I have Parallels Desktop 11, which does not have support port forwarding to VMs (just the Pro version supports it). So I am trying to use pfctl to forward ports to my Parallels VM.

I have followed this answer to setup the port forwarding. Forwarding is enabled with sysctl net.inet.ip.forwarding=1

I have specified this rule.

rdr pass inet proto tcp from any to any port 51414 -> port 51414 is the static IP of the Parallels VM.

However the port forwarding does not work for VM. It can successfully forward port x to port y on but can not forward port x from Mac to port x on Parallels VM.

What could be going wrong? Is it Parallels which is dropping packets etc?


1 Answer 1


There are two solutions for your problem with Parallels Desktop 11 (this doesn't apply to Parallels Desktop Pro/Enterprise 11, which both provide a convenient interface to configure port forwarding - nonetheless the solutions should work also in those enhanced versions):

Instead of attaching the VM's network interface to the "Shared Network" use a bridged interface (e.g. en0 or en1) and configure it with a IP/netmask in the respective network. Then you don't need NAT/port forwarding.

If you insist on a NAT'ed network do the following:

In the example below I use nc as server. To run a server enter nc -l -4 port and to connect to this server use nc server-IP port. You may also specify a source port: nc -p source-port server-IP port.

Here I use nc -l -4 11111 on the VM. To connect to this server I would run nc server-IP 11111 from a host in the same network. After starting the server and connecting the client you can simply enter some text, which is sent to the other console. To connect from a third host in a different network to the VM nc-server I want to use nc NAT-host-IP 22222. So I have to forward NAT-host-IP:22222 to VM-IP:11111. NAT-host in this case is the Mac hosting the Parallels VM.

  1. attach the VM guest's network interface to the "Host-only Network". Usually Parallels' host-only network has the following host configuration (check this by entering ifconfig on the host machine):

    vnic1: ...
    inet netmask broadcast

    So configure the VM guest as following:

    • IP: 10.37.129.x (with x ≠ 0,1,2,255) - below I assume it's
    • Netmask:
    • Gateway:
    • DNS: a real DNS server like
  2. On the NAT-host machine enable forwarding in /etc/sysctl.conf:


    and reboot the host.

  3. On the NAT-host machine (with an example IP of en0: create an anchor file org.user.forwarding in /private/etc/pf.anchors

    sudo touch /private/etc/pf.anchors/org.user.forwarding

    with the following content and a trailing empty line:

    rdr pass on en0 inet proto tcp from any to any port 22222 -> port 11111
  4. On the NAT-host machine modify the file /private/etc/pf.conf but keep a trailing empty line

    original file:

    scrub-anchor "com.apple/*"
    nat-anchor "com.apple/*"
    rdr-anchor "com.apple/*"
    dummynet-anchor "com.apple/*"
    anchor "com.apple/*"
    load anchor "com.apple" from "/etc/pf.anchors/com.apple"


    scrub-anchor "com.apple/*"
    nat-anchor "com.apple/*"
    rdr-anchor "com.apple/*"
    rdr-anchor "org.user.forwarding"
    nat on en0 proto {tcp, udp, icmp} from to any -> en0
    pass from {lo0,} to any keep state
    dummynet-anchor "com.apple/*"
    anchor "com.apple/*"
    load anchor "com.apple" from "/etc/pf.anchors/com.apple"
    load anchor "org.user.forwarding" from "/etc/pf.anchors/org.user.forwarding"
  5. Parse and test your anchor and your pf.conf file to make sure that there are no errors:

    sudo pfctl -vnf /etc/pf.anchors/org.user.forwarding
    sudo pfctl -vnf /etc/pf.conf
  6. Enable pf with:

    sudo pfctl -e -f /etc/pf.conf
  7. To test this start the nc server on the VM with nc -l -4 11111. Now on a third host in your physical network enter nc 22222.

After a reboot you have to start pf again. If you want to enable pf permanently check my other pf related answers.

After a system update or upgrade some of the original files above may have been replaced and you have to reapply all changes.

  • Will try it out..
    – Sudhir N
    Dec 5, 2016 at 4:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .