pfSense 2.7 makes HP printers crash

jonatkins

I've had an odd problem with pfSense and HP wifi printers.
Replaced an ISP-supplied router with pfSense on a mini-pc and a Unifi AP.

Everything worked except for HP wifi printers.

Same problem with both an old HP ENVY 4500 printer, and a brand new HP DeskJet 2820e.
The printers connect to the AP, but then crash without being assigned an IP address.

After several days of trying to get things working, eventually found this post: https://forums.lawrencesystems.com/t/pfsense-2-7-and-dhcp-to-hp-printer/18054

The solution there (blocking IPv6) fixed the issues, both printers now connect and work.

Setup:

pfSense on a mini PC, Unifi AP for wifi
WAN is via PPPoE, with a static IPv4 address and no IPv6
LAN is a 192.168.X.0/24 block IPv4, and no IPv6 configured (however IPv6 link-local addresses will still be there)
IPs assigned by ISC DHCP
Firewall rules allowed all IPv4 and IPv6 traffic to access the router itself

Removing the rules allowing IPv6 fixed the problem.

Now this sounds like a problem with the HP printers, but it's been seen in models released 10+ years apart. Also, as the above post mentioned, it wasn't an issue in pfSense 2.6, so something changed to break things.

I don't have time or skills to investigate any further, but perhaps someone can look into this?

w0w

@jonatkins
Did you install recommended patches via system package?

johnpoz

@jonatkins said in pfSense 2.7 makes HP printers crash:

and no IPv6
IPv6 traffic to access the router itself

Why would you bother to have rules to allow for IPv6, if you have no IPv6?

Seems like maybe the printer is trying to talk via its link local IPv6 and causing it to freak out when something doesn't work?

w0w

@johnpoz
Thats why I asked him about patches. On the clean 2.7.2, for example, ULA is broken by default and something else, maybe that's the cause of the problem. HP itself states that when printer see IPv6 it definitely want to use it instead of IPv4.

jonatkins

@w0w I wasn't even aware of the "system patches" package - good to know. Any specific patches I should enable? I can't see anything relevant.

@johnpoz why not - shouldn't cause any harm, right? I plan to get IPv6 enabled soon, and the default rules had both IPv4 and IPv6 entries, so I just followed that when making appropriate changes.

Anyway, I mainly wanted to increase visibility of this issue, as it could save someone else a lot of time.

johnpoz

@w0w but ula is something the user would have to setup up.. Maybe he did and just didn't mention it?

Maybe his dhcp was handing out some ula, or maybe he some sort of bad ipv6 config from his isp that didn't actually work - but printer thought it should..

Printer having a link local sure shouldn't think it could use it for really anything that should freak it out.. And nothing you could do via dhcp or anything on pfsense that would stop the printer from having a link local.. But if you had no IPv6 rules then yeah printer wouldn't even be able to talk to pfsense via link-local..

I don't have a hp printer to play with - but would be curious to what is actually going on with the printer..

johnpoz

@jonatkins said in pfSense 2.7 makes HP printers crash:

I mainly wanted to increase visibility of this issue

yeah its good info for sure.. if you plan on setting up IPv6 I could see not removing the rules I guess.. I allow ipv6 on my lan, but I don't normally use it.. I have it disabled on clients, and if want to play/test something I just enable it on the client so I leave the rule there myself to make it easier to enable - just click on client vs having to access pfsense to enable a ipv6 rule, etc.

jonatkins

Possibly relevant info. The mini-pc running pfSense has 4 lan ports. The first is configured as WAN for the PPPoE connection, the other three ports are configured together as a bridge. The LAN rules are configured on an interface group which includes the bridge and three LAN ports.

And no, I haven't configured any ULA. And the LANBRIDGE interface is configured for IPv4 Static and IPv6 None. No signs of any IPv6 in the PPP negotiation from the ISP either.

This whole setup is at my mum's house, and I'll be leaving in a few days. She won't be happy if I keep breaking the internet to experiment with this :)

I do have pfSense running at home too, but that has a working IPv6 setup. I have an even older HP printer there, and that did connect successfully. Not sure if it supports IPv6, but I'll check when I get home next week.

w0w

@jonatkins said in pfSense 2.7 makes HP printers crash:

Any specific patches I should enable? I can't see anything relevant.

I am not sure, but you can try apply all recommended patches, just for test, i think most of them anyway will be applied on the next version available.