TomatoUSB

Hi,

I was really hoping one of the brilliant people here can help me. Basically I work in a small office at a big university. Our office has its own server that runs OpenVPN which everyone uses to share files but printing has been a big problem. Plugging the printer straight into the network works for a while but the IP address will change and then I get 100 emails.

My goal is to be able to plug our printer/scanner/copiers into a linksys e4200 with some version of tomato. Right now the one im testing on is "tomato-E4200USB-NVRAM60K-1.28.7495.2MIPSR2-Toastman-RT-VPN". I was able to set it up as an OpenVPN client with a static ip. It pings from other VPN members. The printer is connected and got a local ip which I set to static. What I really want now is for people to using the vpn to somehow get hooked to the printer.

I don't know very much about networking, (although I am learning now), but this might be simple or it might be impossible. I tried googling my head off for this but I just might not know the right way to say it. I originally assumed it was port forwarding which it seems like it does what I want but only from its actual internet ip address not the vpn.

Is there any one out there that can help? I will take any suggestion, even if it doesn't involve tomato firmware at all :-).

Hi,

Nice pick for Tomato firmware. You nailed it there! I strongly recommend that you read this link and clarify few basic concepts. https://forums.openvpn.net/topic12147.html . Yes you need to do port forward for the VPN subnet in order to perform remote prints. Here are the ports depending on which service are you using:

LPD / printer tcp515 udp515
Internet Printing Protocol (IPP) tcp631 udp631

If you want to use a hostname instead of an IP for printer then assign it a hostname on the Tomato router. That way it will be easier.

Good luck! &

Have a great day!

Thanks so much for your guidance. I guess the part I'm getting stuck is figuring out how to route my vpn connections to my routers LAN.

Here is my example I'm using to try and test my setup:
My routers static vpn ip is 10.8.16.117 and within my router the printer is hooked to 192.168.1.155 and it has a typical web interface.

So when I try port forwarding ext port 81 to int port 80 at 192.168.155, I expected to be able to access the printers web interface from anywhere else on my VPN by typing 10.8.16.117:81 on a browser. But this doesnt seem to be working, although it does work if trying with my big internet IP:81.

I'm pretty sure I opened up the VPN server's firewall and even turned it off temporarily with the same outcome. I'm looking at things the routing table in the tomato GUI or iptables command from ssh into the router. Like I said, i'm very new to networking so these seem a little daunting at the moment. Am I on the right track?

Hello again chillynapper :)

I understand the issue here. What you can do is add a rule to forward an un-used VPN ip to the printer's IP 192.168.1.155 . If your printer is running IPP or LPD then you should be able to access it via a share easily. For example, on windows you can do \\open-vpn-ip-reserved (printer IP) assigned on VPN for IP forwarding. For this kind, you have to do some SNAT and DNAT. Since you say that you are fairly new so let me write down the iptables syntax for you here.

iptables -t nat -A PREROUTING -d open-vpn-ip-reserved -j DNAT –to-destination 192.168.1.155
iptables -t nat -A POSTROUTING -s 192.168.1.155 -j SNAT –to-source open-vpn-ip-reserved

Once this is done then you can forward port 81 for your printer's web interface on open-vpn-ip-reserved

Please try this. If this is too much confusion then let me know and i will try to some up with some other solution.

_{P.S: Tomato and its mods, DDWRT, AsusWRT and its variants all run Linux . Read about SNAT & DNAT to understand it better and increase your knowledge of networking. This will help you in your future endeavours .http://thewiringcloset.wordpress.com/2013/03/27/linux-iptable-snat-dnat/}

Have a great day!

Thanks lucifercipher,

Worked like a charm. I was really scared of messing with the iptables but the article was really helpful in breaking down what was happening. I cannot tell you how grateful I am, and you really helped spark my interest in learning more networking.

Hello chillynapper,

You are most welcome. Im really happy that this forum helped you and made your day! Indeed you should learn about networking and basic to medium level for a start. Get a Linux virtual machine going and play around with it. www.virtualbox.org is your friend. That way, everything that you do stays inside a Sandbox per say :) If you ever need help again, the forum is here.

Have a great day!