I have my office network that looks like this:

networking scheme

My office network looks like this:

  • the office network (wifi and wired) has the subnetwork
  • I have some server machines on the subnetwork (NODE_1,.... NODE_10).
  • I have a machine (it is a Mac mini) with 2 subnetwork interfaces that acts as:
    • the gateway for all machines in subnetwork
    • exposes a VPN service (the Mac server app default one)
    • and provides extra services, such as a DNS)

The Mac mini configuration is my big problem. This is how it looks:

Ethernet interface en0

  • address:
  • netmask:
  • gateway:

Ethernet interface en2

  • address:
  • netmask:
  • gateway:

I need routing from machines in to those in

To do so I have activated the "Internet sharing" feature of Mac OS: actually I do not know what happens under the hood, but the machines NODE_1 ...NODE_10 go to internet.

Then, when I'm connected to the office network, so that I get an IP such as: I add a routing rule such as:

 sudo route -n add -gateway

So far so good: everything works fine!!!!!

The big problem is when I connect through the VPN.

VPN Connection

I connect successfully to the VPN exposed at:, then I add the routing rule.

 sudo route -n add -gateway

I'm not able to reach the machines in subnet

Sniffing the packets I see that the packets follow the hops:

  1. ->
  2. ->
  3. ->
  4. <-
  5. <-

The packet goes to the gateway instead of the Looking into the Mac mini routing tables I see:      UH              2       93    ppp1     40:6c:8f:3:d5:e7   UHLS2           0        0     en0

40:6c:8f:3:d5:e7 is the mac address of

I would like to change the routing without using the internet sharing in order to allow internet access for, and cover both the VPN and local scenario, but I don't know the steps I need to do, and how to hand write the rules.

Thanks a lot.

  • 1. You have two default gateways: the one set for en2 is wrong - it should be nada/nothing. 2. You have a double-NAT: 1st is your ADSL router 2nd is your Mac mini en1>en2 (internet Sharing!) 3. Is it possible to setup a static route on your ADSL router? 4. Please add your system/macOS server version. 5. How did you set up forwarding on your ADSL router (to get VPN working)?
    – klanomath
    May 10, 2017 at 14:07
  • 3. unfortunately no 4. El Capitan 5. I opened the ports for the L2TP protocol and forwarded to the machine.
    – JayZee
    May 10, 2017 at 15:32
  • the router is the default vodafone one, the "vodafone station revolution". It should be the Huawei hhg2500.
    – JayZee
    May 10, 2017 at 15:37
  • where do MacOs store the network ip tables, and configuration files?
    – JayZee
    May 10, 2017 at 15:41

1 Answer 1


It should be possible to create a bridge with en0 and en2 and enable net.inet.ip.forwarding to get rid of all routing problems. The bridge acts more or less as another switch between en0 and en2.

  • Disable Internet Sharing
  • remove the gateway in the en2 settings of the Mac mini and change the IP-address to an available one in (e.g.
  • remove all additional static routes
  • Check for bridge interfaces with ifconfig
  • On the server create a file bridge:

    sudo mkdir -p /usr/local/bin/ #only if the folder is missing
    sudo nano /usr/local/bin/bridge

    with the content

    sysctl -w net.inet.ip.forwarding=1
    ifconfig bridge create
    ifconfig bridge0 addm en0 addm en2 up #use the first available bridge number here and the proper interface device names
  • enter sudo chmod +x nano /usr/local/bin/bridge
  • Create a launch daemon usr.bridge.plist:

    sudo nano /Library/LaunchDaemons/usr.bridge.plist

    with the content

    <?xml version="1.0" encoding="UTF-8"?>
    <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
    <plist version="1.0">
  • Load the plist

    sudo launchctl load /Library/LaunchDaemons/usr.bridge.plist
  • Change the IP-addresses of node_1 and node_10 to available ones in (e.g. and Change their default gateways to and the DNS server to
  • Thanks a lot for the long answer! actually I would prefer to keep the separate from the Would it be possible with a bridge?
    – JayZee
    May 11, 2017 at 7:39
  • @JayZee This doesn't make much sense: you want to access everything from all devices but without Internet Sharing/NAT. Then you either have to create a lot of additional static routes (one route will fail because you apparently can't add static routes on your router) or you create such a bridge.
    – klanomath
    May 11, 2017 at 7:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .