OK, thank you everybody. The linked document didn't help, because, as far as I understand, the listed ports 8610 and 8612 refer to the pixma backend.

By enabling firewalld logging (and walking my way through the jungle of entries in the journal, that are an awful lot), I was able to find out that the ports to open are the 3702 for WSD and 5353 for eSCL, if one wants that too: any one will do.

Bottom line, it now works fine and survives reloads of the firewall and reboots on both Leap and TW, so we can consider the problem solved.

Thanks, Andreas

This document says what ports to open for sane

https://wiki.debian.org/SaneOverNetwork#Opening_Ports

On 6/4/24 08:22, Axel Braun wrote:

Try to find out on which Port the network is scanned, and open this Port in the FW.

Schöne Grüße
 Axel