4

I have Murus 1.4.12 and am following the directions to share my internet connection from en0 (static IP connected to Comcast modem/router) through en3. Both the client and server are macOS High Sierra 10.13.1. I am successfully able to share it via System Preferences -> Sharing. Regardless of Murus, I am able to use en3 as a network device and ssh into the host over it -- just cannot share internet.

After resetting pf to its default state via Murus, installing boot scripts, and restarting, I create an NAT group with 10.0.0.25/32 (en3's IP) with access to all services. I then attempt to share internet connection from en0 (WAN interface) to en3.

On the client machine with its own static IP of 10.0.0.234 and router of 10.0.0.25, I am able to ping and ssh into 10.0.0.25 but do nothing else. When I sniff en3 via Murus I can see my attempts to ping 8.8.8.8 but everything times out on the client. The relevant pf rules Murus is generating are as follows:

table <NatLanInterfaces> { en3 }
pass net proto {tcp, udp} from {10.0.0.25/32 } to !<NATLanInterfaces> port {1:65535}

Can anyone see what I need to add or fix to let 10.0.0.234 access the WAN?

Improve this question
10
  • 1
    without seeing your pf rules, I would guess that you don't have a reverse route/rule set up allowing for responses to be sent back to the client. – Allan Jan 2 '18 at 18:16
  • @klanomath added -- 10.13.1 – Walrus the Cat Jan 2 '18 at 18:20
  • @Allan My rules are autogenerated by Murus. What would that rule look like? thanks! – Walrus the Cat Jan 2 '18 at 18:22
  • @klanomath thanks ... I don't think this Comcast router lets me get that fancy but I will give it a shot. amazon may be involved here. – Walrus the Cat Jan 2 '18 at 18:30
  • @klanomath this is a Cisco DPC3941T. Pretty sure Comcast has deliberately locked it down. – Walrus the Cat Jan 2 '18 at 18:36
1
+50

Your set up is probably faulty. A static route on the second router (connected to the ISP) isn't required.

The proper set up looks like this:

  • Open Murus and hit the wrench > Static NAT

enter image description here

  • Choose the proper LAN and WAN interfaces. In your environment the WAN interface probably is en0 or en1 and your LAN interface is en3.

  • Then move the mouse pointer to your NAT group and hit the looking glass:

    enter image description here

    Remove the current IP/network address (in your case 10.0.0.25/32) and add the "NAT-client's" IP address (in your case 10.0.0.234/32) or a network address (e.g. 10.0.0.0/24).

    You added the gateway's address (instead of the NATed network/host) by accident.

    Add "ALL SERVICES" to the Allowed Internet Services.

  • Close the NAT window.

  • In the menubar > Firewall > Interface Forwarding choose "Enable".

  • In the upper right corner of Murus hit the start button (►) - just to be sure.

  • Test the NAT with the client.

Improve this answer
3
  • You have to remove the gateway's IP (10.0.0.25/32) from the NAT group. I'll check the ping problem (which is shouldn't be a NAT or a routing problem) later this evening (~next 60 mins). – klanomath Jan 3 '18 at 23:45
  • @WalrustheCat Did you reboot the gateway (sometimes/often useful)? – klanomath Jan 3 '18 at 23:49
  • Let us continue this discussion in chat. – klanomath Jan 3 '18 at 23:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .