Printing capability for open network users

[rslater-cs]

Printer discovery and printing

Devices that work across open and admin network

Problem

Currently we have a printer which can connect to the admin network but only admin users can then print with it, the printer cannot connect to the open network and won't be seen as a device.

Solution

As the admin network has some unused ip addresses, 172.28.8.250-254, we can allocate these to be shared device addresses for things like printers. Adding forwarding between admin and open in the firewall will not fix the printer issue entirely as multicast dns typically searches across its own subnet, therefore preventing device detection between the adm -> jan barrier. Avahi is an open-source tool that can bridge the multicast dns messages across the two subnets by repeating the message to jan while also refecting the message to adm. A disadvantage of Avahi is that it parrots messages either based on device name and/or service type which means it has no knowledge that shared devices only sit in a specific address range.

The setup would follow a flow of:

flowchart TD
    subgraph Discovery["1. Discover the printer"]
        PrinterAdvert["Printer: 172.28.8.250"]
        Router["Router"]
        Avahi["Avahi: 172.28.32.1:5353"]
        ClientDiscovery["Open client discovers printer"]

        PrinterAdvert -->|Advertise availability via mDNS| Router
        Router -->|Receive announcement| Avahi
        Avahi -->|Repeat announcement to open network| ClientDiscovery
    end

    subgraph Printing["2. Print job"]
        ClientPrint["Open client sends print job to 172.28.8.250"]
        Firewall["Router: new firewall forwarding rule"]
        PrinterJob["Printer: 172.28.8.250"]
        Success["Print succeeds"]

        ClientPrint -->|Direct print request| Firewall
        Firewall -->|Allow and forward to 172.28.8.250| PrinterJob
        PrinterJob --> Success
    end

    ClientDiscovery --> ClientPrint

Loading

Avahi reflects the discovery announcement so the open client can find the printer.
The client then sends the print job directly to 172.28.8.250 through the router's
new firewall forwarding rule.

If a printer was added via dhcp to the admin network clients on the open network could still see the printer but not send any jobs to it, this is because the discover messages would still get parroted by Avahi.

The flow would be:

flowchart TD
    subgraph Discovery["1. Discover the printer"]
        PrinterAdvert["Printer: 172.28.8.134"]
        Router["Router"]
        Avahi["Avahi: 172.28.32.1:5353"]
        ClientDiscovery["Open client discovers printer"]

        PrinterAdvert -->|Advertise availability via mDNS| Router
        Router -->|Receive announcement| Avahi
        Avahi -->|Repeat announcement to open network| ClientDiscovery
    end

    subgraph Printing["2. Print job"]
        ClientPrint["Open client sends print job to 172.28.8.134"]
        Firewall["Router: firewall blocks request"]
        Blocked["172.28.8.134 is outside the allowed shared device range"]
        Failure["Printer receives no job: printing fails"]

        ClientPrint -->|Direct print request| Firewall
        Firewall -->|Blocked| Blocked
        Blocked --> Failure
    end

    ClientDiscovery --> ClientPrint

Loading

Avahi still reflects the discovery announcement for 172.28.8.134, so the open
client can see the printer. The firewall blocks the direct print request because
this address is outside the shared device range 172.28.8.250-254.

If we want to fix this we can do two things:

• mdns-repeater (https://github.com/geekman/mdns-repeater) is a software which repeats multicast messages and filters by address but is significantly less mature and used than Avahi.
• Make our own repeater but this could extend what is supposed to be a quick turnaround solution