Unable to ping imageCLASS LBP246dw when connected to network via tun VPN

[tbain98]

I've got an ImageCLASS LBP246 on a home network with a simple network configuration (ASUS RT-AX5400 router, DHCP w/ an IP reservation for the printer, 255.255.255.0 subnet, no VLANs, no firewall customizations). When directly connected to the router, I can access the printer as expected (ping, Remote UI access, printing all work).

The router provides built-in VPN servers, and I've configured both WireGuard and OpenVPN to allow myself remote access to the network since I live across the country. WireGuard is configured as a tun (L2/Ethernet bridging) VPN connection, and I've tried configuring OpenVPN both as tun and as tap (L3/IP bridging). In all three cases, I can access the router's admin console without issue and can ping other devices on the network (not the printer), so the VPN connections themselves are working correctly.

However, I've only been able to interact with the Canon printer when I use the tap OpenVPN configuration. For the two tun configurations, ping gives me "Request timed out" (but pinging other devices on the same subnet works just fine) and the Remote UI page doesn't connect when accessed from a browser. If I couldn't ping any devices on the network, I'd suspect this was a problem with the VPN configuration, but given that other devices respond as expected I think this is a problem in the printer, and I'd appreciate help determining what it is and how to fix it.

The printer's Remote UI shows that the printer is getting its IP/subnet/default gateway from the router's DHCP server, and they look as I'd expect (the printer's IP is the reserved one, the subnet is 255.255.255.0, the default gateway is that of the router). There are no firewall rules showing in the Remote UI. What else might be causing this, and how can I figure out more about what's going on?

[tbain98]

Small correction: tun is L3/IP bridging, tap is L2/Ethernet bridging, rather than the inverse as I wrote it.

[shadowsports]

Greetings,

Look for a setting on the router or VPN client called split tunnel or similar.  This allows traffic typically confined to the tunnel to communicate with devices on the local LAN.  This a network configuration and has nothing to do with your printer.  🙂

[Stephen]

Rick is correct about it being a networking/VPN issue rather than a printer issue. The printer must be on the same network/VLAN (VPN) as the client (computer) you're trying to print from, or they won't be able to see each other.

Please keep in mind, Canon USA does not support this, and I'm not a tech support rep, I'm just a nerd who happens to know a lot of random stuff, and I've worked here for 16 years.

Most router-based VPN clients assign the inbound connection to a VLAN (Virtual LAN). By design, VLANs are isolated from the rest of the network, so you have to tell the VPN client to grant it access to all of the network resources. If you're not sure how to do that, you'll need to check the documentation for your ASUS Router's VPN client.

The other thing that I recommend (so you don't run into problems) is to log into your printer's local web UI and set it to a static IP, and make sure to assign a static IP from your router, too. Since you want to be able to get to it from the VPN, you don't want any DHCP nonsense getting in the way. HERE is info on that.

Also, if you haven't installed the Canon software & drivers, I recommend doing that. The built-in drivers are limited. You can get the Windows software HERE or macOS software HERE.

I hope this helps, but if you need additional help, let us know here or contact support at 1-800-OK-CANON (800-652-2666).

[tbain98]

Thank you both for your responses. 

Rick, my understanding is that split tunneling is applicable when you want to access devices on the LAN the client is on, whereas in this case the printer I'm trying to access is on the server LAN.

Stephen, your explanation of network segregation at the router / VPN server was what I started out assuming, but what doesn't add up for me is the fact that I can ping other devices connected to the remote router. If my VPN client is unable to see the printer due to the remote router isolating my client from the rest of the network (all of it), why am I able to ping other devices on that network but not the Canon printer? That was the part that makes me think the printer is choosing to not respond to the traffic (ping, HTTP) rather than that this is caused by the router not passing traffic through in one of the directions. Is there a firewall in the printer itself that's configured by default to not respond to clients connecting from outside the subnet?

Thanks for your recommendation about using a static IP. I use DHCP reservations for a few devices on my home router (also Asus, though a different model) and haven't had any issues in several years of use, but if it becomes flaky I'll consider switching to a static IP.