. The exact name and default vary by app and platform.
- Remote access to a VPN server at home: You are away from home and connect back through a VPN server on your router or another home device. The home firewall must permit the intended access from the VPN client network. Discovery or broadcast-based device lists may not cross the VPN even when a direct address works.
- VPN client configured on the home router: The router sends some or all internet traffic through a commercial VPN. Local printer/NAS access depends on the router's LAN routes and firewall rules; use the exact router and VPN-provider documentation. See the router VPN setup guide.
Work through these low-risk checks
- Check the device itself. Confirm the printer or NAS is powered on, connected to the expected home network, and not reporting an error. If available, check the router's ordinary connected-device list or the device's own display for its current local address. Use only an address you are authorized to access.
- Confirm both devices are on a network allowed to communicate locally. Guest Wi-Fi, client isolation, separate VLANs, mesh/IoT networks, or a different router can prevent peer connections. Network names can look similar while being segmented. Check the router's documentation or ask its administrator; do not weaken a managed network's isolation.
- Separate name lookup from connectivity. If a saved hostname or the operating system's device list fails, use the device's current local IP address in its normal app or documented interface as a comparison. If the IP works but the name does not, investigate local DNS or multicast discovery support in the VPN app and device. Discovery lists are not a reliable test of whether a device is powered on or reachable.
- Check the VPN app's LAN option. On a personal device you control, consult the provider's current instructions for “Allow LAN connections,” “local network access,” or similar. If you choose to enable it, understand that local-device traffic may bypass the VPN tunnel onto the local network. Reconnect the VPN if the app's documentation says the change needs it, then test the printer/NAS again.
- Compare one condition at a time. Note the VPN state, network name, device address, and whether access by IP or name works. If appropriate on a personal device and before sensitive activity, a brief test with the VPN disconnected can show whether the app setting is involved; reconnect immediately afterward. This only diagnoses that moment and says nothing about all apps or routes.
- For a home VPN server, use the documented direct path. Check the server/router's instructions for the permitted LAN routes and the NAS/printer's supported access method. Entering a current local IP can work when network discovery does not. If an IP connection is refused, ask the device or network administrator to review the narrow, intended firewall rule; do not turn off the firewall or expose NAS/printer ports to the public internet.
What the symptoms can suggest
| Observation | What it may indicate | Next check |
|---|---|---|
| The device works by IP but not by name | Name resolution or local discovery may be unavailable; the route to the device may still work. | Check the VPN app's documented local DNS or device-name feature and the device's current address. |
| It fails by both IP and name only while the device VPN is connected | A LAN access setting, route, firewall rule, or VPN network filter may be involved. | Review the exact VPN client's LAN-access instructions. On a managed device, stop and ask its administrator. |
| Other devices on the same Wi-Fi also cannot reach it | The printer/NAS, Wi-Fi segment, router, or device firewall may be the issue rather than the VPN tunnel. | Check device status and the network owner's normal troubleshooting steps. |
| A remote VPN connection works, but the device is absent from a network browser/list | Broadcast or multicast discovery may not cross the remote VPN, even if direct access is supported. | Use the administrator-approved address or hostname and the documented app/protocol. Ask the VPN server administrator about routes and firewall scope. |
Stop before changing managed settings
On a work-, school-, ISP-, or otherwise managed device or router, do not edit routes, firewall rules, VPN exclusions, or network isolation. Those controls may be required by the owner. Ask the administrator to confirm whether local devices are meant to be reachable and which approved method to use. For personal equipment, keep a note of each setting before changing it so you can restore the previous state.
Local-network access is separate from internet access through the VPN. A VPN's local-network exception can make a printer reachable while placing that local connection outside the VPN tunnel; exact behavior depends on the app and configuration. For general routing background, see how VPN split tunneling works, the Windows route guide, and the VPN visibility guide.
Sources
- Proton VPN Support: How to allow LAN connections (accessed 2026-11-03) — provider-specific examples of LAN access settings across platforms; states that allowed local-device connections are not routed through that VPN tunnel.
- Proton VPN Support: How to connect to LAN devices by name on Windows (accessed 2026-11-03) — explains its Windows app's local device-name option and why IP access can work when multicast DNS name discovery does not.
- TP-Link Support: VPN Connected but Can't Access or Discover LAN Devices (updated 2026-04-23; accessed 2026-11-03) — covers a TP-Link router acting as a remote-access VPN server; describes device firewall rules and discovery limits in that specific topology.
Impact — TODO: apply/approval and configure referral URL — referral link not configured.
PartnerStack — TODO: apply/approval and configure referral URL — referral link not configured.
CJ Affiliate — TODO: apply/approval and configure referral URL — referral link not configured.