0

We configure the printer in the organization. The scheme of work is as follows. There is a network of computers connected over a closed VPN network. All computers on the network have ip addresses such as 10.15.0.1, 10.15.0.2, etc. There is a central cups server version 2.2.7 at 10.15.0.200. On this server, in fact, all printers on the network are added.

On each computer, the printer is connected via wifi direct connect so that the computer itself has an IP address of 192.168.115.2, and the printer is 192.168.115.1. At the same time, for the possibility of sending print jobs from a central server, the following iptables are installed on each device

* filter
INPUT ACCEPT [00]
FORWARD ACCEPT [00]
OUTPUT ACCEPT [00]
COMMIT
# Completed on Sun Oct 20 235552 2019
# Generated by xtables-save v1.8.2 on Sun Oct 20 235552 2019
* nat
PREROUTING ACCEPT [00]
INPUT ACCEPT [00]
POSTROUTING ACCEPT [00]
OUTPUT ACCEPT [00]
-A PREROUTING -s 10.15.0.0/24 -p tcp -m tcp --dport 80 -j DNAT --to-destination 192.168.115.180
-A PREROUTING -s 10.15.0.0/24 -p udp -m udp --dport 80 -j DNAT --to-destination 192.168.115.180
-A PREROUTING -s 10.15.0.0/24 -p tcp -m tcp --dport 443 -j DNAT --to-destination 192.168.115.1443
-A PREROUTING -s 10.15.0.0/24 -p udp -m udp --dport 443 -j DNAT --to-destination 192.168.115.1443
-A PREROUTING -s 10.15.0.0/24 -p tcp -m tcp --dport 632 -j DNAT --to-destination 192.168.115.1631
-A PREROUTING -s 10.15.0.0/24 -p udp -m udp --dport 632 -j DNAT --to-destination 192.168.115.1631
-A PREROUTING -s 10.15.0.0/24 -p tcp -m tcp --dport 161 -j DNAT --to-destination 192.168.115.1161
-A PREROUTING -s 10.15.0.0/24 -p udp -m udp --dport 161 -j DNAT --to-destination 192.168.115.1161
-A PREROUTING -s 10.15.0.0/24 -p tcp -m tcp --dport 162 -j DNAT --to-destination 192.168.115.1162
-A PREROUTING -s 10.15.0.0/24 -p udp -m udp --dport 162 -j DNAT --to-destination 192.168.115.1162
-A PREROUTING -s 10.15.0.0/24 -p tcp -m tcp --dport 9101 -j DNAT --to-destination 192.168.115.19100
-A PREROUTING -s 10.15.0.0/24 -p udp -m udp --dport 9101 -j DNAT --to-destination 192.168.115.19100
-A POSTROUTING -j MASQUERADE
COMMIT
# Completed on Sun Oct 20 235552 2019

We want to make our printer work using the ipp protocol. But when trying to connect, we get a Bad Request error. The web interface on port 80 is working fine. We also tried using the lpd protocol (port 9100), and then printing occurs, but sometimes we get Broken pipe errors, and the document is printed halfway, i.e. The print job breaks off in the middle, and does not end to the end. Therefore, we would still like to make the printer work using the ipp protocol. Other printer models (Kyocera, Ricoh) work normally with this network configuration. Judging by the fact that we get 400 Bad Request errors, there is a feeling that some kind of firewall is installed on the printer itself, or there is some kind of authorization. We could not find the settings to remove it.

There is the following observation. If Ipp is printed directly on the printer network (i.e., at 192.168.115.1), then everything works fine, but if a router appears on the path, or just some kind of relaying packets from one network to another, then a Bad error occurs Request. We have not yet managed to understand what exactly is the matter.

For me it seems like we have an error in our iptables. I guess it will work if we could send packages to the printer as it will see them like packages from the local 192.168.115.* network. So we have to change the source in the incoming package or something like that, because the printer tends to block packages from the outer network. But I don't know how to make it work in iptables.

The printer model is Canon Pixma MB2740.

  • I considered to use SNAT for INPUT sequence, it seems like connection is established but I couldn't get any response – Dmitriy Nov 15 '19 at 14:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.