Hello,

I'm trying to block 192.168.1.2 from printing to my printer at 192.168.1.236. That's all I want. I just don't want that computer printing from the printer. I thought this would be a simple firewall rule. However, it can still print. Any ideas why? I bolded my rule below:

root@OpenWrt:/etc/config# cat firewall

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option src_ip 'fe80::/10'
        option src_port '547'
        option dest_ip 'fe80::/10'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config defaults
        option syn_flood '1'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option disable_ipv6 '1'
        option forward 'REJECT'

config zone
        option name 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        option network 'lan'

config zone
        option name 'wan'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option network 'wan wan6'
        option masq '1'
        option mtu_fix '1'

config include
        option path '/etc/firewall.user'

config rule
        option proto 'all'
        option target 'DROP'
        option dest_ip '192.168.1.236'
        option name 'Block All to HP Printer'
        option src_ip '192.168.1.2'
        option src '*'
        option dest '*'
        option dest_port '9100'

config forwarding
        option dest 'lan'
        option src 'wan'

config forwarding
        option dest 'wan'
        option src 'lan'
---------------------------------------------------------------------------------

root@OpenWrt:/etc/config# cat network

config switch 'eth0'
        option name 'eth0'
        option reset '1'

config switch_vlan
        option device 'eth0'
        option vlan '1'
        option ports '1 2 3 4 8t'

config switch_vlan
        option device 'eth0'
        option vlan '2'
        option ports '0 8t'

config interface 'loopback'
        option ifname 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'

config interface 'lan'
        option force_link '1'
        option type 'bridge'
        option proto 'static'
        option ipaddr '192.168.1.1'
        option netmask '255.255.255.0'
        option _orig_ifname 'eth0.1 wlan0 radio1.network1'
        option _orig_bridge 'true'
        option ifname 'eth0 eth0.1 eth0.2'

config interface 'wan'
        option proto 'dhcp'
        option _orig_ifname 'eth0.2'
        option _orig_bridge 'false'

config interface 'wan6'
        option ifname '@wan'
        option proto 'dhcpv6'

Thank you for your time.

(Last edited by user2016 on 23 Jul 2016, 03:07)

You might have better luck having your question answered if you posted it in the proper section, not DevOnly.

Try using iptables .. Try this rule:
iptables -I FORWARD -p tcp -s 192.168.1.2 -d 192.168.1.236 --dport 9100 -j DROP

If above rule works, copy it in /etc/firewall.user file and it will be created everytime firewall is reloaded ..