• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

Sharing a network printer between two LAN networks

Scheduled Pinned Locked Moved Firewalling
17 Posts 4 Posters 8.9k Views
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • A
    amcoolio
    last edited by Jul 25, 2016, 9:37 PM

    Hello all, I apologize for starting a new topic but I have searched and can't find the solution.

    I have Pfsense set up as a router with three NIC's. The first one is WAN - standard cable internet. The second one is LAN (10.1.0.1/24) - allows one of the office computers and the public wifi WAP's so it is an open network. The third is BACKOFFICE (10.2.0.1/24) and it is a closed network that has all the Point-Of-Sale computers and printers, and credit card terminals, and can't be accessed by the LAN or the public. It only uses the WAN to process credit card payments. Everything is working fine the way it is supposed to. Pfsense is a lifesaver in this regard and I've saved thousands (I am a restaurant owner and chef, but a computer hobbyest so I have the basic sense of networking down). So thanks!

    I have a wireless laser printer that is currently on the LAN network that I use to print everyday things (applications, tax forms, receipts, etc.) But I need the BACKOFFICE network to print a daily report of credit card transactions as well. So far, I've tried a bunch of different firewall rules but I can't get BACKOFFICE to find the printer.

    The printer's IP is 10.1.0.73. Due to the very small, brick-like, and the "I don't need more heat in here" nature of the server room the large laser printer is in a separate room so it has to be connected wirelessly.

    TL;DNRWhat firewall rule would allow 10.2.0.50 to connect to 10.1.0.73? Thanks so much for the help!

    1 Reply Last reply Reply Quote 0
    • J
      jahonix
      last edited by Jul 25, 2016, 10:28 PM

      @amcoolio:

      …I can't get BACKOFFICE to find the printer.

      Try to ping it's IP from the computer you want to print from.

      "Finding" a printer is difficult across subnets because that's handled by broadcasts which are not routed between subnets.
      However, you can add the printer manually with the IP specified. You will be able to print if rules permit. Just not find it or "see" the printer in network neighborhood.

      1 Reply Last reply Reply Quote 0
      • A
        amcoolio
        last edited by Jul 25, 2016, 10:40 PM

        Pings fine, 5ms. However when I try to add it manually in Windows it can't connect to the printer.  Nor can the Brother software find the printer when typing the IP manually.

        1 Reply Last reply Reply Quote 0
        • J
          jahonix
          last edited by Jul 26, 2016, 12:47 AM

          Your firewall rule(s) allow traffic from 10.2.0.50 host to your printer's IP for TCP and UDP protocols on any ports?

          1 Reply Last reply Reply Quote 0
          • A
            amcoolio
            last edited by Aug 2, 2016, 1:31 AM

            Sorry for the late reply. Yes, I added those rules. I can ping the printer through the command prompt just fine, but when I try to do so in a browser, I get connection timed out.

            I even tried a rule that allows the BACKOFFICE Net to reach the LAN Net, but to no avail.

            I guess the printer doesn't like talking across networks? 10.1.0.73 -> 10.2.0.50

            1 Reply Last reply Reply Quote 0
            • J
              johnpoz LAYER 8 Global Moderator
              last edited by Aug 2, 2016, 1:37 AM

              "I guess the printer doesn't like talking across networks? 10.1.0.73 -> 10.2.0.50"

              Well does your printer have a gateway set?  If not then no its not going to be able to talk across networks.  When you say you can ping it.. Your pinging it from where?

              An intelligent man is sometimes forced to be drunk to spend time with his fools
              If you get confused: Listen to the Music Play
              Please don't Chat/PM me for help, unless mod related
              SG-4860 24.11 | Lab VMs 2.8, 24.11

              1 Reply Last reply Reply Quote 0
              • W
                W4RH34D
                last edited by Aug 2, 2016, 4:08 AM

                Instead of punching a hole in your firewall for the industry's most hackable device (printers) would it be possible to do cloud printing instead with it?

                I also run a pci compliant network and printers are my worst issue by far.

                Did you really check your cables?

                1 Reply Last reply Reply Quote 0
                • J
                  johnpoz LAYER 8 Global Moderator
                  last edited by Aug 2, 2016, 10:33 AM

                  Allowing your 1 vlan to talk to your printer on your other vlan not really suer I would call that punching a hole in your firewall ;)  How would use cloud printing make that more secure?

                  While I don't agree with open all ports to the printer.. Sure doesn't need UDP to print.. Depending on the printing protocol he is using, they just need to open that tcp port.

                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                  If you get confused: Listen to the Music Play
                  Please don't Chat/PM me for help, unless mod related
                  SG-4860 24.11 | Lab VMs 2.8, 24.11

                  1 Reply Last reply Reply Quote 0
                  • J
                    jahonix
                    last edited by Aug 2, 2016, 11:42 AM

                    @amcoolio:

                    … in Windows it can't connect to the printer...

                    You have set your Windows firewall to allow traffic to the other subnet (which Windows sees as non-local)?

                    1 Reply Last reply Reply Quote 0
                    • J
                      johnpoz LAYER 8 Global Moderator
                      last edited by Aug 2, 2016, 12:02 PM

                      Where did he say this printer was being shared off a windows machine?

                      "I have a wireless laser printer that is currently on the LAN network"

                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                      If you get confused: Listen to the Music Play
                      Please don't Chat/PM me for help, unless mod related
                      SG-4860 24.11 | Lab VMs 2.8, 24.11

                      1 Reply Last reply Reply Quote 0
                      • W
                        W4RH34D
                        last edited by Aug 2, 2016, 4:10 PM

                        @johnpoz:

                        Allowing your 1 vlan to talk to your printer on your other vlan not really suer I would call that punching a hole in your firewall ;)  How would use cloud printing make that more secure?

