I have a company-issued 2017 MacBook Pro (4 x Thunderbolt 3 ports, macOS Sierra 10.12.6). My IT has installed Tunnelblick VPN so that I access company-internal servers over WiFi at home. I would like to share the VPN connection via Ethernet cable to another home machine (Windows laptop and/or desktop). Sounds simple enough, eh?

Model Name: MacBook Pro
Model Identifier:   MacBookPro14,2
Processor Name: Intel Core i5
Processor Speed:    3.1 GHz
Number of Processors:   1
Total Number of Cores:  2
L2 Cache (per Core):    256 KB
L3 Cache:   4 MB
Memory: 16 GB
Boot ROM Version:   MBP142.0167.B00
SMC Version (system):   2.44f1
Serial Number (system): C02TW0QCHV2T
Hardware UUID:  FF55C0D0-DDD5-50AE-B914-473716A4D10B
4 x Thunderbolt-3/USB-C ports

Here is the basic ifconfig (no Ethernet cable, no Inet sharing, no VPN) which works as expected: I can see external web sites, but not internal company sites:

lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> mtu 16384
  options=1203<RXCSUM,TXCSUM,TXSTATUS,SW_TIMESTAMP>
  inet 127.0.0.1 netmask 0xff000000 
  inet6 ::1 prefixlen 128 
  inet6 fe80::1%lo0 prefixlen 64 scopeid 0x1 
  nd6 options=201<PERFORMNUD,DAD>
 gif0: flags=8010<POINTOPOINT,MULTICAST> mtu 1280
 stf0: flags=0<> mtu 1280
 en6: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500
  ether ac:de:48:00:11:22 
  inet6 fe80::aede:48ff:fe00:1122%en6 prefixlen 64 scopeid 0x4 
  nd6 options=281<PERFORMNUD,INSECURE,DAD>
  media: autoselect
  status: active
en8: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500
  options=4<VLAN_MTU>
  ether 00:e0:4b:36:61:46 
  nd6 options=201<PERFORMNUD,DAD>
  media: autoselect (none)
  status: inactive
en0: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500
  ether 8c:85:90:05:2b:d7 
  inet6 fe80::56:be65:a160:ad8%en0 prefixlen 64 secured scopeid 0x6 
  inet 192.168.1.168 netmask 0xffffff00 broadcast 192.168.1.255
  nd6 options=201<PERFORMNUD,DAD>
  media: autoselect
  status: active
en2: flags=963<UP,BROADCAST,SMART,RUNNING,PROMISC,SIMPLEX> mtu 1500
  options=60<TSO4,TSO6>
  ether fe:00:94:e0:83:04 
  media: autoselect <full-duplex>
  status: inactive
  en4: flags=963<UP,BROADCAST,SMART,RUNNING,PROMISC,SIMPLEX> mtu 1500
  options=60<TSO4,TSO6>
  ether fe:00:94:e0:83:05 
  media: autoselect <full-duplex>
  status: inactive
en1: flags=963<UP,BROADCAST,SMART,RUNNING,PROMISC,SIMPLEX> mtu 1500
  options=60<TSO4,TSO6>
  ether fe:00:94:e0:83:00 
  media: autoselect <full-duplex>
  status: inactive
en3: flags=963<UP,BROADCAST,SMART,RUNNING,PROMISC,SIMPLEX> mtu 1500
  options=60<TSO4,TSO6>
  ether fe:00:94:e0:83:01 
  media: autoselect <full-duplex>
  status: inactive
bridge0: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500
  options=63<RXCSUM,TXCSUM,TSO4,TSO6>
  ether fe:00:94:e0:83:00 
  Configuration:
    id 0:0:0:0:0:0 priority 0 hellotime 0 fwddelay 0
    maxage 0 holdcnt 0 proto stp maxaddr 100 timeout 1200 
    root id 0:0:0:0:0:0 priority 0 ifcost 0 port 0
    ipfilter disabled flags 0x2
  member: en1 flags=3<LEARNING,DISCOVER>
        ifmaxaddr 0 port 9 priority 0 path cost 0
  member: en2 flags=3<LEARNING,DISCOVER>
        ifmaxaddr 0 port 7 priority 0 path cost 0
  member: en3 flags=3<LEARNING,DISCOVER>
        ifmaxaddr 0 port 10 priority 0 path cost 0
  member: en4 flags=3<LEARNING,DISCOVER>
        ifmaxaddr 0 port 8 priority 0 path cost 0
  nd6 options=201<PERFORMNUD,DAD>
  media: <unknown type>
  status: inactive
p2p0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 2304
  ether 0e:85:90:05:2b:d7 
  media: autoselect
  status: inactive
awdl0: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> mtu 1484
  ether 02:11:66:be:14:c8 
  inet6 fe80::11:66ff:febe:14c8%awdl0 prefixlen 64 scopeid 0xd 
  nd6 options=201<PERFORMNUD,DAD>
  media: autoselect
  status: active
utun0: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> mtu 2000
  inet6 fe80::e196:26e7:fb6c:2069%utun0 prefixlen 64 scopeid 0xe 
  nd6 options=201<PERFORMNUD,DAD>

Now I plug in PC <-> Ethernet cable <-> adapter <-> Thunderbolt3 <-> Mac. The change to Mac ifconfig is:

en8: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500
  options=4<VLAN_MTU>
  ether 00:e0:4b:36:61:46 
  inet6 fe80::108b:f827:7bd6:a14f%en8 prefixlen 64 secured scopeid 0x5 
  inet 169.254.209.90 netmask 0xffff0000 broadcast 169.254.255.255
  nd6 options=201<PERFORMNUD,DAD>
  media: autoselect (100baseTX <full-duplex>)
  status: active

So it seems that en8 is Ethernet interface (shows up in Network as USB 10/100 LAN /Self-assigned IP, Connected, Using DHCP). Now I go to (Mac) Sharing and turn on Internet Sharing from Wi-Fi to USB 10/100 Lan. Sometimes (as in this example) a Mac reboot is required (not sure why?), but I can now access Inet from PC over Ethernet. Changes to ifconfig are:

en8: flags=8963<UP,BROADCAST,SMART,RUNNING,PROMISC,SIMPLEX,MULTICAST> mtu 1500
  options=4<VLAN_MTU>
  ether 00:e0:4b:36:61:46 
  inet 169.254.160.155 netmask 0xffff0000 broadcast 169.254.255.255
  nd6 options=201<PERFORMNUD,DAD>
  media: autoselect (100baseTX <full-duplex>)
  status: active
en0: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500
  ether 8c:85:90:05:2b:d7 
  inet6 fe80::1443:52bd:fc9:5d8e%en0 prefixlen 64 secured scopeid 0x6 
  inet 192.168.1.168 netmask 0xffffff00 broadcast 192.168.1.255
  nd6 options=201<PERFORMNUD,DAD>
  media: autoselect
  status: active
awdl0: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> mtu 1484
  ether ca:86:5c:83:f9:ac 
  inet6 fe80::c886:5cff:fe83:f9ac%awdl0 prefixlen 64 scopeid 0xd 
  nd6 options=201<PERFORMNUD,DAD>
  media: autoselect
  status: active
utun0: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> mtu 2000
  inet6 fe80::8bff:1abf:f968:adf9%utun0 prefixlen 64 scopeid 0xe 
  nd6 options=201<PERFORMNUD,DAD>
bridge100: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500
  options=3<RXCSUM,TXCSUM>
  ether ae:de:48:00:33:64 
  inet 192.168.2.1 netmask 0xffffff00 broadcast 192.168.2.255
  inet6 fe80::acde:48ff:fe00:3364%bridge100 prefixlen 64 scopeid 0xf 
  Configuration:
    id 0:0:0:0:0:0 priority 0 hellotime 0 fwddelay 0
    maxage 0 holdcnt 0 proto stp maxaddr 100 timeout 1200
    root id 0:0:0:0:0:0 priority 0 ifcost 0 port 0
    ipfilter disabled flags 0x2
  member: en8 flags=3<LEARNING,DISCOVER>
        ifmaxaddr 0 port 5 priority 0 path cost 0
  nd6 options=201<PERFORMNUD,DAD>
  media: autoselect
  status: active

So far, so good. Now I turn on the VPN. Inet on the Mac still works, plus I can now access internal company sites. Changes to ifconfig are:

tap0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
  ether 2e:f1:63:c3:59:aa 
  inet 10.2.4.110 netmask 0xffffff00 broadcast 10.2.4.255
  media: autoselect
  status: active
  open (pid 1223)

However, I can no longer acess Inet from the PC. Everything says “There is no Internet connection.” :(

Note: I had hoped to see a new entry in Internet Sharing for "from: VPN" or something like that, but there is nothing new there. I have Googled a number of items, such as these:

https://superuser.com/questions/931827/sharing-openvpn-on-mac-os-x-yosemite https://www.facebook.com/linuxmasterdotro/posts/1520350381566910 https://blog.netnerds.net/2016/11/share-vpn-with-os-x-sierra-internet-sharing/

They suggest setting up one or more nat-rules, such as:

nat on utun0 from bridge100 to any -> (utun0)
    -or-
nat on tap0  from bridge100 to any -> (tap0)
    -or-
nat on en0   from bridge100 to any -> (enp0)

and then doing:

sysctl -w net.inet.ip.forwarding=1
sysctl -w net.inet.ip.fw.enable=1    # Note: gets unknown oid on my MAC
pfctl -d
pfctl -F all
pfctl -f ./nat-rules -e

I have tried (it seems like) hundreds of variations of these commands (different nat intrerface names, etc.), but nothing seems to work. I can still access external and internal sites from the Mac, but nothing from the PC. Any advice?

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.