I am running a mid 2010 MacMini as a server. OS X 10.11.3 and Server 5.0.15. I am connecting to the internet on the built in Ethernet (Ethernet) and have a USB to GigaBit Ethernet adapter (Ethernet 2) going to a wireless AP (WAP).

I have DHCP and DNS services configured and enabled. If I turn ICS on in the sharing control panel it ignores the DHCP service from the server, yet allows me to connect to the internet from my clients. This also breaks the local DNS unless I start changing IPs and such. If I turn it off, I get control over the DHCP server, but nothing connects to the internet.

How can I use BOTH? Or at least configure the settings on the server correctly to "bridge" the Ethernet and Ethernet 2 adapters to allow internet access to my clients?

I am looking for a NAT function someplace that is NOT the Internet Connection Sharing on the Sharing Control Panel.

Built in Ethernet config:

  • IP: DHCP from Cable Modem
  • Subnet Mask: - DHCP from Cable Modem
  • DNS: to use the Servers own DNS Service
  • Search Domain: My FQDN of the server.
  • Router: DHCP from Cable Modem

USB to GigaBit Adapter Config:

  • IP:
  • Subnet Mask:
  • DNS:
  • Search Domain: My FQDN of the server.
  • Router: Address acquired from DHCP for the Built in Ethernet


  • Name: Home
  • IP Pool: -
  • Lease: 1 Hour
  • Interface: USB to GigaBit Adapter
  • Router: - Must be on the same network as the IP Pool and Interface.
  • Note: 16+ IP Reservations for devices in the house.


  • IP:


  • Permissions: All Networks
  • Client Lookup: All Clients
  • Forwarding Servers:,

Not sure what other information to put in here, it is late and I am tired...

Ask me some questions and let me know if you have any insight into the new 5.0.15 server.app

  • To summarize, you want to use your Mac as a router/gateway and have Server control the DHCP and DNS for the LAN side of the router? If you don’t use Internet Sharing from the Sharing pane of System Preferences, then you will need to familiarize yourself with pfctl.
    – medbot
    Feb 26, 2016 at 8:36
  • Possible duplicate of How can I setup my mac (OS X Yosemite) as an internet gateway. If you need further assistance I may adapt my answer there to El Capitan and automate some things.
    – klanomath
    Feb 29, 2016 at 3:14
  • Thanks to both of you. medbot pointed me in the right direction and gave me some good reading on pfctl and pf in general on OSX.
    – Takagami
    Mar 1, 2016 at 5:04

1 Answer 1


The newest OS X Server versions don't provide any tools to enable NAT/Routing in OS X.

To get NAT working without using Internet Sharing you have to use a pf rule and create a plist to enable forwarding and load the pf rule:

Below I assume en0: the interface connected to the cable modem and en1: the interface connected to the LAN. DHCP and DNS are set up properly in the internal LAN.

  1. Create a pf NAT rule:

    Create a file named nat-rules in /private/etc/ with the following content

    nat on en0 from en1 to any -> (en0)
  2. Create a shell script named nat-pf.sh enabling forwarding and loading the pf rule. I saved it in /usr/local/:

    sysctl -w net.inet.ip.forwarding=1
    sysctl -w net.inet.ip.fw.enable=1
    #disables pfctl
    pfctl -d
    sleep 1
    #flushes all pfctl rules
    pfctl -F all
    sleep 1
    #starts pfctl and loads the rules from the nat-rules file
    pfctl -f /private/etc/nat-rules -e
  3. Create a plist named org.user.natpf.plist with the following content and save it in /Library/LaunchDaemons/ to execute the above shell script at start-up:

    <?xml version="1.0" encoding="UTF-8"?>
    <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
    <plist version="1.0">

    All three files need a trailing empty line so don't simply copy the above code/lines.

  4. Modify ownership and file modes:

    sudo chown root:wheel /private/etc/nat-rules
    sudo chown root:wheel /usr/local/nat-pf.sh
    sudo chmod 755 /usr/local/nat-pf.sh
    sudo chown root:wheel /Library/LaunchDaemons/org.user.natpf.plist
  5. Load the launch daemon:

    sudo launchctl load /Library/LaunchDaemons/org.user.natpf.plist
  6. After testing everything you can delete the following part in the plist:


    org.user.natpf.stderr provides error messages to debug your plist.

  7. On my local router I had to add a static route: (the internal network) -> (Mac mini IP-address of the external interface connected to the router)

    This last step may not apply to your network environment!

  • This worked perfectly!! Very elegant and well written, Thank you! I modified the required areas to fit my environment, but this is exactly what I was looking for.
    – Takagami
    Mar 1, 2016 at 5:00
  • @Takagami Good to hear! ;-) if you additionally use pf as OS X firewall you may have to add/modify some pf anchors. Step 7 is for users behind a (local) router. I assumed that you don't have access to the router.
    – klanomath
    Mar 1, 2016 at 5:06
  • No. No access to the charter primary router for my area... Sadly. But I know enough about networking to know I didn't need a static route. Still learning about the OSX/UNIX backend.
    – Takagami
    Mar 1, 2016 at 15:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .