3

I have a company-issued 2017 MacBook Pro (4 x Thunderbolt 3 ports, macOS Sierra 10.12.6). My IT has installed Tunnelblick VPN so that I access company-internal servers over WiFi at home. I would like to share the VPN connection via Ethernet cable to another home machine (Windows laptop and/or desktop). Sounds simple enough, eh?

Model Name: MacBook Pro
Model Identifier:   MacBookPro14,2
Processor Name: Intel Core i5
Processor Speed:    3.1 GHz
Number of Processors:   1
Total Number of Cores:  2
L2 Cache (per Core):    256 KB
L3 Cache:   4 MB
Memory: 16 GB
Boot ROM Version:   MBP142.0167.B00
SMC Version (system):   2.44f1
Serial Number (system): C02TW0QCHV2T
Hardware UUID:  FF55C0D0-DDD5-50AE-B914-473716A4D10B
4 x Thunderbolt-3/USB-C ports

Here is the basic ifconfig (no Ethernet cable, no Inet sharing, no VPN) which works as expected: I can see external web sites, but not internal company sites:

lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> mtu 16384
  options=1203<RXCSUM,TXCSUM,TXSTATUS,SW_TIMESTAMP>
  inet 127.0.0.1 netmask 0xff000000 
  inet6 ::1 prefixlen 128 
  inet6 fe80::1%lo0 prefixlen 64 scopeid 0x1 
  nd6 options=201<PERFORMNUD,DAD>
 gif0: flags=8010<POINTOPOINT,MULTICAST> mtu 1280
 stf0: flags=0<> mtu 1280
 en6: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500
  ether ac:de:48:00:11:22 
  inet6 fe80::aede:48ff:fe00:1122%en6 prefixlen 64 scopeid 0x4 
  nd6 options=281<PERFORMNUD,INSECURE,DAD>
  media: autoselect
  status: active
en8: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500
  options=4<VLAN_MTU>
  ether 00:e0:4b:36:61:46 
  nd6 options=201<PERFORMNUD,DAD>
  media: autoselect (none)
  status: inactive
en0: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500
  ether 8c:85:90:05:2b:d7 
  inet6 fe80::56:be65:a160:ad8%en0 prefixlen 64 secured scopeid 0x6 
  inet 192.168.1.168 netmask 0xffffff00 broadcast 192.168.1.255
  nd6 options=201<PERFORMNUD,DAD>
  media: autoselect
  status: active
en2: flags=963<UP,BROADCAST,SMART,RUNNING,PROMISC,SIMPLEX> mtu 1500
  options=60<TSO4,TSO6>
  ether fe:00:94:e0:83:04 
  media: autoselect <full-duplex>
  status: inactive
  en4: flags=963<UP,BROADCAST,SMART,RUNNING,PROMISC,SIMPLEX> mtu 1500
  options=60<TSO4,TSO6>
  ether fe:00:94:e0:83:05 
  media: autoselect <full-duplex>
  status: inactive
en1: flags=963<UP,BROADCAST,SMART,RUNNING,PROMISC,SIMPLEX> mtu 1500
  options=60<TSO4,TSO6>
  ether fe:00:94:e0:83:00 
  media: autoselect <full-duplex>
  status: inactive
en3: flags=963<UP,BROADCAST,SMART,RUNNING,PROMISC,SIMPLEX> mtu 1500
  options=60<TSO4,TSO6>
  ether fe:00:94:e0:83:01 
  media: autoselect <full-duplex>
  status: inactive
bridge0: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500
  options=63<RXCSUM,TXCSUM,TSO4,TSO6>
  ether fe:00:94:e0:83:00 
  Configuration:
    id 0:0:0:0:0:0 priority 0 hellotime 0 fwddelay 0
    maxage 0 holdcnt 0 proto stp maxaddr 100 timeout 1200 
    root id 0:0:0:0:0:0 priority 0 ifcost 0 port 0
    ipfilter disabled flags 0x2
  member: en1 flags=3<LEARNING,DISCOVER>
        ifmaxaddr 0 port 9 priority 0 path cost 0
  member: en2 flags=3<LEARNING,DISCOVER>
        ifmaxaddr 0 port 7 priority 0 path cost 0
  member: en3 flags=3<LEARNING,DISCOVER>
        ifmaxaddr 0 port 10 priority 0 path cost 0
  member: en4 flags=3<LEARNING,DISCOVER>
        ifmaxaddr 0 port 8 priority 0 path cost 0
  nd6 options=201<PERFORMNUD,DAD>
  media: <unknown type>
  status: inactive
p2p0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 2304
  ether 0e:85:90:05:2b:d7 
  media: autoselect
  status: inactive
awdl0: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> mtu 1484
  ether 02:11:66:be:14:c8 
  inet6 fe80::11:66ff:febe:14c8%awdl0 prefixlen 64 scopeid 0xd 
  nd6 options=201<PERFORMNUD,DAD>
  media: autoselect
  status: active
utun0: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> mtu 2000
  inet6 fe80::e196:26e7:fb6c:2069%utun0 prefixlen 64 scopeid 0xe 
  nd6 options=201<PERFORMNUD,DAD>

Now I plug in PC <-> Ethernet cable <-> adapter <-> Thunderbolt3 <-> Mac. The change to Mac ifconfig is:

en8: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500
  options=4<VLAN_MTU>
  ether 00:e0:4b:36:61:46 
  inet6 fe80::108b:f827:7bd6:a14f%en8 prefixlen 64 secured scopeid 0x5 
  inet 169.254.209.90 netmask 0xffff0000 broadcast 169.254.255.255
  nd6 options=201<PERFORMNUD,DAD>
  media: autoselect (100baseTX <full-duplex>)
  status: active

So it seems that en8 is Ethernet interface (shows up in Network as USB 10/100 LAN /Self-assigned IP, Connected, Using DHCP). Now I go to (Mac) Sharing and turn on Internet Sharing from Wi-Fi to USB 10/100 Lan. Sometimes (as in this example) a Mac reboot is required (not sure why?), but I can now access Inet from PC over Ethernet. Changes to ifconfig are:

en8: flags=8963<UP,BROADCAST,SMART,RUNNING,PROMISC,SIMPLEX,MULTICAST> mtu 1500
  options=4<VLAN_MTU>
  ether 00:e0:4b:36:61:46 
  inet 169.254.160.155 netmask 0xffff0000 broadcast 169.254.255.255
  nd6 options=201<PERFORMNUD,DAD>
  media: autoselect (100baseTX <full-duplex>)
  status: active
en0: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500
  ether 8c:85:90:05:2b:d7 
  inet6 fe80::1443:52bd:fc9:5d8e%en0 prefixlen 64 secured scopeid 0x6 
  inet 192.168.1.168 netmask 0xffffff00 broadcast 192.168.1.255
  nd6 options=201<PERFORMNUD,DAD>
  media: autoselect
  status: active
awdl0: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> mtu 1484
  ether ca:86:5c:83:f9:ac 
  inet6 fe80::c886:5cff:fe83:f9ac%awdl0 prefixlen 64 scopeid 0xd 
  nd6 options=201<PERFORMNUD,DAD>
  media: autoselect
  status: active
utun0: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> mtu 2000
  inet6 fe80::8bff:1abf:f968:adf9%utun0 prefixlen 64 scopeid 0xe 
  nd6 options=201<PERFORMNUD,DAD>
bridge100: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500
  options=3<RXCSUM,TXCSUM>
  ether ae:de:48:00:33:64 
  inet 192.168.2.1 netmask 0xffffff00 broadcast 192.168.2.255
  inet6 fe80::acde:48ff:fe00:3364%bridge100 prefixlen 64 scopeid 0xf 
  Configuration:
    id 0:0:0:0:0:0 priority 0 hellotime 0 fwddelay 0
    maxage 0 holdcnt 0 proto stp maxaddr 100 timeout 1200
    root id 0:0:0:0:0:0 priority 0 ifcost 0 port 0
    ipfilter disabled flags 0x2
  member: en8 flags=3<LEARNING,DISCOVER>
        ifmaxaddr 0 port 5 priority 0 path cost 0
  nd6 options=201<PERFORMNUD,DAD>
  media: autoselect
  status: active

So far, so good. Now I turn on the VPN. Inet on the Mac still works, plus I can now access internal company sites. Changes to ifconfig are:

tap0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
  ether 2e:f1:63:c3:59:aa 
  inet 10.2.4.110 netmask 0xffffff00 broadcast 10.2.4.255
  media: autoselect
  status: active
  open (pid 1223)

However, I can no longer acess Inet from the PC. Everything says “There is no Internet connection.” :(

Note: I had hoped to see a new entry in Internet Sharing for "from: VPN" or something like that, but there is nothing new there. I have Googled a number of items, such as these:

https://superuser.com/questions/931827/sharing-openvpn-on-mac-os-x-yosemite https://www.facebook.com/linuxmasterdotro/posts/1520350381566910 https://blog.netnerds.net/2016/11/share-vpn-with-os-x-sierra-internet-sharing/

They suggest setting up one or more nat-rules, such as:

nat on utun0 from bridge100 to any -> (utun0)
    -or-
nat on tap0  from bridge100 to any -> (tap0)
    -or-
nat on en0   from bridge100 to any -> (enp0)

and then doing:

sysctl -w net.inet.ip.forwarding=1
sysctl -w net.inet.ip.fw.enable=1    # Note: gets unknown oid on my MAC
pfctl -d
pfctl -F all
pfctl -f ./nat-rules -e

I have tried (it seems like) hundreds of variations of these commands (different nat intrerface names, etc.), but nothing seems to work. I can still access external and internal sites from the Mac, but nothing from the PC. Any advice?

You must log in to answer this question.

Browse other questions tagged .