When tl-setup is installing nearest and thinlocal, it should also open port 631 for cups if it understands how to manipulate the firewall.