Mac OS Lan Routing

I struggled to find a simple guide to setting up local lan based routing on Mac OS X.
Finally got it working and thought it might help someone.

Context:
Home Network:

  • MacMini (OSX) connected via ethernet to router.
  • MacMini internal IP address 192.168.0.2 (setup with ipforwarding and interface routing)
  • MacMini ZeroTier IP address 10.0.0.2
  • Various other local computers / printers / NAS drives etc on 192.168.0.0/24 network

ZeroTier
Using ZeroTier to connect various devices MacBook, iPad, iPhone to Home Network.
ZeroTier set up on 10.0.0.0/24 range

Steps:

  1. Setup ZeroTier network as needed on the computers/laptop/iPhone etc

  2. Set up Managed Routes for the network on my.zerotier.com
    Destination: 192.168.0.0/24
    Via: 10.0.0.2

  3. On Mac mini set ip IP Forwarding:
    sudo sysctl -w net.inet.ip.forwarding=1

  4. Check the network interfaces on Mac mini by running ifconfig and checking for the right interface ids, (mine are en0 for the lan and feth3632 for zerotier)

  5. On Mac mini set up Interface Routing:
    create /etc/pfzerotier.conf and add the following line (editing the interface ids)
    nat on en0 from feth3632:network to any -> (en0)

  6. restart PF
    sudo pfctl -d
    sudo pfctl -e -f /etc/pfzerotier.conf

  7. Test on one of the external devices, (eg iPhone) you should now be able to reach any local IP address on your home network.

Hope this helps.

4 Likes

I’ve been struggling for hours, trying to piece together bits and pieces on macos bridges, pf nat rules (converted from all the Linux equivalent commands) and people on StackExchange saying it will never work with pf.

This looks much simpler and can’t wait to try it…

I struggled to get this to work, until i only loaded the custom pf.conf per your steps. Initially I was trying to use a pf anchor and tag on to the system rules, but the NAT was failing.

Do you know, or anyone else, which system pf rules would block the NAT from working? I’d like to add on to the system rather than replace altogether with a different conf if possible.

I did try to investigate the system rules but it wasn’t obvious where the issues may be. I know order is important, so when found will move the anchor accordingly.

I’m using Mac OS Server (El Capitan) for reference.

I had an issue with turning on the default system pf rules. It failed to load even without changes, hence I went with a custom.