RelayBridge

Devices

Prepare printer connectivity

Bind RelayBridge to one trusted private LAN interface, enable queue processing, restart safely, and apply a narrow manual Windows Firewall rule if required.

v1.0.0-rc.1 · PreviewUnsigned public release candidate for evaluation and community testing. A signed stable release is not yet available.Release status

Start from the safe default

Before printer connectivity is applied, RelayBridge keeps management on loopback, the SMTP source configuration on loopback port 2525, cleartext device authentication disabled, and queue processing disabled.

Microsoft 365 must be active and verified before devices can be added. Select only a private interface that the intended printers can reach.

Apply the private listener

  1. Open Settings → Printer connectivity.Select the active private LAN interface intended for device submissions.
  2. Review the generated configuration.Confirm the exact private binding and that queue processing will be enabled.
  3. Select Apply printer connectivity.Approve the Windows elevation prompt for the fixed installed helper.
  4. Wait for the controlled restart.The helper saves the protected configuration, stops RelayBridge, confirms the old service process exited, starts the service, waits for management readiness, and verifies the selected listener and queue state.
  5. Allow the browser to reconnect.Confirm that Settings reports the listener and queue as ready before adding a device.

The helper writes only C:\Program Files\RelayBridge\Host\appsettings.Production.json and controls only the RelayBridge service. It accepts a one-shot approved revision and a narrow listener/queue schema.

Apply distinguishes configuration-not-saved, configuration-saved-but-restart-failed, service-started-but-readiness-unconfirmed, and successful outcomes. If writing succeeded but restart failed, start or restart the service and verify readiness instead of replacing the JSON again.

Windows Firewall remains manual

RC1 does not create or modify Windows Firewall rules

Settings generates guidance scoped to the RelayBridge Host executable, selected local address and port, Private profile, and local subnet. Narrow the remote scope to the exact printer address or trusted subnet whenever practical.

Do not use an all-programs or all-ports rule, enable public profiles, bind to 0.0.0.0, expose the listener to the Internet, or create any LAN firewall rule for management port 5080.

RelayBridge does not probe whether a particular printer can reach the selected host interface. Interface choice, VLAN routing, endpoint security, and firewall scope remain administrator responsibilities.

Transport boundary

The device-facing SMTP connection uses connection security None. RC1 does not advertise or implement inbound STARTTLS. The listener must remain on one trusted private interface with access restricted to intended devices.

The Microsoft-facing hop is separate: RelayBridge connects to smtp.office365.com:587, requires STARTTLS with normal certificate and hostname validation, then authenticates with XOAUTH2.

Add a deviceCreate the device record after listener and queue readiness are confirmed.Authenticated and Legacy modesChoose the narrowest mode the client can support.Branch-office topology guideCompare local instances with a central instance reached over site-to-site VPN.Printer TLS diagnosticsUnderstand why the local cleartext hop and Microsoft TLS hop are different connections.