printing from a different subnet question

Actually, you can print from different subnet, whether or not private IP's are used. Ignore the following phrases, intended for google search hits

gateway return icmp host unreachable
router not forward icmp redirect

There are 2 parts for answer: network part and setting up printer part. Gateway, hereafter, means not the cheap SoHo off-the-shelf routers; it means manually configurable ones like Cisco or Linux or BSD gateways.

For the network part, lets say there are gw-A and printer-A in subnet A and gw-B and node-B in subnet B. node-B tries to print to printer-A. printer-A has gw-A as gateway and properly set up IP address but it does not have any ARP entry matched to any IP address in subnet B (and you as an admin cannot put in any static route in printer's host routing table). Here is what happen:

1) node-B prints to printer-A. The packet goes to gw-B which in turn, forwards it to printer-B. gw-B has interfaces in both subnets

2) printer-A replies but when it does, it looks at source IP and finds that it is not in the same broadcast domain. So printer-A sends the packet to its default gateway, gw-A. gw-A has, for i.e, an interface in Internet and in subnet A.

3) gw-A, upon receiving given-up packet from printer-A, consults its routing table and finds that gateway for destination net is gw-B and forwards the packet to gw-B. This is critical point. gw-A CANNOT modify packet's source or destination IP (using for i.e SNAT/DNAT in iptables or nat/rdr in pf) or else the packet will be dropped. So how does it forward to gw-B without IP? Using ARP address of gw-B! If you are still vague, google on ARP IP interactions.
gw-A will also send icmp redirect to printer-A saying a better route is via gw-B. Due to this, printer-A will send directly to gw-B in the future (until its ARP entry expires).
If you are stuck at this point, there are only 2 most likely causes. One is your firewall rules on gw-A are dropping this given-up packet or you have disabled icmp redirects on gw-A. To troubleshoot, run tcpdump at gw-A interface to subnet A.

4) gw-B will then forward the packet to node-B. Viola, everybody's happy!

5) Btw, alternative solution to this network part is to enable NAT on gw-B's subnet A interface. Then, you won't have to deal with this troubleshooting mess. But there are some disadvantages to this approach.

Here is the printer part! This seemingly easy part took out a couple of hours from me. There are 3 ways to set up printer in Windows: local, network, via http.

1) If you try to set up via network, it WON'T work. Why? That network setup assumes one broadcast domain (a.k.a one subnet). Even if you use printer software that comes with printer, the same assumption applies

2) Via http? It will work (in my case) only if you have print server in front of the printer. The printer will connect to print server which will connect to the network. This case is not considered since I don't have print server.

3) Normally, people think of local as printer has to be physically attached. Only partially correct. This is the correct way to set up a printer located in different subnet. In Windows XP, go to Add Printer > Local printer (uncheck auto-detect box) > Create A New Port > Select TCP/IP > [Next] > Type in IP address and follow the rest of instructions to load the driver.

I hope my post saves countless hours of people time. Have fun!!!

Quick question:

3) Normally, people think of local as printer has to be physically attached. Only partially correct. This is the correct way to set up a printer located in different subnet. In Windows XP, go to Add Printer > Local printer (uncheck auto-detect box) > Create A New Port > Select TCP/IP > [Next] > Type in IP address and follow the rest of instructions to load the driver.

In this section, what would you enter for the IP address if the print server is on DHCP?

I sort of have the same situation.

I have a main (modem/4port Router0) with two routers connected to it (Router1) and (Router2) Now I want my computer thats on R1 to see the printer on R2. Well that should be easy. Im guessing all I have to do is get onto R2 and setup a DMZ for the printer IP. That will basically expose the Printer and everything should work.

But what if I had two printers on R2. Would I have to setup additional port forwarding or routing. I have to idea about routing and that sounds like something that could do this. I just need someone to point me in the right direction.