2

I have my office network that looks like this:

networking scheme

My office network looks like this:

  • the office network (wifi and wired) has the subnetwork 192.168.88.0.
  • I have some server machines on the subnetwork 192.168.2.0 (NODE_1,.... NODE_10).
  • I have a machine (it is a Mac mini) with 2 subnetwork interfaces that acts as:
    • the gateway for all machines in subnetwork 192.168.2.0.
    • exposes a VPN service (the Mac server app default one)
    • and provides extra services, such as a DNS)

The Mac mini configuration is my big problem. This is how it looks:

Ethernet interface en0

  • address: 192.168.88.10
  • netmask: 255.255.255.0
  • gateway: 192.168.88.1

Ethernet interface en2

  • address: 192.168.2.1
  • netmask: 255.255.255.0
  • gateway: 192.168.88.10

I need routing from machines in 192.168.88.0 to those in 192.168.2.0.

To do so I have activated the "Internet sharing" feature of Mac OS: actually I do not know what happens under the hood, but the machines NODE_1 ...NODE_10 go to internet.

Then, when I'm connected to the office network, so that I get an IP such as: 192.168.88.33 I add a routing rule such as:

 sudo route -n add 192.168.2.0/24 -gateway 192.168.88.10

So far so good: everything works fine!!!!!

The big problem is when I connect through the VPN.

VPN Connection

I connect successfully to the VPN exposed at: 192.168.88.10, then I add the routing rule.

 sudo route -n add 192.168.2.0/24 -gateway 192.168.88.10

I'm not able to reach the machines in subnet 192.168.2.0.

Sniffing the packets I see that the packets follow the hops:

  1. -> 192.168.88.10
  2. -> 192.168.2.1
  3. -> 192.168.2.110
  4. <- 192.168.2.1
  5. <- 192.168.88.1

The packet goes to the gateway 192.168.88.1 instead of the 192.168.88.10. Looking into the Mac mini routing tables I see:

192.168.88.202     192.168.88.10      UH              2       93    ppp1
192.168.88.202     40:6c:8f:3:d5:e7   UHLS2           0        0     en0

40:6c:8f:3:d5:e7 is the mac address of 192.168.88.1.

I would like to change the routing without using the internet sharing in order to allow internet access for 192.168.2.0, and cover both the VPN and local scenario, but I don't know the steps I need to do, and how to hand write the rules.

Thanks a lot.

  • 1. You have two default gateways: the one set for en2 is wrong - it should be nada/nothing. 2. You have a double-NAT: 1st is your ADSL router 2nd is your Mac mini en1>en2 (internet Sharing!) 3. Is it possible to setup a static route on your ADSL router? 4. Please add your system/macOS server version. 5. How did you set up forwarding on your ADSL router (to get VPN working)? – klanomath May 10 '17 at 14:07
  • 3. unfortunately no 4. El Capitan 5. I opened the ports for the L2TP protocol and forwarded to the 192.168.88.10 machine. – JayZee May 10 '17 at 15:32
  • the router is the default vodafone one, the "vodafone station revolution". It should be the Huawei hhg2500. – JayZee May 10 '17 at 15:37
  • where do MacOs store the network ip tables, and configuration files? – JayZee May 10 '17 at 15:41
3

It should be possible to create a bridge with en0 and en2 and enable net.inet.ip.forwarding to get rid of all routing problems. The bridge acts more or less as another switch between en0 and en2.


  • Disable Internet Sharing
  • remove the gateway in the en2 settings of the Mac mini and change the IP-address to an available one in 192.168.88.0/24 (e.g. 192.168.88.11)
  • remove all additional static routes
  • Check for bridge interfaces with ifconfig
  • On the server create a file bridge:

    sudo mkdir -p /usr/local/bin/ #only if the folder is missing
    sudo nano /usr/local/bin/bridge
    

    with the content

    #!/bin/bash
    
    sysctl -w net.inet.ip.forwarding=1
    ifconfig bridge create
    ifconfig bridge0 addm en0 addm en2 up #use the first available bridge number here and the proper interface device names
    
  • enter sudo chmod +x nano /usr/local/bin/bridge
  • Create a launch daemon usr.bridge.plist:

    sudo nano /Library/LaunchDaemons/usr.bridge.plist
    

    with the content

    <?xml version="1.0" encoding="UTF-8"?>
    <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
    <plist version="1.0">
    <dict>
        <key>Label</key>
        <string>usr.bridge</string>
        <key>ProgramArguments</key>
        <array>
            <string>/bin/sh</string>
            <string>-c</string>
            <string>/usr/local/bin/bridge</string>
        </array>
        <key>RunAtLoad</key>
        <true/>
        <key>StandardErrorPath</key>
        <string>/tmp/usr.bridge.err</string>
        <key>StandardOutPath</key>
        <string>/tmp/usr.bridge.out</string>
    </dict>
    </plist>
    
  • Load the plist

    sudo launchctl load /Library/LaunchDaemons/usr.bridge.plist
    
  • Change the IP-addresses of node_1 and node_10 to available ones in 192.168.88.0/24 (e.g. 192.168.88.101 and 192.168.88.110). Change their default gateways to 192.168.88.1 and the DNS server to 192.168.88.10.
  • Thanks a lot for the long answer! actually I would prefer to keep the 192.168.2.0 separate from the 192.168.88.0. Would it be possible with a bridge? – JayZee May 11 '17 at 7:39
  • @JayZee This doesn't make much sense: you want to access everything from all devices but without Internet Sharing/NAT. Then you either have to create a lot of additional static routes (one route will fail because you apparently can't add static routes on your router) or you create such a bridge. – klanomath May 11 '17 at 7:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .