I have two interfaces: - A physical WLAN interface with 802.1x auth (en0) - A virtual TUN interface with VPN (invisible in Network Settings) (utun1)

I have mobiles (both rooted Android and jailbroken iOS) that I want to intercept their HTTP/S traffic, over Bluetooth.

My first thought was to do Internet Sharing from WiFi to Bluetooth, OS X did not like this, as the WiFi has 802.1x auth.

Then I turned on Bluetooth Tethering without any connection on the Android, connected to it from the Mac (en3) and added the Mac as default route with ip route add default via <mac ip>. Then on the Mac I did: sysctl -w net.inet.ip.forwarding=1 echo "nat on utun1 from en3:network to any -> (utun1)" >> /etc/pf.conf pfctl -F all pfctl -ef /etc/pf.conf

I got no errors but the mobile device is not able to connect to the internet. It pings the mac, the route is fine, but the NAT does not work.

How can I share the VPN connection over Bluetooth PAN to the mobile devices? Should I try a different approach? Am I doing something wrong?

1 Answer 1


First on the Mac do a network configuration (a location in Apple wording) appropriate for your need. Never use the too infamous and too magic "Automatic" location. A configuration with a "Wi-Fi" and "Bluetooth PAN" interfaces and nothing else. Configure them (I guess you are familiar with this aspect to start playing with a VPN and the problems of security around this).

Once this is set, with nothing connected yet on the "Bluetooth PAN" interface, just configure an "Internet Sharing" (which in fact should be correctly named a "network gateway") as follows: Internet Sharing: Wi-Fi -> Bluetooth PAN

The correct sysctl, nat and pf settings will be done by many subprocesses hidden (and undocumented) behind Internet Sharing.

  • AFAIK this solution will not work as sharing on any interface is unsupported with 802.1x authorized connections. Best of luck!
    – bret7600
    Sep 16, 2018 at 10:59
  • that’s the problem. The 802.1x restriction...
    – dzervas
    Sep 16, 2018 at 11:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .