Take the 2-minute tour ×
Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.

A simple checkbox and a menu allow you to share your internet connection (no matter which interface you get it on) with any other interface (theoretically). But, the guts of this is a little confusing. This page http://www.manpagez.com/man/8/InternetSharing/ describes InternetSharing, a process which reads the property list com.apple.nat.plist stored in the /Library/Preferences/SystemConfiguration.

First question: Why is the AirPort singled out with its own special entry in the plist? I understand the entries for primary interface (the source) and the sharing devices (the targets) But who cares if AirPort is enabled in this plist if you are setting up a NAT between Ethernet and Bluetooth, for example?

Second question: Why does it allow sharing of Ethernet connection with Ethernet connection and then give you a warning that your ISP will hate you? (It also allows Firewire with Firewire) It doesn't allow Bluetooth to Bluetooth or AirPort to AirPort; the menu entries for self-reference disappear.

Third question: How do you change the default network when you share the Ethernet through your AirPort? InternetSharing configures the IP addresses for non-AirPort interfaces starting at 192.168.2.1 and the SharingNetworkNumberStart property allows you to change that. The AirPort interface by default is assigned 10.0.2.1. How to change?

Fourth question: If you only have one Ethernet jack on a MacBook how could you possibly have more than one interface? InternetSharing configures the IP addresses for non-AirPort interfaces starting at 192.168.2.1, walking up by one class C network (subnet mask 255.255.255.0) for each subsequent interface, i.e. 192.168.3.1, 192.168.4.1, 192.168.5.1, and so on. Is this to address the possibility of a Mac Pro or an Xserve with multiple NICs?

[SOLVED] 1) the airport is not like the other interfaces 2) the hard connections are less likely to connect to themselves-you actually have to WIRE them and nobody would do that 3)edit the bootpd.plist 4) usb adapters tnx. i solved the problem. even tho i turned off the firewall in the gui, ipfw was still running. sudo ipfw list gave the same list of rules regardless whether i had firewall on or off. dont know how i managed to achieve that!

I looked to noobproof and turned off the rule for blocking port 80. Now it works, at least for web surfing.

share|improve this question
    
Welcome to the site! That's a heck of a question! Yes - networks are very complicated, powerful and flexible. It's gonna be hard to really answer this in a way that's useful to you - but I'll try my best. You might find that pacing things, picking this apart and only asking one question gets you better learning and better overall answers. –  bmike Jul 16 '11 at 16:15

3 Answers 3

As @bmike said, Internet Sharing hides a lot of complexity behind a very simple interface, and some of your questions can't be answered authoritatively without interviewing some of the Apple engineers behind it. But that won't stop me from taking a stab at it...

1) AirPort is different from the other interface types because in order to share over AirPort, your Mac has to actually create the wireless network (as opposed to just providing service over an existing ethernet, FireWire, etc connection). This means that InternetSharing needs to have a bunch of info about how to create the wireless network: network name (SSID), channel, security, etc.

2) Resharing over the same ethernet interface is useful under some circumstances. For example, on my home network my ISP provides limited number of static IP addresses for my use. I run a Mac doing the equivalent of Internet Sharing (actually, I set up the daemons manually as @Spiff recommended) to reshare over the same ethernet. Result: if I put a computer on my home ethernet and config it via DHCP, I get a private (behind-the-firewall) IP address from my virtually unlimited internal pool. If I manually config the computer with one of the public IPs, I get full unfitered internet access, but use up one of my limited public IP pool. Because they're both on the same network, "moving" a computer behind or in front of the firewall is just a simple configuration switch.

On the other hand, if you did this same trick on an ethernet network that already had a DHCP server, computers attaching to the network would randomly get configuration from one server or the other, leading to unpredictability, confusion, and hair-pulling. It's definitely a use-only-if-you-know-what-you're-doing feature. Fortunately, Internet Sharing is smart: if it detects another DHCP server on "its" private network, it shuts itself off to avoid trouble.

3) I don't know of a way to change the private IP range on an IS-created wireless network. On the other hand, it shouldn't really matter, since the network is being created by Internet Sharing, and therefore it doesn't have to worry about conflicts with any existing network numbering.

4) You can add interfaces with Apple's USB Ethernet Adapter. Get some USB hubs, and pile them on!

share|improve this answer
    
Excellent call out of why wifi is different than other link level networks. Also + for the USB Ethernet option. I'm dying for thunderbolt speed Ethernet adapters. –  bmike Jul 16 '11 at 19:53
    
thank you.yes i get your reply to #1 and #4. DUH. but i think i wasnt clear about #2. in any event i figured out #2 and put my understanding in the comment to bmike. –  aquagremlin Jul 16 '11 at 19:55
    
how did you know what spiff was going to say since his reply came after yours? –  aquagremlin Jul 16 '11 at 19:56
    
pointer to this=> "actually, I set up the daemons manually" where can i find out the details, pplease? –  aquagremlin Jul 16 '11 at 19:59
    
@aquagremlin: I'm running this on OS X server, which has fairly straightforward interfaces for setting up the firewall, NAT routing, DHCP, and DNS. I did set this up on OS X client once, but I don't know of any good documentation -- I just ran Internet Sharing, cloned the config files it created and edited them for what I needed, then wrote a LaunchDaemon to start natd. BTW, Spiff's answer appeared while I was writing mine -- no prescience here. –  Gordon Davisson Jul 16 '11 at 21:11

The Internet Sharing feature has always seemed to be a simple-to-set-up service via the Sharing panel in System Preferences. I'm surprised they even documented the InternetSharing daemon with a man page.

If the settings you can easily access from the GUI are insufficient for your needs, I recommend you jump right into configuring and invoking the other underlying daemons yourself, rather than messing with InternetSharing and nat.plist.

ipfw, natd, bootpd, and named are powerful and worth learning to use directly.

share|improve this answer
    
[SOLVED]1) the airport is not like the other interfaces 2) the hard connections are less likely to connect to themselves-you actually have to WIRE them and nobody would do that 3)edit the bootpd.plist 4) usb adapters tnx. i solved the problem. even tho i turned off the firewall in the gui, ipfw was still running. sudo ipfw list gave the same list of rules regardless whether i had firewall on or off. dont know how i managed to achieve that! i looked to noobproof and turned off the rule for blocking port 80. now it works, at east for web surfing. –  aquagremlin Jul 16 '11 at 21:49

I think you oversimplify the sharing process. It's much more complicated than your initial paragraph. Firewall, nat/dhcp and networking concepts will kill you if you don't have some good foundation on basic conventions and rules as well as how networks were designed to work.

1) Why? I don't know - the snarky answer is to ask the engineers at Apple to share their thinking. Rather than speculate - feel free to ask a more concrete question that can be answered.

2) I don't know about hate - but I get a "you may disrupt the network" since many networks assume each client is an end point - not a gateway to more traffic that it has to handle differently. You can break your mac's connection as well as break the other people on the network. Your ISP won't care unless you call them to fix a problem you created :-)

3) Decide if you want to map out your network using DHCP or manually. Decide if you want one network or two. Once you read up on what a subnetwork is - you'll see you likely need a software router to bridge addresses not on the current router's subnet. The implementation depends on which way you decide to go.

4) It's called interface aliasing. Study up on the layers that make up the IP model and you will have a better feel for how you can add multiple second layer data on top of one physical link level network connection.

Don't give up, I can see how much work you put into your question - keep asking and you'll find a lot of really knowledgeable people here will chip in as their time allows to help you out. Entice them by asking really well researched and specific questions.

share|improve this answer
    
thanks for your replies. I did some more research. regarding #2- ethernet-ethernet and firewire-firewire are HARDWARE connections and therefore specifically configurable. The others are not and if they were allowed would lead to a mesh network. with the difficult issue of you wanting to hook up to yourself unintentionally( cyber masturbation? got to think of a more elegant term) –  aquagremlin Jul 16 '11 at 19:45
1  
regarding #3 I figured that out as well-just semantics i think i'd just add a subnet to the file /etc/bootpd.plist –  aquagremlin Jul 16 '11 at 19:53
    
You're right regarding #2 - you'll want to read up on ifconfig and spanning tree protocol if you will be bridging/spanning and have potential loops in the network. I had a lot of fun with link aggregation in tiger and leopard but not had the chance to play with this lately. –  bmike Jul 16 '11 at 20:01

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.