I need to give Internet access to a VM under Vmware fusion 7 in Host-Only mode. I know how to do it in Linux, with the following IPtables rules:

sysctl -w net.ipv4.ip_forward=1

iptables -A FORWARD -o eth0 -i vboxnet0 -s -m conntrack --ctstate NEW -j ACCEPT
iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -A POSTROUTING -t nat -j MASQUERADE

Can this be done in MacOS Sierra?


1 Answer 1


To enable NAT for a host-only network in VMware Fusion do the following:

  1. Enable forwarding by adding a file /etc/sysctl.conf with the content:


    and reboot

  2. Connect the Mac to the host-only network and make a note of the network/netmask of the host.only network:

    enter image description here

  3. Enter ifconfig to get the vmnet IP of the Mac

            ether 00:50:56:c0:00:03 
            inet netmask 0xffffff00 broadcast
  4. In the IP setting of the guest VM enter an IP/netmask according to the host-only network settings (with the example above that's in the range, a gateway (the vmnet3 IP of the hosting Mac from step 3 - here: and a DNS server.

  5. Open the pf.conf file with:

    sudo nano /etc/pf.conf

    and add the lines:

    nat on {en0, en1} proto {tcp, udp, icmp} from to any -> {en0, en1}
    pass from {lo0,} to any keep state

    after the line rdr-anchor "com.apple/*".

    Depending on your Mac and your network configuration only one interface is sufficient (either en0 or en1). Also use the proper network/netmask (your vmnet config instead of!.

    Save the file and exit nano.

  6. Check your pf.conf with:

    sudo pfctl -vnf /etc/pf.conf
  7. If no error occurs enable pf with:

    sudo pfctl -ef /etc/pf.conf

After a reboot you have to relaunch pf because it's not started automatically while booting. To launch pf while booting check step 4 in this answer: What is the modern way to do port-forwarding on El Capitan? (forward port 80 to 8080)

  • Works well with Virtualbox and ''Host-only Adapter" mode
    – ipeacocks
    Commented Jul 22, 2017 at 11:52
  • @klanomath, thanks for an excellent answer. Why do you NAT on {en0,en1}, when ifconfig reports the interface as vmnet3? Furthermore, please correct "the IP of the Mac from step 2" to "the IP of the Mac from step 3".
    – Shuzheng
    Commented Sep 5, 2019 at 18:56
  • @Shuzheng You have to enable NAT on a "public" interface (which usually is either en0 or en1) of a NAT gateway. Vmnet3 is a "private" interface by definition and has no connection to the world.
    – klanomath
    Commented Sep 6, 2019 at 13:15
  • @klanomath, indeed, but doesn't the packages pass the vmnet3 interface (and not en0), when going from the host-only network to the Internet? The guest VM sends it's packets to the vmnet3 interface of the host.
    – Shuzheng
    Commented Sep 6, 2019 at 13:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .