You connect to your VPN, and the printer disappears. The NAS folder won’t open. Your phone can’t cast to the TV. Turn the VPN off, and everything works again.
When a VPN blocks local network access, the cause is usually a setting inside the VPN app. Many apps have an option that lets traffic to your own home devices skip the tunnel. If that option is off, or tied to the kill switch, your devices become unreachable. Find the setting, turn it on, and reconnect.
This guide lists the exact setting for each VPN whose documentation we checked. It also covers printers that still fail after that.
Why a VPN Blocks Local Network Devices
A VPN sends your traffic through an encrypted tunnel to a server. Your printer and NAS don’t live at that server. They live on your router’s network. So the app must decide which traffic goes into the tunnel and which stays home.
NordLayer’s printer troubleshooting page explains the cause. It says “connecting to a VPN Server will place your computer on the server’s local network.” That can cut you off from the network you just left.
General networking background fills in the rest. If the tunnel takes every route, a request for 192.168.1.20 goes to the VPN server instead of your printer. The vendor pages below don’t explain this routing in detail. They only name the settings.
There is also a trade-off. On Proton VPN’s LAN connections page, local device traffic “aren’t routed through the VPN tunnel.” So the VPN doesn’t encrypt it. On a home network you control, that is normally fine.
Fix 1: Turn On the Local Network Setting in Your VPN App
Every app names this setting differently. Start with the list below. These paths come from each vendor’s own support page, not from our testing. Menus can change after an update.
Proton VPN (paths from its support page):
- Windows: Settings > Connection > Advanced settings > Allow LAN connections
- macOS and iOS: Settings > Connection > Allow LAN connections
- Android: Settings > Connection > Advanced settings > LAN connections
- Linux, Apple TV and browser extensions: LAN access is allowed automatically
- If you’re connected, reconnect after you change it
Proton says LAN access is on by default. It also says the setting is available to everyone with a paid plan. If your Proton VPN blocks local network traffic anyway, the cause is likely elsewhere on this list.
NordVPN: Open Settings > Connection and security, and make sure “Stay invisible on LAN” is off. NordVPN’s Windows printer article lists this as its first step. The name is easy to misread. “Invisible” hides your PC from the LAN, and it can also stop you from seeing the printer.
WireSock: Enable “Bypass LAN Traffic.” WireSock’s local network guide says this option “automatically excludes local traffic from the VPN tunnel.”
Other VPNs: Look in the connection or network settings for words like LAN, local network, or bypass. If you can’t find one, check the vendor’s support site for your exact app and version.
Fix 2: Check the Kill Switch on ExpressVPN
A kill switch blocks all traffic if the VPN drops. That can also block your printer, so your VPN blocks local network devices even while it works. ExpressVPN’s LAN access page names the cause. It “might be because access to local network devices is disabled when Internet Kill Switch is enabled.”
How to fix:
- Open the ExpressVPN app settings
- Turn on the option to allow access to local network devices
- If that doesn’t work, turn off Internet Kill Switch and test again
- Turn the kill switch back on when you finish
That last step matters. ExpressVPN says the kill switch protects your data “if your VPN unexpectedly disconnects.”
For Android, the page says the kill switch “does not disrupt your access to your local network devices.” On a router app, local devices stay reachable on the same network. The page doesn’t give steps for Windows, iOS or Linux. It also doesn’t mention NAS devices or Chromecast.
Fix 3: Add the Printer by IP Address
Printers often get found through discovery, which can fail while a VPN is running. Adding the printer by its IP address skips discovery. NordVPN’s article gives these steps for Windows.
How to fix:
- Find the printer’s IP address on its screen or in your router’s device list
- Open Settings > Bluetooth & devices > Printers & scanners
- Choose the manual option, then “Add a printer using an IP address or hostname”
- Set Device type to “Autodetect” and enter the IP address
- If you see a port-exists error, add the suffix “_VPN” to the Port Name
- If prompted, pick your model or “Generic Network Card”
On a Mac, ExpressVPN’s page describes a similar path. Open System Settings > Printers & Scanners. Click Add Printer, Scanner or Fax, choose the IP tab, and enter the address.
Give the printer a fixed address in your router. NordVPN warns that printers can drop off the network if their IP changes. Our guide to a Windows 11 printer that keeps going offline explains why a TCP/IP port and reserved address help.
Fix 4: Use Split Tunneling for the Print Spooler
Split tunneling lets chosen apps skip the VPN. NordVPN lists it as a printer fix.
How to fix on NordVPN:
- Open Settings > Split Tunneling and turn it on
- Choose “Disable VPN for selected apps”
- Add your printer software or spoolsv.exe
- Test printing
NordVPN lists this among several steps and doesn’t promise it works alone. Test after each change, so you know which one helped.
Fix 5: Add Your Home Subnet to Non-Tunneled Networks
Sometimes a VPN blocks local network access and the client has no bypass switch. It may let you list networks that stay outside the tunnel instead. WireSock documents this manual route.
How to fix:
- Open Command Prompt and run ipconfig
- Note your IPv4 Address and Subnet Mask
- Edit the VPN profile and add your local network to Non-tunneled networks
- Save the profile and reconnect
WireSock’s example is 192.168.1.0/24. Use your own subnet, not that one. It also gives a DNS warning. If the profile has a DNS line, “DNS requests still go through the VPN, so local hostnames may not resolve.” Then open devices by IP address, such as \192.168.1.50.
Fix 6: Check the Windows Firewall Printer Rules
This one comes from a business VPN. NordLayer’s article says to open Windows Defender Firewall > Advanced settings. Enable both “File and Printer Sharing” Echo request ICMPv4 rules, then restart the PC.
NordLayer says these steps “may only potentially remediate this behavior.” Treat the fix as a long shot. It costs little to try, since it only allows ping requests for file and printer sharing.
Fix 7: Rule Out Security Software and Wi-Fi Bands
If the VPN setting is correct and your VPN still blocks local network traffic, look at other software. NordVPN suggests two checks.
How to check:
- Pause the VPN’s “Real-time protection” feature briefly and test again
- Temporarily disable any third-party antivirus or firewall
- If printing works, add exceptions for the VPN app and the printer’s IP address
- Re-enable everything when you finish
- Put the PC and printer on the same Wi-Fi band, both 2.4GHz or both 5GHz
Don’t leave protection off. Turn it back on as soon as the test is done.
Casting and Mac apps add a second layer. If Chromecast still fails with the VPN off, read about no cast devices found. On a Mac, each app also needs its own Mac local network permission, separate from any VPN setting.
When Nothing Works: One Unresolved Case
A Microsoft Q&A thread shows how stubborn this can get. A user on NordVPN ran tracert to a printer at 192.168.1.x. The trace went to a 10.x address and timed out. The Windows troubleshooter restored printing, but power-cycling the printer broke it again.
The only reply, from a volunteer moderator, told the user to contact NordVPN support. No cause was confirmed. That trace pattern fits traffic entering the tunnel, but the thread never proves it.
You can borrow the test. Run tracert followed by your printer’s IP address. A local device should answer from your own network within a hop or two. If the first hop is a VPN address, your traffic is entering the tunnel.
Frequently Asked Questions
Why does my VPN block local network devices? The VPN sends your traffic into its tunnel, while your devices sit on your home network. Without a LAN bypass, requests for local addresses can fail. Turn on the app’s LAN option.
Is it safe to allow LAN access on a VPN? Proton says local traffic skips the tunnel, so the VPN doesn’t encrypt it. On a home network you trust, that is usually acceptable. On public Wi-Fi, think twice.
Why does the kill switch block my printer? ExpressVPN says local access can be disabled while the kill switch is on. Allow local devices in its settings, or turn the kill switch off briefly to test.
What does “Stay invisible on LAN” do on NordVPN? NordVPN tells printer users to make sure it’s off. The setting hides your device on the local network. Turn it off if the printer or NAS can’t be reached.
What if my VPN blocks local network names but not IPs? Hostnames may fail while IP addresses work. WireSock warns that local hostnames may not resolve when the VPN handles DNS. Use the device’s IP address instead.
The Bottom Line
When a VPN blocks local network devices, start with the LAN setting in the app. Proton calls it Allow LAN connections, NordVPN uses “Stay invisible on LAN,” and WireSock calls it Bypass LAN Traffic. On ExpressVPN, check the kill switch too. If the printer still fails, add it by IP address, use split tunneling, or list your subnet as non-tunneled. These steps come from vendor documentation, and results vary by app version. Change one thing at a time, and turn your protection back on when you finish testing.