[QUOTE]FYI, here’s a brief description how your firewall configuration is implemented.
[LIST]
[]When you use YaST Firewall, it saves the configuration in /etc/sysconfig/SEfirewall2.
[]If you prefer and if you know what you are doing, you can use a text editor to change /etc/sysconfig/SEfirewall2 yourself.
[]When you start the firewall (rcSuSEfirewall2 start) the configuration is read from /etc/sysconfig/SEfirewall2 and used to create a set of “iptables” rules.
[]These rules are what really control access to your system.
[]When you stop the firewall (rcSuSEfirewall2 stop) the rules are removed from “iptables”
[]
[/LIST][/QUOTE]
When troubleshooting, it is important to change only one thing at a time and observe how it affects everything!
Forget about iptables. I only mentioned it because it was an easy way to see what directives were in effect. If you need to configure your firewall, use YaST - Firewall.
Things are becoming way too complicated. I can’t follow what changes you are making and I don’t know which system you are changing.
In another post I suggested that we get things working from your SLED system first. That is your laptop, is it not? You said you can print when the firewall is disabled but not when it is enabled. That suggests it is a simple firewall issue.
[LIST]
[]Find out what ports need to be open to print to your HP printer. Please tell us.
[]Use YaST - Firewall to open the appropriate ports.
[/LIST]
Once you have this part working, we can continue looking at other issues.
The problem is: Sometimes printer work. It can happen i change w.g firewall and the printer works, but not next day with same setup.
It is not stable.
Further, the DELL printer prints always, in-dependent what I do. Only the HP printer is a problem.
I made several test in weekend. The printer itself mention in the display, the print file is not complete send.
I tested with and without firewall.
With different print driver
different setup.
All that is collected in a file to get a better description and systematic overview.
For me, it is quite confusing.
I made several dumps too showing the LAN traffic. I can load them up too - fitting to the document attached here.
Same PC as before, firewall on.
Used my KVM viortual machine on this PC and started WIN10 on it.
installed the HP laserjet automatically and printed from Win10 via SUSE on HP laserjet
successfully.
[QUOTE=hcp_dk;36880]I made several test in weekend. The printer itself mention in the display, the print file is not complete send.
I tested with and without firewall.[/QUOTE]
I looked at the PDF file you provided. On Page 3, I see this:
[QUOTE]linuxSLES:/home/hans-christoph # snmpwalk -Os -c public -v 1 10.0.25.26
1.3.6.1.4.1.11.2.3.9.1.1.7.0[/QUOTE]
Please answer these questions:
[LIST=1]
[]Is “LinuxSLES” your server?
[]I thought we were going to get this working on your SLED system first?
Are you able to print from SLED to the HP printer with your firewall enabled?
[*]Please confirm: SLED is running on your laptop?
[/LIST]
In another post, you said:
The firewall screen shots show both an internal and an external interface.
[LIST=5]
[]What system was this screen shot taken on?
[]Why does it have multiple interfaces when you said you are using an external firewall?
[]Please provide the IP addresses for each interface.
[]Did you run the five Tests from your SLES or your SLED system?
[/LIST]
On Page 3 of the PDF, where it says “open ports manuell:”, you show the Custom Allowed Rules. They are not configured correctly!
[LIST]
[]The source network should not be “0/0” (any network). Since your printing is between devices on your LAN, the source network should be your LAN. Example: 192.168.1.0/24.
[]Do not configure a Source Port. Source ports usually cannot be predicted. If you do configure one, all traffic will likely be blocked because the actual source port will not match the one you specified.
[/LIST]
Please correct your firewall configuration and provide the requested information.
Hi Kevin,
first of all thank for support and engagement.
I have SLED (Laptop) and SLES+Workstation Extension on a PC. SLES to see how that works. I agree, we stick to SLES since both systems, even very alike, seems to act different.
SLES is on LAN.
The Server is an Windows Server 2008 - Active Domain. SLES works as Desktop.
I tried and tested in the beginning from both systems, since they should be alike. I found out that it might work one day or hour once, but not later. Why I don’t know?
In general, I can’t print stable from Linux system on HP laserjet.
(Just as Note: I have another PC with Leap42.1 Here I can’t print too. )
The whole system is like: 100Mbits WAN - Modem - Trustgate (DHCP) - Asus WLAN accesspoint
from here WLAN and LAN to whole system.
Since all printer etc. are in the “internal system”, Trustgate firewall is not important.
All print screens are from SLES system, from the here called internal zone and external zone. The network card is on internal zone. The SUSE Firewall provide these zones default: internal zone and external zone.
All data and print screens come from SLES.
The trustgte has IP 10.0.25.1
Win Server IP 10.0.25.4
HP Laserjet IP 10.0.25.26
SLES has a dynamic adress obtained from DHCP server.
I made a check of all ports via nmap.
I made 7 tests (I send a link later where I showed I can print from virtual box KVM and Windows10 via SLES to HP laserjet.
I made for all test LAN dumps.
Printer shows: Not all data arrived the printer.
Custom rules:
On HPLIP website HP suggest open some ports manually to solve possible issues. I put the links too. I followed that. [QUOTE]http://hplipopensource.com/node/216 [/QUOTE] and [QUOTE]http://hplipopensource.com/node/375[/QUOTE]
Maybe you can help me to set these rules correctly?
I’ll try correct the port informations as mentiond.
thanks for support
I suggested you try to get printing working on your SLED desktop/laptop first.
You said that you can print to the HP printer from your laptop when the firewall is disabled so this should be a simple firewall configuration issue.
In my previous post I pointed out some firewall configuration issues which should be easy to correct. Printing should work once your firewall is configured correctly.
Once you can print from your laptop, you will know what the correct firewall settings are. You can then use the same settings on your SLES system. That may not be enough to let you print from your SLES system because I suspect there may be other configuration issues we will need to look at.
Okay, for now we will ignore the Trustgate firewall.
Let’s look a little closer at this:
[LIST]
[]The external zone is considered unsafe. Traffic to and from this zone is blocked by default. Exceptions are needed to permit traffic.
[]The internal zone is considered safe. Traffic to and from this zone is permitted by default.
[*]
[/LIST]
You said:
To simplify the firewall configuration each interface, Network Interface Card (NIC), is assigned to a zone. While a zone can have multiple NICs assigned to it, if you only have one NIC, how can you have both an internal and an external zone?
acc. to documentation, in internal zone, all ports are open.
The NIC is in internal zone.
That means, all ports should be open.[/QUOTE]
I agree with your conclusion!
[QUOTE]Why can i print via KVM and Win10, not via SUSE?
Why is not the whole file send?[/QUOTE]
That is what we are trying to find out.
[LIST]
[]You have two systems with printing issues: SLES (your server) and SLED (your laptop).
[]They both may or may not suffer from the same issue. That is still to be determined.
[]To simplify troubleshooting, we should not make assumptions. We need to verify everything.
[]When you provide additional information, please be sure to specify where the information was obtained (server or laptop).
[]Because you said you can print from your laptop when the firewall is disabled, it appears there is a firewall issue that should be easy to resolve. That is why I would like to resolve your laptop printing issue first.
[/LIST]
Please post the output from these commands:
[LIST]
[]Run them on your laptop.
[*]When posting the results, please use code tags: ("[SIZE=3]#[/SIZE]").
[/LIST]
virbr0 Link encap:Ethernet HWaddr 52:54:00:94:74:BC
inet addr:192.168.122.1 Bcast:192.168.122.255 Mask:255.255.255.0
UP BROADCAST MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:0 (0.0 b) TX bytes:0 (0.0 b)
wlan0 Link encap:Ethernet HWaddr A4:34:D9:D7:ED:71
inet addr:10.0.25.147 Bcast:10.0.25.255 Mask:255.255.255.0
inet6 addr: fe80::a634:d9ff:fed7:ed71/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:107089 errors:0 dropped:0 overruns:0 frame:0
TX packets:46230 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:147963529 (141.1 Mb) TX bytes:5659802 (5.3 Mb)
[/CODE]
I have installed KVM (virtual machine) on Laptop too because I use WIN10 for special engineering software within SUSE. VIBR is the LAN bridge to virtual machine
These data are now from Laptop. Both SLES, SLED[/QUOTE]
The output you provided appears to be from SLED. How is it from both SLESand SLED?
I know you want to get your printer working but here are some things to consider about your firewall:
Your laptop is currently connected to your LAN. If all your interfaces are assigned to the Internal Zone you are saying you trust everything and you do not need to configure special rules to allow communication with devices on your LAN. But what happens when your laptop is not connected to your LAN? If you are connected to a public Wi-Fi hotspot your firewall still treats it as an Internal zone and provides no protection at all. That is not good!
When you only have one zone, it should be the External zone and you should configure rules for all the services you need. This requires a bit more work but you want to keep your laptop secure. Normally, your firewall does not require special configuration to allow outgoing packets or to allow responses to them and there should only be a few cases where you want to allow unsolicited incoming packets.
I see this in your /etc/sysconfig/SuSEfirewall2 configuration:
FW_SERVICES_ACCEPT_INT="0/0,udp,5353,5353
0/0,udp,427,427"
It tells me you didn’t make the changes I asked in a previous post:
[QUOTE]On Page 3 of the PDF, where it says “open ports manuell:”, you show the Custom Allowed Rules. They are not configured correctly!
The source network should not be “0/0” (any network). Since your printing is between devices on your LAN, the source network should be your LAN. Example: 192.168.1.0/24.
Do not configure a Source Port. Source ports usually cannot be predicted. If you do configure one, all traffic will likely be blocked because the actual source port will not match the one you specified.[/QUOTE]
Also, the ports shown in this output from your laptop are different from those shown in the PDF. Make sure you have included all the necessary ports.
Okay, let’s try to get this working.
[LIST]
[]Make a backup copy of /etc/sysconfig/SuSEfirewall2
[]Use YaST Firewall to make these changes:
[/LIST][INDENT][LIST=1]
[]Assign all interfaces to the External Zone.
[]Remove from the Internal Zone all the Custom Allowed Rules
[]Setup the External Zone with all the Custom Allowed Rules shown on Page 3 of the PDF
[]When setting up the rules, the network should be 10.0.25.0/24
[*]When setting up the rules, the Source Port should blank.
[/LIST][/INDENT]
When you have finished, restart your firewall then test your printing from SLED.
If you still can’t print, please post the output from:
the data I send are from laptop with SLED as I wrote.
I mentioned that both SLES and SLED have same architecture. So they act same.
It is correct. Actual in my system the laptop is save. I wrote somewhere in documentation, I think about get SUSE on an AD Windows network, the Firewall need to be internal.
I probably need to switch when I’m not home? But you have a point there. I can try that later. It might be not too easy due to network.
The open port was on Laptop, I have not changed it. it comes from HPLIP trouble shooting…
[QUOTE=hcp_dk;36985]I wrote somewhere in documentation, I think about get SUSE on an AD Windows network, the Firewall need to be internal.
I probably need to switch when I’m not home? But you have a point there. I can try that later.[/QUOTE]
If you only have one interface, and it is assigned to the Internal Zone, and the Internal Zone is a trusted network then your firewall will not filter any traffic: it will allow everything.
If this is what you really want, there is a simple solution: disable your firewall!
I don’t recommend this.
The correct solution is to run a firewall and setup the necessary rules. There are many workstations on Windows AD networks running correctly configured firewalls.
I tried that - miracle. I C to external firewall and opened the ports 161, 162, 427, 5353, 9100 and reboot.
Now I could print pictures. But I couldn’t print a Libre document.
All prints take long time - for picures. Libre document came now first page - after 5 min.
I tried that - miracle. I C to external firewall and opened the ports 161, 162, 427, 5353, 9100 and reboot.
Now I could print pictures. But I couldn’t print a Libre document.
All prints take long time - for picures. Libre document came now first page - after 5 min.[/QUOTE]
That is good news.
I have reviewed your /etc/sysconfig/SuSEfirewall2. It looks much better. You did a good job re-configuring the firewall.
There are several reasons why printing can be slow. To see if the firewall is contributing to the problem, just disable the firewall and try to print the same documents.
Please let us know if it makes a difference.
When printing a document, the amount of data sent to the printer depends on many things:
[LIST]
[]The type of document: A large picture can take a long time.
[]The printer driver you are using.
[]The print settings (e.g. resolution)
[]Your network: a 1Gb network will provide better performance than 10/100 network, if your printer has a 1Gb interface.
[/LIST]
You may want to experiment with these settings and compare print times using a USB connection to identify any bottlenecks.
the document has standard few pictures, text, all in all 670 kB.
the internet is 1BGbit speed over whole system
the WLAN has 2 Frequences, 6 Antennas and runs on 1300 Mbits.
The NIC runs up to 600 Mbits.
Print from Windows will take less than 1 minute.
I have disabled the firewall.
The print is still slow. maybe 15min for 9 pages. This makes no difference.
I have now disabled firewall. When done that and open YAST - Firewall I get this picture:
I have not installed another firewall. SAMBA runs for access to AD windows network.
There is Apparmor, but disabled in Services. I have not touched it.
[QUOTE=hcp_dk;36992]Hi Kevin,
the document has standard few pictures, text, all in all 670 kB.
[/QUOTE]
That does not appear to be a very large document.
That tells me the firewall is good. It is not affecting performance.
That should be adequate, assuming there are no network issues.
You won’t get 1,300 Mb even if you have a 1 Gb LAN connecton.
You might get 600 Mb.
15 minutes for 9 pages does appear to be slow but it depends on the amount of data that is sent to the printer. For example, you could be printing several 72 dpi images at 1200 dpi so you could be sending much more than 670 KB to the printer.
I’m curious if it takes just as long if you print via your Ethernet connection instead of your WLAN.
Now, this is interesting. Assuming…
[LIST]
[]you’re doing this on your laptop (SLED)
[]and Windows is a KVM virtual machine
[*]and you’re printing via your WLAN connection
[/LIST]
It would suggest the bottleneck is related to the Linux print driver or perhaps cups. Have a look at /var/log/messages. Are there any errors or other messages that might point to the cause?
[QUOTE]
I have now disabled firewall. When done that and open YAST - Firewall I get this picture:
I have not installed another firewall. SAMBA runs for access to AD windows network.
There is Apparmor, but disabled in Services. I have not touched it.[/QUOTE]
Again, have a look at /var/log/messages. Are there any errors or other messages that might point to the cause?
From an earlier post, I thought that message came from your SLES system. Do you see that message on SLES, SLED, or both?
all this is now from SLED. So we are on one system.
Usually I print files of several Megabites or hundred of pages without a problem. It must be a problem of data transfer. I think, driver can be an issue since:
I can print on DELL 3100CN printer
I can print out of KVM from WINDOWS
I can see in Forums other has problems with LaserJet printer too.
I enable now the firewall again since it is not the main problem.
This commands removed the error massage. But when I’m reboot, the error massage come again. I can so type commands again and the error message disappear
Error messags print related from “message”
[QUOTE]2017-03-11T15:29:39.184983+01:00 SLEDLaptop systemd[1]: Started CUPS Scheduler.
2017-03-11T15:29:39.190958+01:00 SLEDLaptop systemd[1]: Started CUPS Scheduler.
2017-03-11T15:29:39.259424+01:00 SLEDLaptop hpps: [8156]: error: Failed to create /var/spool/cups/tmp/.hplip
I tried from SLED Laptop and connected the printer via USB. I installed drier again. “HP Laserjet USB”
The printer works as fast as in Windows without problems. SO, USB works
However, I can’t connect the printer to all PC via USB - I think we have, when kids are home, 10 PC and Laptops. It should work via network as other printer do too.
But it seems to be lnked to LAN and CUPS handling of LAN?
I tried from SLED Laptop and connected the printer via USB. I installed drier again. “HP Laserjet USB”
The printer works as fast as in Windows without problems. SO, USB works[/QUOTE]
Understood.
[QUOTE]However, I can’t connect the printer to all PC via USB - I think we have, when kids are home, 10 PC and Laptops.[/QUOTE]Understood.
[QUOTE]It should work via network as other printer do too.[/QUOTE]Agreed.
[QUOTE]But it seems to be lnked to LAN and CUPS handling of LAN?[/QUOTE]Agreed, but I do not have any experience working with CUPS.
This might be a good time for some of the other Knowledge Partners who have more experience in this area to jump in and offer some assistance.
