3DPrinting

If you really control the firewall, you should know to block all inbound traffic by default.

It doesn’t matter if it’s IPv4 or IPv6; NAT is not a security protocol and it doesn’t protect you.

I can think of no compelling reason whatsoever to have my printer exposed to the outside internet. If I have to get at it remotely that's what my VPN is for.

Connected to the internet or just connected to your network?

Connect it to your network and use an invalid IP as your gateway and it shouldn’t go out of your network.

IoT devices are, to be quite honest, a shitshow. Where your Sovol counts as such.

Either the device needs to call upstream to get updates or it's going to ship with a security bug that can be exploited. Or, in may cases, it'll have an unpatched security vulnerability and it'll call upstream to get updates.

It costs money to keep the necessary cloud infrastructure in place, both in terms of hosting costs as well as devops time. Either they will eventually need to brick the device, leave it unpatched forever, charge you some maintenance fee, go bankrupt, or fund the whole thing by selling your data.

It's not hard to write a bot that would scan for signs of a Sovol printer, try the default SSH password, and do nefarious things. And people are generally really bad about the default SSH password regardless.

There's not really a good answer here for IoT devices. There's not even a really great answer for home brew IoT devices with the thing where Home Assistant's reverse-tunnel service had a nasty vulnerability that let you remote HA instances.

Aaand.. IPv6 is great. But unfortunately the way things are now means that giving everything on your network a publicly routable IPv6 address is a very bad idea.

Klipper provides a lot of protections but all of that hinges on the microcontroller, so presumably an attacker can upload a substitute firmware using the update mechanism that would go full send on the heaters, which has the potential to actually melt some things.

The problem is that if you want Klipper, you need a full Linux. This is not actually a problem for the Klipper devs, mind you, because they wrote a cool tool for people comfortable modding their printers and only BTT and Obico sponsor Klipper. This was a lot less of a problem when we were talking about Marlin printers. Except that if people weren't using Klipper, it's just too damn easy to write a two-piece controller software in the same fashion of Klipper and get the expediency of writing code in Linux instead of in an os-less microcontroller.

tl;dr: there is no safe way to buy a printer with klipper on it, it just looks like it works right now.

If you are worried about it, put them on their own VLAN with no internet access. Set a firewall rule so that only the computer you use to control it can talk to that VLAN.

Unless you added a firewall rule allowing inbound access to the printer's IPv6 address, nothing will be able to make an inbound connection to it from the internet.

I thought the default firewall rule for IPv6 is to block all incoming traffic? At least it is on my hardware out of box.

Public facing IPv6 doesn't means its externally reachable, its just how IPv6 works because there is no need for NATing. You can quickly test it by trying to SSH to it to make sure its not reachable. Otherwise just add a firewall rule that block all incoming IPv6.

Anyway if you want to make sure it also doesn't connect to the internet, you could just do the inverse and MAC ban outgoing traffic or put it on a VLAN.

Connect it to an isolated vlan. Having access to a printer on your intranet can be handy, having access from the internet is generally unnecessary. Do you need to check on it from outside your house? If that’s the case then you need to start looking at stuff like tailscale but i don’t recommend printing while not at home

make physical real-world actions like:

Send a command to your printer to make something illegal (like a gun), then report you for making an illegal gun.

I have my prusa connected to my WiFi, but it only serves up a Web page with limited control locally. You can only upload gcode, and start a print if the printer is ready to start. And it's open source so I'd expect the community to have found any issues.

You should monitor it's connections at the firewall and see if it's trying to make ANY connections outside your network, no reason for it to try making any dns queries even.