Assume my Mac Mini (Sierra/High Sierra, doesn't matter) has two defined users: user1 and user2.

The machine has two IPs assigned via Ethernet:

inet netmask 0xffffff00 broadcast    
inet netmask 0xffffff00 broadcast
status: active

Is it possible restricting user1 to and user2 to

i.e, when user1 performs any network actions on the machine, the source IP would be

Both users can be logged in to the machine at the same time via SSH.


So it's possible to perform source IP NAT translation by adding the following rule to pfctl

nat on en0 inet from any to any ->

But nat-rules do not support filtering (by specific user) - in contrary to block/pass rules, so I need to keep digging

  • I don't know, but I suspect it would involve setting a route to any address to use a particular interface address for each user: route add -host INADDR_ANY -ifa Have a read through superuser.com/questions/756134/… and man route. – Heath Raftery Jan 30 '18 at 13:14

The solution was to implement a Network Kernel Extension that changes the source IP of the socket based on the user ID.

More on NKEs can be found here

  • Very interesting! Can you tell me how you changed the source ip? just in a bind() call? – horseyguy Jul 8 at 14:03
  • @horseyguy yeah – Shai Jul 8 at 15:50
  • wow, and that affects how the packets get routed? cos in my case i have a VPN that has the default route, but i also have another default route (that is overriden by the VPN) -- and i am trying to get packets from one app to go out the non-VPN interface by binding the sockets to the non-VPN ip, but it doesn't appear to work! It does work on windows, but on macos, i get "no route to host" errors. Any suggestions? or might you even share your code? :) – horseyguy Jul 10 at 0:17
  • It's a good question. Hard to determine without actually testing it. You can also use interface filters for this (I think). Can't share code unfortunately. But if you share yours I am willing to have a look – Shai Jul 10 at 7:28
  • Oh ok -- so you weren't trying to change the way packets were routed? – horseyguy Jul 10 at 8:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .