Hi vodoo, here I’m again… 
…
In the firewall configuration script ipp=631, they are equivalent. Use one or the other. Open that port for both, TCP and UDP. FW_CONFIGURATIONS_EXT=“cups” should do the same, so it’s double.
…yes I think so, I’ve noticed btw, if I select the checkbox “open port firewall” in yast>hardware>printers it inserts in the firewall services allowed list “SERVER IPP” and not “cups” … little bit funny ?!? btw I think it doesn’t matter, probably “SERVER IPP” and “cups” are double voice in the list ?! or we need insert both ?!?
They changed the syntax for FW_DEV_EXT between some of the releases, but I don’t know when. On some systems it’s: FW_DEV_EXT=“any eth-id-00:30:1b:b9:4b:8c”. Please check the comments in /etc/sysconfig/SuSEfirewall2. It could be: FW_DEV_EXT=“any eth0”. You must be able to cleanly start and stop your firewall.
So I insert the string “any eth0” but firewall behaviour is the same… Just booted my server cups is not visible and checkin’ its status no port 631 are visible and from client.
If I type “SuSEfirewall2 status” I get this… and no port 631 are visible…
### iptables filter ###
Chain INPUT (policy DROP 739 packets, 110K bytes)
pkts bytes target prot opt in out source destination
8243 3297K ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0
17018 11M ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state ESTABLISHED
0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED
Chain FORWARD (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
Chain OUTPUT (policy ACCEPT 8301 packets, 811K bytes)
pkts bytes target prot opt in out source destination
8243 3297K ACCEPT all -- * lo 0.0.0.0/0 0.0.0.0/0
Chain reject_func (0 references)
pkts bytes target prot opt in out source destination
0 0 REJECT tcp -- * * 0.0.0.0/0 0.0.0.0/0 reject-with tcp-reset
0 0 REJECT udp -- * * 0.0.0.0/0 0.0.0.0/0 reject-with icmp-port-unreachable
0 0 REJECT all -- * * 0.0.0.0/0 0.0.0.0/0 reject-with icmp-proto-unreachable
### iptables mangle ###
Chain PREROUTING (policy ACCEPT 26002 packets, 15M bytes)
pkts bytes target prot opt in out source destination
Chain INPUT (policy ACCEPT 26000 packets, 15M bytes)
pkts bytes target prot opt in out source destination
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
Chain OUTPUT (policy ACCEPT 16544 packets, 4107K bytes)
pkts bytes target prot opt in out source destination
Chain POSTROUTING (policy ACCEPT 16626 packets, 4119K bytes)
pkts bytes target prot opt in out source destination
### iptables nat ###
Chain PREROUTING (policy ACCEPT 651 packets, 95273 bytes)
pkts bytes target prot opt in out source destination
Chain POSTROUTING (policy ACCEPT 236 packets, 33158 bytes)
pkts bytes target prot opt in out source destination
Chain OUTPUT (policy ACCEPT 236 packets, 33158 bytes)
pkts bytes target prot opt in out source destination
note also (I booted about 20 min. ago) if I type “cat /var/log/messages | grep firewall | tail -10” I get
Sep 2 09:11:33 pulsarx SuSEfirewall2: /var/lock/SuSEfirewall2.booting exists which means system boot in progress, exit.
Sep 2 09:11:33 pulsarx SuSEfirewall2: /var/lock/SuSEfirewall2.booting exists which means system boot in progress, exit.
Sep 2 09:12:11 pulsarx SuSEfirewall2: /var/lock/SuSEfirewall2.booting exists which means system boot in progress, exit.
Sep 2 09:12:24 pulsarx SuSEfirewall2: Setting up rules from /etc/sysconfig/SuSEfirewall2 ...
Sep 2 09:12:25 pulsarx SuSEfirewall2: using default zone 'ext' for interface vboxnet0
Sep 2 09:12:25 pulsarx SuSEfirewall2: batch committing...
Sep 2 09:12:25 pulsarx SuSEfirewall2: Firewall rules successfully set
Sep 2 09:33:42 pulsarx SuSEfirewall2: batch committing...
Sep 2 09:33:43 pulsarx SuSEfirewall2: Firewall rules set to CLOSE.
Sep 2 09:33:52 pulsarx SuSEfirewall2: /var/lock/SuSEfirewall2.booting exists which means system boot in progress, exit.
I note the last line (after boot), it seems something keep in hang firewall…
If after I type rcSuSEfirewall2 force-reload o start… I can force and load “fine” firewall and now I get port 631 visible and client are able to catch my server cups…
bah really strange behaviour… 
As for cups.conf: probably to have to check it again. But here I now almost nothing, sorry.
I think my cups.conf is somewhat fine… 'cause if I disable firewall or restart it, cups service are ok…
thx
