Nicolas Le Manchet

Raspberry Pi network scanner

Transforming an old all-in-one HP printer/scanner into a networked scanner is quite easy on Debian Buster. The idea is to connect the scanner to a Raspberry Pi via USB, configure the SANE scanning daemon and allow remote clients to use it.

Server (Raspberry Pi)

Install the packages and configure the printer on the server:

apt install --no-install-recommends sane-utils hplip
hp-setup -i

This created a saned user and a scanner group, unfortunately a bug in Buster requires to add a custom udev rule to give permission to the saned user to use the scanner[0]:


ENV{libsane_matched}=="yes", RUN+="/bin/setfacl -m g:scanner:rw $env{DEVNAME}"

Apply to rule with udevadm trigger or reboot the Pi.

At this point the saned user should be able to detect the scanner and use it[1]:

sudo -u saned sane-find-scanner
sudo -u saned scanimage -L
sudo -u saned scanimage -T

Once all these commands terminate without errors, the network part can be configured. The SANE daemon is a bit special for two reasons:

  • It needs to be started by inetd (or its systemd replacement) that will launch it when a connection on port 6566 is made, a bit like a CGI script.
  • Once it is started, it will instruct the client to make a second connection to another port, a bit like in FTP.

With that in mind, let's configure it:


data_portrange = 10000 - 10100  # You can leave this commented if you don't have a firewall

Start the inetd that will launch saned:

systemctl enable saned.socket
systemctl start saned.socket

If you use a netfilter based firewall on the Pi (iptables or ufw), you should be able to use nf_conntrack_sane to automatically track and open the ports specified in data_portrange, but I couldn't get it to work. Instead I manually open all of them:

ufw allow from to any port 6566 proto tcp
ufw allow from to any port 10000:10100 proto tcp

If when you try to scan something, it briefly works but hangs after a second, it is a sign that the first connection to port 6566 works, but the second connection to one port in the range 10000:10100 does not.


Setting up the client is straightforward, see instructions on Debian Wiki.


  • Using SSH port forwarding instead of the SANE daemon, more secure but requires connecting to the server before scanning.
  • Pretending that the scanner is connected directly to the client with USBIP.

More information: