1

I have a linux system on which I need to configure the firewall. Unfortunately scanning the network for printers doesn't work after I set the firewall (without the firewall the the printer is seen).

Printer used - lpinfo -l -v 

Device: uri = socket://xx.xx.xx.xx:9100
class = network
info = Deskjet 3520 e-All-in-One Printer series
make-and-model = HP Deskjet 3520 series
device-id = MFG:HP;MDL:Deskjet 3520 series;
location =

below you can see the rules I am using which were built based on the information I've found at https://www.cups.org/doc/firewalls.html :

iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT DROP
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -p udp --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -p tcp --dport 631 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --dport 631 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -p udp --dport 5353 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p udp --dport 5353 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --dport 161 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --dport 515 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --dport 9100 -m state --state NEW,ESTABLISHED -j ACCEPT


iptables -nvL

Chain INPUT (policy DROP 8 packets, 788 bytes)
 pkts bytes target     prot opt in     out     source               destination
    0     0 ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:22
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:631 state NEW
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:631 state NEW
   23  4228 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:5353 state NEW
    0     0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            state RELATED,ESTABLISHED

Chain FORWARD (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain OUTPUT (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
   22  3619 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            state NEW,RELATED,ESTABLISHED
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            state NEW,ESTABLISHED udp dpt:137
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            state NEW,ESTABLISHED udp dpt:138
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            state NEW,ESTABLISHED tcp dpt:139
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            state NEW,ESTABLISHED tcp dpt:445

Do you know what am I missing ? Thank you

||improve this question||||
  • 1
    Did you try actually printing something? From the iptables the only packets dropped were on INPUT, which maybe has something to do with the nmap/nstat report. – notsoslimshady Jun 17 '19 at 15:41
  • Without the iptables the printing works. My goal is to make it visible in the lpinfo -l -v output. Currently if the iptables rules are used, the printer is not seen by lpinfo. – ossx Jun 17 '19 at 17:59
  • 1
    Let's see if we can work through this, I would start by confirming the assumption that the issue is with INPUT, with the iptables on lets temporarily change the policy to accept instead of drop with iptables --policy INPUT ACCEPT . Does the IPinfo work now? If so, great we know where the problem is. Next step would be to enable logging to see the information about why its being dropped iptables -N LOGGING iptables -A INPUT -j LOGGING iptables -A LOGGING -m limit --limit 2/min -j LOG --log-prefix "Dropped: " --log-level 4 iptables -A LOGGING -j DROP test and check in /var/log/messages – notsoslimshady Jun 17 '19 at 19:05
1

Using the iptables logging (as suggested by @notsoslimshady) I was able to see what I was previously missing. The printer is now found as a network printer.

iptables -A INPUT -p tcp --dport 631 -j ACCEPT
iptables -A INPUT -p udp --dport 631 -j ACCEPT
iptables -A OUTPUT -p udp --dport 161 -j ACCEPT
**iptables -A INPUT -p udp --sport 161 -j ACCEPT** <-- Missing rule
||improve this answer||||
  • Yes, the identification of network printers often uses SNMP, which usually uses only UDP in firmware-embedded implementations. More advanced SNMP implementations like net-snmp might also have the option of using TCP, but UDP is still the standard default for SNMP. – telcoM Jun 19 '19 at 7:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for?Browse other questions tagged or ask your own question.