Sign up ×
Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.

I have a Mac mini running 10.8.2. It connects to the internet over Wi-Fi and everything seems to work. I want to make this Wi-Fi available to another computer connecting to the mini's Ethernet.

My Wi-Fi router is at

I have experimented with a bunch of static and dynamic settings. This is what I have currently:

Static IP:

Internet Sharing is set to go from Wi-Fi to Ethernet. In this configuration:

  1. The mini will serve DHCP address over Ethernet.
  2. The mini will provide DNS resolution over Ethernet.
  3. The mini will NOT route packets for external hosts.
  4. The connected computer can ping or ssh to the mini.
  5. The connected computer can resolve DNS.
  6. The connected computer cannot ping the router, Google, or any other external computers.

Here is a small dump of hopefully useful things from the command line:

boots@eiji:~$ ps ax | egrep '(bootp|natp)'
52502   ??  S      0:00.01 bootpd -d -P
52503   ??  S      0:29.94 natpmpd -d -y bridge0 en1
53729 s001  S+     0:00.00 egrep (bootp|natp)
boots@eiji:~$ ifconfig
lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> mtu 16384
    inet6 fe80::1%lo0 prefixlen 64 scopeid 0x1 
    inet netmask 0xff000000 
    inet6 ::1 prefixlen 128 
gif0: flags=8010<POINTOPOINT,MULTICAST> mtu 1280
stf0: flags=0<> mtu 1280
    ether 3c:07:54:58:2f:9c 
    media: autoselect (none)
    status: inactive
    ether 68:a8:6d:58:06:e7 
    inet6 fe80::6aa8:6dff:fe58:6e7%en1 prefixlen 64 scopeid 0x5 
    inet netmask 0xffffff00 broadcast
    media: autoselect
    status: active
    ether 0a:a8:6d:58:06:e7 
    media: autoselect
    status: inactive
    lladdr a4:b1:97:ff:fe:d9:44:ca 
    media: autoselect <full-duplex>
    status: inactive
    ether ac:de:48:65:39:32 
    inet netmask 0xffffff00 broadcast
        priority 0 hellotime 0 fwddelay 0 maxage 0
        ipfilter disabled flags 0x2
    member: en0 flags=3<LEARNING,DISCOVER>
             port 4 priority 0 path cost 0
share|improve this question

3 Answers 3

Matt's answer is actually not a solution but just a workaround. NAT in 10.8.2 is not working because of a bug in pf configuration files. You can find the solution here:

share|improve this answer
This only applies to OS X Server, there is no AdaptiveFirewall rule in OS X (Client). – patrix Nov 1 '12 at 13:12

I had a slightly different symptom. Wifi-connected iPhones could connect to the Wifi, they got an IP ( and a router ( assigned via DHCP. The Mac could ping them and the iPhone could access services in the local network via IP address. However, the iPhone can't access any Internet service (e.g. Maps).

I discovered that no DNS was assigned. So I manually specified a DNS on the iPhone and now the connection works perfectly. It seems that Internet Sharing's DHCP server in 10.8.2 doesn't correctly assign the DNS to its clients.

See also rdar://12468765.

share|improve this answer
I think you are trying to go the other direction. Mac has internet via Ethernet and is sharing over WiFi. Most likely the mac correctly uses NAT (Network Address Translation) when providing WiFi and not when providing Ethernet. – Matt Oct 11 '12 at 15:50
up vote 0 down vote accepted

A friend of mine reminded me about the existance of tcpdump. This gave me the tool I need to track down my problem.

On my connected computer, I began pinging the wireless router with:

boots@frobisher:~$ ping
PING ( 56 data bytes
Request timeout for icmp_seq 0
Request timeout for icmp_seq 1
Request timeout for icmp_seq 2

I left this running so it would generate traffic that I could easily trace. On my mini I ran

boots@eiji:~$ sudo tcpdump -l -i en1 -n | grep ICMP
13:41:45.776732 IP > ICMP echo request, id 31530, seq 28, length 64
13:41:46.776635 IP > ICMP echo request, id 31530, seq 29, length 64
13:41:47.776489 IP > ICMP echo request, id 31530, seq 30, length 64

This was my first clue. The mac mini is echoing the traffic out onto the wireless netwrok, but it is getting lost there.

At this point, I opened my router's wireless configuration. For most routers this means pointing a web browser at the router: I went to the advanced tab and looked at the routing tables. I noticed that 192.168.2.x addresses were being routed to the internet connection not to the LAN. So I added a static route:

Static Route:

Suddenly my tcpdump starts seeing responses!

13:41:56.775330 IP > ICMP echo request, id 31530, seq 39, length 64
13:41:56.777700 IP > ICMP echo reply, id 31530, seq 39, length 64
13:41:57.774797 IP > ICMP echo request, id 31530, seq 40, length 64
13:41:57.777136 IP > ICMP echo reply, id 31530, seq 40, length 64

Similarly, my ping on the connected computer is seeing responses

boots@frobisher:~$ ping
PING ( 56 data bytes
64 bytes from icmp_seq=0 ttl=64 time=3.864 ms
64 bytes from icmp_seq=1 ttl=64 time=4.463 ms
64 bytes from icmp_seq=2 ttl=64 time=1.246 ms

So, I test the web browser on my connected computer and everything is working. Technically I could stop here, but if my DHCP lease to my mini changes, than I will need to manually fix up the route. To avoid this issue, I have set my router to issue a static IP address to my mini, and set the router for 192.168.2.x traffic to point to that static IP address.

Now that I had it working with my connected computer, I switched the ethernet cable to my xbox and tested it. Everything worked perfectly, so my xbox now connects over ethernet to my mac mini which uses wifi to connect to the internet, just like I wanted.

share|improve this answer
What you are trying to make work here is 2 level of DHCP and 2 level of NAT. By removing a level of DHCP you enable you to define a clear routing within your 2 levels of NAT. – daniel Azuelos Nov 25 '12 at 12:30

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.