SMB | Two Vlans

yuriewcli

Hi,

Am I missing something?

I'm trying to access SMB protocol from vlan1 to vlan2.
But it can't.

Already set rule to allow SMB protocols TCP 445, 139.
I also tried to set the protocol to "any".

Ping are okay.

The device is printer(with scanner) from vlan1.. and a computer in vlan2
The scanned file should store the document to vlan2

yuriewcli

Hi.. Please, I need your expertise, I'm stuck for weeks already.
We have installed a centralized printer - XEROX ALTALINK 8035 in the office with assigned IP: 10.0.11.3

Our office has been setup to have vlan for each dept.
For the sake of the discussion, i'll say IT dept network range is 10.0.12.0/24.
Support Dept is 10.0.11.0/21 where the printer is also connected.

Now, the thing is, printing is okay, we can print from IT dept. But we can't scan.
We are using SMB protocol.
In case needed, yes, Support Dept can scan thru SMB protocol.

As for the rules. I already used "any" protocol aside from SMB ports (445 and 139)

Rule 1
Source: Printer IP
Dest: IT
Protocol: Any

Rule 2
Source: Printer IP
Dest: IT
Protocol: TCP
Port: 445, 139

Rule 3
Source: Support subnets
Des: IT Subnets
Protocol: any

Please help !!

slu

@yuriewcli

Diagnostics / Packet Capture and limit it to the source or destination ip
Don't limit it to the ports, try if it works and click onto the states to see what protocol / port was used

patient0

@yuriewcli please don't double post and this is not the right place. But you provided more helpful infos than in the other thread.

@mods can you merge this with https://forum.netgate.com/topic/196932/smb-two-vlans ?

JKnott

@yuriewcli

How are you trying to connect? If you're waiting for the server to just appear, it won't, as that requires broadcasts which are not passed through a router. You have to use the IP address.

stephenw10

Merged.

Yes, probably needs a different port. 9400 perhaps.

yuriewcli

@slu hi.. i did the packet capture.
![alt text](image url)

i don't understand this though ..

yuriewcli

@stephenw10 i tried this.
TCP port 9400, still didn't pass through

johnpoz

@yuriewcli not sure why you wouldn't show the IPs - would assume they are rfc1918, but there is not much can tell you from what you posted.. Other than whatever you were talking to on 443, which is https - not smb nor printing is sending you a FIN, ie done with this conversation.

If where are you placing those rules you list? Rules are evaluated on the interface traffic enters pfsense - if the source is printer IP, that would be on the printer vlan/network interface..

the support subnets would need to be on the support vlan/network interface.

If you have any rules - those other rule is going to be meaningless your already allowing any, not sure how allowing 445 or 139 wouldn't be included in ANY ;)

Your issue is not related to rules if you have an ANY rule that is for sure... Doe these rules force traffic out a gateway??

Do you have any floating rules? If you say you can print from any network to these printers.. But can't scan - and your using any rules points to something else being wrong, like scanning is not setup correctly, etc. Where is the printer suppose to do with its scan, where is it suppose to store the scan via smb? On the clients machine, on some file share?

Gertjan

@yuriewcli said in SMB | Two Vlans:

For the sake of the discussion, i'll say IT dept network range is 10.0.12.0/24.
Support Dept is 10.0.11.0/21 where the printer is also connected.

Now, the thing is, printing is okay, we can print from IT dept. But we can't scan.

First : 10.0.11.0/21 : are you sure about that /21 ?
Without firing up my network calculator, this /21 might overlap your 10.0.12.0/24 .... introducing network issues.

A device, lets imagine a Windows PC, living on 10.0.12.0/24 can connect to a device on 10.0.11.3/24 (the printer) : it can print. If SMB doesn't seem to work : use the printer IP, and your good.
Or assign a local DNS host name to "10.0.11.3" and use that wherever possible.

The other way around : the scanner : did you check that the destination of the scanner, as it is a device living outside of the local (printer's point of view) is reachable ,
Windows devices, afaik, only accept, by default SMB traffic from their own local network, like 10.0.12.0/24 only.
You have to visit the Windows firewall on that PC, and add other networks like 10.0.11.0/24.
Normally, you should have a shared directory on the PC so the scanner can access it and drop the image or PDF scanned files.