Using Server 5.0.15 to share internet WITHOUT internet sharing

Question

I am running a mid 2010 MacMini as a server. OS X 10.11.3 and Server 5.0.15. I am connecting to the internet on the built in Ethernet (Ethernet) and have a USB to GigaBit Ethernet adapter (Ethernet 2) going to a wireless AP (WAP).

I have DHCP and DNS services configured and enabled. If I turn ICS on in the sharing control panel it ignores the DHCP service from the server, yet allows me to connect to the internet from my clients. This also breaks the local DNS unless I start changing IPs and such. If I turn it off, I get control over the DHCP server, but nothing connects to the internet.

How can I use BOTH? Or at least configure the settings on the server correctly to "bridge" the Ethernet and Ethernet 2 adapters to allow internet access to my clients?

I am looking for a NAT function someplace that is NOT the Internet Connection Sharing on the Sharing Control Panel.

Built in Ethernet config:

• IP: DHCP from Cable Modem
• Subnet Mask: 255.255.255.0 - DHCP from Cable Modem
• DNS: 127.0.0.1 to use the Servers own DNS Service
• Search Domain: My FQDN of the server.
• Router: DHCP from Cable Modem

USB to GigaBit Adapter Config:

• IP: 192.168.3.1
• Subnet Mask: 255.255.255.0
• DNS: 127.0.0.1
• Search Domain: My FQDN of the server.
• Router: Address acquired from DHCP for the Built in Ethernet

DHCP:

• Name: Home
• IP Pool: 192.168.3.2 - 192.168.3.253
• Lease: 1 Hour
• Interface: USB to GigaBit Adapter
• Router: 192.168.3.1 - Must be on the same network as the IP Pool and Interface.
• Note: 16+ IP Reservations for devices in the house.

WAP:

• IP: 192.168.3.254

DNS:

• Permissions: All Networks
• Client Lookup: All Clients
• Forwarding Servers: 8.8.8.8, 8.8.4.4

Not sure what other information to put in here, it is late and I am tired...

Ask me some questions and let me know if you have any insight into the new 5.0.15 server.app

Answer 1

The newest OS X Server versions don't provide any tools to enable NAT/Routing in OS X.

To get NAT working without using Internet Sharing you have to use a pf rule and create a plist to enable forwarding and load the pf rule:

Below I assume en0: the interface connected to the cable modem and en1: the interface connected to the LAN. DHCP and DNS are set up properly in the internal LAN.

1. Create a pf NAT rule:

   Create a file named nat-rules in /private/etc/ with the following content

   nat on en0 from en1 to any -> (en0)
   

2. Create a shell script named nat-pf.sh enabling forwarding and loading the pf rule. I saved it in /usr/local/:

   #!/bin/sh
   
   sysctl -w net.inet.ip.forwarding=1
   sysctl -w net.inet.ip.fw.enable=1
   
   #disables pfctl
   pfctl -d
   
   sleep 1
   
   #flushes all pfctl rules
   pfctl -F all
   
   sleep 1
   
   #starts pfctl and loads the rules from the nat-rules file
   pfctl -f /private/etc/nat-rules -e
   

3. Create a plist named org.user.natpf.plist with the following content and save it in /Library/LaunchDaemons/ to execute the above shell script at start-up:

   <?xml version="1.0" encoding="UTF-8"?>
   <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
   <plist version="1.0">
   <dict>
       <key>Disabled</key>
       <false/>
       <key>KeepAlive</key>
       <dict>
           <key>SuccessfulExit</key>
           <false/>
       </dict>
       <key>Label</key>
       <string>org.user.natpf</string>
       <key>ProgramArguments</key>
       <array>
           <string>/usr/local/nat-pf.sh</string>
       </array>
       <key>RunAtLoad</key>
       <true/>
       <key>StandardErrorPath</key>
       <string>/tmp/org.user.natpf.stderr</string>
       <key>StandardOutPath</key>
       <string>/tmp/org.user.natpf.stdout</string>
   </dict>
   </plist>
   

   All three files need a trailing empty line so don't simply copy the above code/lines.

4. Modify ownership and file modes:

   sudo chown root:wheel /private/etc/nat-rules
   sudo chown root:wheel /usr/local/nat-pf.sh
   sudo chmod 755 /usr/local/nat-pf.sh
   sudo chown root:wheel /Library/LaunchDaemons/org.user.natpf.plist
   

5. Load the launch daemon:

   sudo launchctl load /Library/LaunchDaemons/org.user.natpf.plist
   

6. After testing everything you can delete the following part in the plist:

       <key>StandardErrorPath</key>
       <string>/tmp/org.user.natpf.stderr</string>
       <key>StandardOutPath</key>
       <string>/tmp/org.user.natpf.stdout</string>
   

   org.user.natpf.stderr provides error messages to debug your plist.

7. On my local router I had to add a static route:

   192.168.3.0/24 (the internal network) -> 192.168.0.2 (Mac mini IP-address of the external interface connected to the router)

   This last step may not apply to your network environment!