My Asus Router (Blue Cave) has the ability to let its disk act as a Time Machine capsule. For computers on its LAN, that works just fine. You can see the disk advertised (via Bonjour?) in the sidebar of Finder, select it via Time Machine, and back up.

Upstream from the Asus router and its LAN is another Mac, which provides them internet. The WAN IP for the router is and its parent Mac has the IP On parent mac, I mount afp://router.wan.ip, but can't just mount it without hassle from the Bonjour advertisement.

I'm having a lot of trouble backing up to the disk from both simultaneously. It's as if mounting on the one "steals" the disk from the other. They end up telling me they want to do a new backup and they don't have access to delete their .sparsebundle.purgeable and I should probably run first aid on the disk.

Per @klanomath's request, the network architecture is as follows:

modem to internet (internet IP space)
wired router (
mac mini (  sharing internet via pf static NAT
network adapter (en4) (
asus w/ network disk (, serving  
macbook (
  • 1
    Reading the router manual, nowhere does it say that it has the ability to act as a Time Capsule. It has the ability to share files, not be a Time Capsule server. – Allan Feb 20 '18 at 0:59
  • 2
    @Allan The Time Machine functionality is a feature of the USB Application! – klanomath Feb 20 '18 at 3:16
  • 1
    By definition 192.168/16 are private networks: non-routable to non-private networks > not really WAN (depends on how you define wide!). 192.168.1/24 or 192.168.2/24 are 1st and 2nd LAN!? With the default configuration of a /24 net mask for 192.168 networks the router and the parent "Mac" aren't in the same network (I would expect the parent Mac to have the IP This appears to be an error but it depends on your net mask. Please add net masks to your IP-addresses and the IP-addresses/net masks of the other (downstream) network. Better reveal the complete network environment. – klanomath Feb 20 '18 at 3:19
  • 1
    @klanomath nice to see you again, thanks for your interest. there is double NAT and i know that's wrong but it's the only way I can get it to work. I posted my network architecture, let me know if i'm missing any information. – Walrus the Cat Feb 20 '18 at 4:03
  • @WalrustheCat Looks like triple-NAT! 1. Wired router (internet < 192.168.1/24) 2. Mac mini (192.168.1/24 < 192.168.2/24) 3. ASUS Blue Cave (192.168.2/24 < 192.168.3/24)! – klanomath Feb 20 '18 at 7:40

It would be really nice to properly forward Bonjour or whatever is allowing it to be visible in the Finder sidebar (have already tried forwarding 1900,5300,5351,5353 to

This is not how Bonjour/Zeroconf was intended to function.

Bonjour only works within a single broadcast domain, which is usually a small area, without special DNS configuration. macOS, Bonjour for Windows and AirPort Base Stations may be configured to use Wide Area Bonjour which allows for wide area service discovery via an appropriately configured DNS server.

Emphasis mine.

Bonjour is a broadcast protocol meaning while on the subnet, it will broadcast out a message to see who responds. The key here is that it doesn't know the IP addresses of any machine (service) until it responds back. That's how Finder puts it in the sidebar as you describe.

You can't just enable Bonjour on the WAN or the Internet for that matter. MIT's IT knowledgebase sums it up:

"While ZEROCONF and Bonjour work well on home or small business networks, they are not compatible with large enterprise networks which can frequently have thousands of devices in the same wireless address space. ZEROCONF relies on multicast traffic to discover devices on the network, which exhibits crippling performance and load issues on large enterprise network implementations. Even if it were enabled on the network, results would be slow to return and potentially return lists of hundreds of devices to choose from, which can be unmanageable on devices such as iPhones or iPads."

Just for the sake of argument... if you were able to send out your broadcast packets over the Internet (via WAN), your ISP would most certainly block it because of the massive amount of traffic you would be generating.

Bonjour is basically DNS

It not about port forwarding "Bonjour." It's much more than that. Currently, you don't "port forward" DNS ports. Bonjour is a "DNS method".

You don't port forward DNS from your ISP to your computers so you can look up a domain. Your router either assigns the DNS servers during DHCP so you can query hosts/domains directly or acts as a relay to forward them to the actual DNS servers.

What does this mean?

(Remember the emphasized text at the beginning of this answer?) Technically speaking, you can get Bonjour to search another domain by adding that domain record into DNS (you're telling Bonjour to go search somewhere else). However, it requires the following:

If this is something you're willing to do, then start with learning BIND.

Connecting to Time Machine Shares

To connect to an internal AFP share so you can "Time Machine" across the network, you need to open those ports. See: What ports need to be open for netatalk to work as a Time Machine server on my LAN?

In my cursory reading of the Asus router manual, (IMO) it's not capable of this level port forwarding.

Personally, I would set up a VPN between to the two networks, routing all traffic through the VPN thus making it my subnet. Bonjour traffic will traverse the VPN "autodiscovering" everything. AFP will be immediately accessible as all traffic traverses the VPN without impediment of the firewall; meaning no port forwarding.

Bottom Line

This is not an effective nor productive solution. Time Machine was designed to work on the local network. Backups to a network connected Time Capsule over Gigabit can take hours. Significantly longer over WiFi. Connecting over the Internet at speeds that sometimes don't even reach 1/10 of that speed would take an eternity.

To get Bonjour service discovery setup to connect an AFP share to share a Time Capsule will require a ton of expended effort for hardly any results, if at all.

| improve this answer | |
  • 1
    thanks @Allan, it's clarifying. I suppose I thought opening ports associated with the Bonjour services would just pass everything through. I will keep your VPN solution in mind and possibly ask you more about it. – Walrus the Cat Feb 20 '18 at 3:52
  • 1
    regarding your VPN solution, could I use parent Mac as a VPN server and then the wireless router as its client? If this solution would work, would I attach the disk to parent mac or to the wireless router? – Walrus the Cat Feb 20 '18 at 4:08
  • You could use either machine as the VPN server, and make the router the client, but it would add to the complexity. The router is already your DHCP server for the LAN and it's easier for it to make the clients part of the network – Allan Feb 20 '18 at 11:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .