Take the 2-minute tour ×
Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.

I have a Mac mini running 10.8.2. It connects to the internet over Wi-Fi and everything seems to work. I want to make this Wi-Fi available to another computer connecting to the mini's Ethernet.

My Wi-Fi router is at 10.0.0.1.

I have experimented with a bunch of static and dynamic settings. This is what I have currently:

mini
Static IP: 192.168.2.1
Netmask:   255.255.255.0
Router:    10.0.0.1

Internet Sharing is set to go from Wi-Fi to Ethernet. In this configuration:

  1. The mini will serve DHCP address over Ethernet.
  2. The mini will provide DNS resolution over Ethernet.
  3. The mini will NOT route packets for external hosts.
  4. The connected computer can ping or ssh to the mini.
  5. The connected computer can resolve DNS.
  6. The connected computer cannot ping the router, Google, or any other external computers.

Here is a small dump of hopefully useful things from the command line:

boots@eiji:~$ ps ax | egrep '(bootp|natp)'
52502   ??  S      0:00.01 bootpd -d -P
52503   ??  S      0:29.94 natpmpd -d -y bridge0 en1
53729 s001  S+     0:00.00 egrep (bootp|natp)
boots@eiji:~$ ifconfig
lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> mtu 16384
    options=3<RXCSUM,TXCSUM>
    inet6 fe80::1%lo0 prefixlen 64 scopeid 0x1 
    inet 127.0.0.1 netmask 0xff000000 
    inet6 ::1 prefixlen 128 
gif0: flags=8010<POINTOPOINT,MULTICAST> mtu 1280
stf0: flags=0<> mtu 1280
en0: flags=8963<UP,BROADCAST,SMART,RUNNING,PROMISC,SIMPLEX,MULTICAST> mtu 1500
    options=2b<RXCSUM,TXCSUM,VLAN_HWTAGGING,TSO4>
    ether 3c:07:54:58:2f:9c 
    media: autoselect (none)
    status: inactive
en1: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500
    ether 68:a8:6d:58:06:e7 
    inet6 fe80::6aa8:6dff:fe58:6e7%en1 prefixlen 64 scopeid 0x5 
    inet 10.0.0.145 netmask 0xffffff00 broadcast 10.0.0.255
    media: autoselect
    status: active
p2p0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 2304
    ether 0a:a8:6d:58:06:e7 
    media: autoselect
    status: inactive
fw0: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500
    lladdr a4:b1:97:ff:fe:d9:44:ca 
    media: autoselect <full-duplex>
    status: inactive
bridge0: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500
    ether ac:de:48:65:39:32 
    inet 192.168.2.1 netmask 0xffffff00 broadcast 192.168.2.255
    Configuration:
        priority 0 hellotime 0 fwddelay 0 maxage 0
        ipfilter disabled flags 0x2
    member: en0 flags=3<LEARNING,DISCOVER>
             port 4 priority 0 path cost 0
share|improve this question

3 Answers 3

up vote 0 down vote accepted

A friend of mine reminded me about the existance of tcpdump. This gave me the tool I need to track down my problem.

On my connected computer, I began pinging the wireless router with:

boots@frobisher:~$ ping 10.0.0.1
PING 10.0.0.1 (10.0.0.1): 56 data bytes
Request timeout for icmp_seq 0
Request timeout for icmp_seq 1
Request timeout for icmp_seq 2
...

I left this running so it would generate traffic that I could easily trace. On my mini I ran

boots@eiji:~$ sudo tcpdump -l -i en1 -n | grep ICMP
13:41:45.776732 IP 192.168.2.14 > 10.0.0.1: ICMP echo request, id 31530, seq 28, length 64
13:41:46.776635 IP 192.168.2.14 > 10.0.0.1: ICMP echo request, id 31530, seq 29, length 64
13:41:47.776489 IP 192.168.2.14 > 10.0.0.1: ICMP echo request, id 31530, seq 30, length 64
...

This was my first clue. The mac mini is echoing the traffic out onto the wireless netwrok, but it is getting lost there.

At this point, I opened my router's wireless configuration. For most routers this means pointing a web browser at the router: http://10.0.0.1/. I went to the advanced tab and looked at the routing tables. I noticed that 192.168.2.x addresses were being routed to the internet connection not to the LAN. So I added a static route:

Static Route: 192.168.2.0
Netmask: 255.255.255.0
Gateway: 10.0.0.145

Suddenly my tcpdump starts seeing responses!

13:41:56.775330 IP 192.168.2.14 > 10.0.0.1: ICMP echo request, id 31530, seq 39, length 64
13:41:56.777700 IP 10.0.0.1 > 192.168.2.14: ICMP echo reply, id 31530, seq 39, length 64
13:41:57.774797 IP 192.168.2.14 > 10.0.0.1: ICMP echo request, id 31530, seq 40, length 64
13:41:57.777136 IP 10.0.0.1 > 192.168.2.14: ICMP echo reply, id 31530, seq 40, length 64
...

Similarly, my ping on the connected computer is seeing responses

boots@frobisher:~$ ping 10.0.0.1
PING 10.0.0.1 (10.0.0.1): 56 data bytes
64 bytes from 10.0.0.1: icmp_seq=0 ttl=64 time=3.864 ms
64 bytes from 10.0.0.1: icmp_seq=1 ttl=64 time=4.463 ms
64 bytes from 10.0.0.1: icmp_seq=2 ttl=64 time=1.246 ms
...

So, I test the web browser on my connected computer and everything is working. Technically I could stop here, but if my DHCP lease to my mini changes, than I will need to manually fix up the route. To avoid this issue, I have set my router to issue a static IP address to my mini, and set the router for 192.168.2.x traffic to point to that static IP address.

Now that I had it working with my connected computer, I switched the ethernet cable to my xbox and tested it. Everything worked perfectly, so my xbox now connects over ethernet to my mac mini which uses wifi to connect to the internet, just like I wanted.

share|improve this answer
    
What you are trying to make work here is 2 level of DHCP and 2 level of NAT. By removing a level of DHCP you enable you to define a clear routing within your 2 levels of NAT. –  daniel Azuelos Nov 25 '12 at 12:30

Matt's answer is actually not a solution but just a workaround. NAT in 10.8.2 is not working because of a bug in pf configuration files. You can find the solution here: http://support.apple.com/kb/TS4418?viewlocale=en_US&locale=en_US

share|improve this answer
    
This only applies to OS X Server, there is no AdaptiveFirewall rule in OS X (Client). –  patrix Nov 1 '12 at 13:12

I had a slightly different symptom. Wifi-connected iPhones could connect to the Wifi, they got an IP (192.168.2.2) and a router (192.168.2.1) assigned via DHCP. The Mac could ping them and the iPhone could access services in the local network via IP address. However, the iPhone can't access any Internet service (e.g. Maps).

I discovered that no DNS was assigned. So I manually specified a DNS on the iPhone and now the connection works perfectly. It seems that Internet Sharing's DHCP server in 10.8.2 doesn't correctly assign the DNS to its clients.

See also rdar://12468765.

share|improve this answer
    
I think you are trying to go the other direction. Mac has internet via Ethernet and is sharing over WiFi. Most likely the mac correctly uses NAT (Network Address Translation) when providing WiFi and not when providing Ethernet. –  Matt Oct 11 '12 at 15:50

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.