What setting(s) do I have to put in my firewall to allow my printers to work?

English Hardware
1

Hi All,
I have been wrestling with the problem of getting my printers to work on OpenSuse Tumbleweed. I only installed it a couple of days ago so still finding my way around.
After a lot of searching in forums I finally tried turning my firewall off, and waddyaknow, I got them both working with a minimum of fuss. So my question now is; what do I have to set in my firewall config to allow the printers to work? And still have the firewall active.
When I open the firewall utility I see that the ā€œhomeā€ zone (which makes the most sense for me, Iā€™m the only one using this computer) the allowed services are dhcpv6-client, mdns, samba-client, and ssh. None of these, apparently, will let my PC talk to my Brother hl-l2305w laser printer or my Epson Expression 442 printer. Both are using ipp I believe, but when I put ipp in the home zone services it still wonā€™t print. These are the details.

Screenshot_20230814_170333
Screenshot_20230814_170333977Ɨ696 52.4 KB

Screenshot_20230814_170451
Screenshot_20230814_170451885Ɨ696 51.1 KB

All advice gratefully received.

2

Can you show the firewall configuration?

sudo firewall-cmd --zone=home --list-all

3

@deano_ferrari Thanks for the quick reply. Hereā€™s the output.

ian@OpenSusian:~> sudo firewall-cmd --zone=home --list-all
home (active)
  target: default
  ingress-priority: 0
  egress-priority: 0
  icmp-block-inversion: no
  interfaces: enp5s0
  sources: 
  services: dhcpv6-client ipp ipp-client
  ports: 
  protocols: 
  forward: yes
  masquerade: no
  forward-ports: 
  source-ports: 
  icmp-blocks: 
  rich rules: 
ian@OpenSusian:~>
4

The mdns service is not allowed. That will be needed in order to resolve the Avahi hostnames defined in your printer configuration.

2 Likes
5

Like this?

ian@OpenSusian:~> sudo firewall-cmd --zone=home --list-all
home (active)
  target: default
  ingress-priority: 0
  egress-priority: 0
  icmp-block-inversion: no
  interfaces: enp5s0
  sources: 
  services: dhcpv6-client ipp ipp-client mdns
  ports: 
  protocols: 
  forward: yes
  masquerade: no
  forward-ports: 
  source-ports: 
  icmp-blocks: 
  rich rules: 
ian@OpenSusian:~> 


Well that seems to have done it! A print that was waiting printed as soon as I added mdns.

Thanks!
;-) Ian
6

@deano_ferrari Is there a way to mark the problem solved? And link to your post as the solution?

7

Glad to have been of guidance.

8

No, we donā€™t do that here, but those reading this thread will understand that it is resolved for you. :wink:

9

I thought Iā€™d solved this problem with @deano_ferrari 's help, but now itā€™s occurring again. Iā€™v had to completely reinstall OpenSuse since I posted this, so not sure if Iā€™ve missed something else. Anyway, same problem, my printer wonā€™t print unless I disable the firewall.

Screenshot_20240119_124042
Screenshot_20240119_124042903Ɨ574 49.3 KB

image
image746Ɨ343 21.8 KB

image
image858Ɨ387 21.3 KB

image
image1320Ɨ466 37.6 KB

Not sure what Iā€™ve done wrong. All advice gratefully received.

:-\

10

Did you reload the firewall after making changes?

11

Iā€™m assuming thatā€™s what the yast firewall gui does when I click ā€œacceptā€. Iā€™ve restarted since making the changes too so it should all be there. But when I print a test page the status is shown as ā€œunable to locate printerā€

But if I turn off the firewall it prints immediately.

<30 minutes later>

So I did a bit of RTFMing and I think, even though I changed the zone in the yast firewall app to ā€œhomeā€, I think it wasnā€™t actually using that zone, but the default zone, ā€œpublicā€. So I changed the zone to public in the yast app (to associate it with esp5s0(?) ) , which is the default zone, and added ipp, ipp-client, and mdns to the public zone, and it now seems to be working. No idea what the yast app is doing (and very confusing to use I have to say, for us mere mortals who are not experts on firewalls and how they work) but it seems Iā€™ve stumbled on the/a solution.

Thanks, :slight_smile:

12

I donā€™t use the YaST app for firewall management, but in any case your firewall-cmd output showed the enp5s0 interface was assigned to the ā€˜homeā€™ zone. Maybe that wasnā€™t the interface that is connected to your LAN? Always good to check the relevant zones and interfaces first.

13

If it can help, I struggled with the same kind of issue on TW for a long time, and ultimately gave up on relying on the Yast firewall module since changes done there donā€™t seem to be persisted as they should.

I run a script like this one whenever I need to reinstall my system:

sudo firewall-cmd --permanent --new-service=chromecast
sudo firewall-cmd --permanent --service=chromecast --set-description=Chromecast
sudo firewall-cmd --permanent --service=chromecast --set-short=chromecast
sudo firewall-cmd --permanent --service=chromecast --add-port=32768-61000/udp
sudo firewall-cmd --permanent --service=chromecast --add-port=8008-8009/tcp
sudo firewall-cmd --permanent --service=chromecast --add-source-port=32768-61000/udp

sudo firewall-cmd --permanent --new-service=chromecast-ssdp
sudo firewall-cmd --permanent --service=chromecast-ssdp --set-description=Chromecast\ SSDP
sudo firewall-cmd --permanent --service=chromecast-ssdp --set-short=chromecast-ssdp
sudo firewall-cmd --permanent --service=chromecast-ssdp --add-port=1900/udp
sudo firewall-cmd --permanent --service=chromecast-ssdp --set-destination=ipv4:239.255.255.250/32

sudo firewall-cmd --zone=home --add-service=chromecast-ssdp --permanent
sudo firewall-cmd --zone=home --add-service=chromecast --permanent
sudo firewall-cmd --zone=home --add-service=mdns --permanent
sudo firewall-cmd --zone=home --add-service=dhcpv6-client --permanent
sudo firewall-cmd --zone=home --add-service=ipp-client --permanent
sudo firewall-cmd --zone=home --add-service=samba-client --permanent
sudo firewall-cmd --zone=home --add-service=ssh --permanent
sudo firewall-cmd --reload

sudo firewall-cmd --set-default-zone=home

You probably wonā€™t need all of it, skip the first two blocks if not interested in casting to Google Home/TV devices, and in the third block keep only mdns (ipp can also be useful for printing, IIRC).

And definitely keep the last command.

BTW I wonder if Chromecast service in the firewall settings could be shipped by default in new opensuse installs. I found those two blocks somewhere on the web, but wouldā€™ve been nice to find It pre-defined in the list of available fw servicesā€¦

@malcolmlewis