                        While I don't agree with open all ports to the printer.. Sure doesn't need UDP to print.. Depending on the printing protocol he is using, they just need to open that tcp port.

                        Oh, then he's not compliant.  The cc processor must be separated by a firewall.

                        Did you really check your cables?

                        1 Reply Last reply Reply Quote 0
                        • J
                          johnpoz LAYER 8 Global Moderator
                          last edited by Aug 2, 2016, 4:56 PM Aug 2, 2016, 4:51 PM

                          Where does it say that the printer the cc processor prints to can not be on a different network?  He is not opening up traffic to the cc proc, he is opening up the cc proc to talk to the printer.

                          He does have a firewall, he just needs to open the ports to the printer.  He is prob trying to find the printer via broadcast or something?  If he is trying to use something like airprint for example that is not going to work out of the box across segments.  Would need something like ahavi to allow the discovery of the printer.

                          His rule on his backoffic interface is pointless since he has any any rules there.  So that first rule is just not needed at all.

                          Can you ping the printer?  What are you using for wifi?  You didn't put it behind a nat did you?  Can you ping the printer from your backoffice network?

                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                          If you get confused: Listen to the Music Play
                          Please don't Chat/PM me for help, unless mod related
                          SG-4860 24.11 | Lab VMs 2.8, 24.11

                          1 Reply Last reply Reply Quote 0
                          • W
                            W4RH34D
                            last edited by Aug 2, 2016, 6:25 PM

                            @johnpoz:

                            Where does it say that the printer the cc processor prints to can not be on a different network?  He is not opening up traffic to the cc proc, he is opening up the cc proc to talk to the printer.

                            He does have a firewall, he just needs to open the ports to the printer.  He is prob trying to find the printer via broadcast or something?  If he is trying to use something like airprint for example that is not going to work out of the box across segments.  Would need something like ahavi to allow the discovery of the printer.

                            His rule on his backoffic interface is pointless since he has any any rules there.  So that first rule is just not needed at all.

                            Can you ping the printer?  What are you using for wifi?  You didn't put it behind a nat did you?  Can you ping the printer from your backoffice network?

                            Agreed, that's what we use.  So ok, pci dss requires the processor and registers to basically be on their own subnet that is separated by hardware.  At least, that was my interpretation at the time.  Though as long as the device is business and not personal, it is allowed on the same subnet.  His separation of devices may be unnecessary.

                            Airprint would require internet access to the printer which, yes, is another can of worms.  However, printers are most vulnerable physically from what I've gathered.

                            Did you really check your cables?

                            1 Reply Last reply Reply Quote 0
                            • J
                              johnpoz LAYER 8 Global Moderator
                              last edited by Aug 2, 2016, 8:06 PM

                              airprint requires no internet access…  But it does require the device using the printer to be on the same layer 2 to discover it.

                              The OP has not stated how he is trying to print, what protocol, what printer.  His backoffice rules are any any.. So anything on that network would be able to access anything on the lan.  Unless there was software firewall on the lan devices..

                              I print from multiple segments all the time to my printer.  You just add the IP in the driver on your device, and open the ports your using.. 9100 is a common printer port for example.  But like I said his rules are any any so he has something else going on..  Like his wifi is behind some nat router plugged into his lan???  Once the OP gives some info to work with we can help him find his problem.

                              An intelligent man is sometimes forced to be drunk to spend time with his fools
                              If you get confused: Listen to the Music Play
                              Please don't Chat/PM me for help, unless mod related
                              SG-4860 24.11 | Lab VMs 2.8, 24.11

                              1 Reply Last reply Reply Quote 0
                              • W
                                W4RH34D
                                last edited by Aug 2, 2016, 8:55 PM

                                @johnpoz:

                                airprint requires no internet access…  But it does require the device using the printer to be on the same layer 2 to discover it.

                                The OP has not stated how he is trying to print, what protocol, what printer.  His backoffice rules are any any.. So anything on that network would be able to access anything on the lan.  Unless there was software firewall on the lan devices..

                                I print from multiple segments all the time to my printer.  You just add the IP in the driver on your device, and open the ports your using.. 9100 is a common printer port for example.  But like I said his rules are any any so he has something else going on..  Like his wifi is behind some nat router plugged into his lan???  Once the OP gives some info to work with we can help him find his problem.

                                Oh right - I was thinking cloud printing.

                                Yeah who knows what OP has got going on.  Airprint is supposed to be close to NFC just through the wireless of the printer and device sending the print.  Logistically that may be impossible so what I was really recommending is cloud printing if OP does indeed need to separate his lan.

                                Did you really check your cables?

                                1 Reply Last reply Reply Quote 0
                                • J
                                  johnpoz LAYER 8 Global Moderator
                                  last edited by Aug 3, 2016, 2:36 AM

                                  how would could printing be compliant?

                                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                                  If you get confused: Listen to the Music Play
                                  Please don't Chat/PM me for help, unless mod related
                                  SG-4860 24.11 | Lab VMs 2.8, 24.11

                                  1 Reply Last reply Reply Quote 0
                                  • W
                                    W4RH34D
                                    last edited by Aug 3, 2016, 3:02 AM

                                    Oh just like any other web service, I guess.  Shouldn't impact him any more than having the firewall open for the printer on whatever ports he's going to use.

                                    It would only be a compliance issue if the printer was for personal use and on the business network, or if the device somehow opens ports on the wan firewall that a scanner would pick up.  Or if he somehow managed to be plugged into the ethernet of the business and the wifi portion connected to the guest.  You know, crazy stuff that happens by accident all the time.

                                    Did you really check your cables?

                                    1 Reply Last reply Reply Quote 0
                                    • First post
                                      Last post
                                    Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.
                                      This community forum collects and processes your personal information.
                                      consent.not_received