Printing through Firewall

[John J Read]

I've seen a lot of threads on this topic but none that addressed my issue. I'd appreciate any advice anyone has.

I need to print from my HP-UX 11i server inside the firewall to a network printer in a remote office. The firewall team opened all ports "from" my server to the printer and a portscan shows them as open. No ports are open coming back in. I can't ping due to no ICMP. I faked out JetAdmin by configuring an identical printer, then changed the IP address in /var/spool/lp/interface.

However, any lp sent will just sit in the queue.

Questions:

Do I need to allow the printer to "see" any ports on my server inside the firewall?

Will this ever work without ICMP ping?

[Joe Harrison_1 · Accepted solution]

You should not need to open any port on the system you are printing from (assuming it is behind a NAT firewall), the return TCP port is auto-negotiated at the client and firewall.

The destination printserver is a different matter. At the destination firewall, forward TCP port 515 to the the internal IP address of the printserver if using BSD printing(LP). If using JetDirect printing forward TCP Port 9100.

If it is still not working post the results summary of 'tcpdump host and port 515 or port 9100' from SYN,SYN/ACK,ACK to FIN,FIN/ACK,FIN,FIN/ACK.

Since opening ports like this to printers is not very secure, I would look into investing in a VPN.