iptables: forwarding port 9100 into a jetdirect printer on the lan

[shpshftr]

I am trying to let a company print out on the our jetdirect printer on our lan.

I am using Arno's iptables script to ease the administration of iptables.
I have set up tcp/udp forwarding for port 9100-9120. But connections still time out. :(
If i telnet into the printer from the linux-router-box, it works fine. :/

Any help would be greatly appreciated! :D

[Claudio Cilloni]

are you sure that IP forwarding on the linux-router-box is enabled?
the file /proc/sys/net/ipv4/ip_forward should be 1:

# cat /proc/sys/net/ipv4/ip_forward
1

if it isn't so, run this command:

# echo "1" >/proc/sys/net/ipv4/ip_forward

hth,
Claudio

[shpshftr]

cat /proc/sys/net/ipv4/ip_forward returns 1.
This is specified in the Arno iptable script.

But, thanks for the reply, anyway. (gave you a point)

[Manuel Wolfshant]

No idea what that script does, but
- AFAIK, jetdirect only uses TCP, port 9100. at least this is what I've been using in the last 3.5 years
- make sure you do not block tcp port 9100 in any table (mangle/filter/nat).

Also, in the script you should include something similar to:
iptables -A PREROUTING -t nat -p tcp -d $EXTERNAL_IP -i $EXTERNAL_INTERFACE --dport 9100 -j SNAT --to $HP_PRINTER_IP
iptables -A FORWARD -d $HP_PRINTER -s $YOUR_PARTNER_IP -j ACCEPT

You could use tcpdump/ethereal and/or some iptables -j LOG rules to debug the connection. If your kernel + iptables are patched using patch-o-matic, you could also use some -j TRACE rules.

One last point: on most distributions, /proc/sys/net/ipv4/ip_forward can be set to "1" only once, during startup, using /etc/sysctl.conf or rc.local. No need to include this setting in a firewall script which might be run several times after the machine boots.