I am trying to forward traffic like this:

Internal Network Computer (192.168.1.*) → Server (192.168.186:1234) → Internal Network Computer (
  • Server is plugged into the router via ethernet on interface en0

  • Internal Computer is connected to router via wifi

  • Server can access with no problems

According to various other related questions, I have gotten the following rules

nat on en0 from any to en0 -> (en0)
rdr pass inet proto tcp from any to any port 1234 -> port 80

However I get the following when telneting:

$ telnet 1234
telnet: connect to address Operation timed out
telnet: Unable to connect to remote host

Using Wireshark on the I have confirmed that the telenet connection is received however it doesn't seem to connect.

Some more info:

  • rdr's from to work fine, for example:

    rdr pass inet proto tcp from any to any port 1234 -> port 80

  • I have confirmed that port 80 is open on, and that it is accessible from the server

  • Firewall (in System Preferences) is disabled on both computers

  • I have enabled cross interface traffic forwarding with

    sudo sysctl -w net.inet.ip.forwarding=1

  • I think it may be something with NAT (see the below posts) but I am not sure

The same issue is discussed on GitHub. @ctgreybeard, @dandriana, @snimavat, and @sergeyzwezdin have all reported the same issue. Does anyone have a solution?

Please Note: I would like to use pfctl and not SSH or another service.

Here are some other related posts:


How can I setup my mac (OS X Yosemite) as an internet gateway

  • 127/8 is sometimes handled as a special case. Is this a problem only when using, or does it also happen for other (non-127) IP addresses?
    – jksoegaard
    Jun 25, 2019 at 8:36
  • @jksoegaard I can test a bit later to be sure, but according to the GitHub thread the same issue occurs when using non address. Jun 25, 2019 at 11:05
  • Maybe a stupid question but: is the 'telnet' service running on the machine you're trying to connect to? Port 23 must be open as this is the 'telnet' 's standard port.
    – Dakta
    Jun 30, 2019 at 17:58
  • @DaktaMoriamé telnet is being run from the Internal Network Computer. telnet is connecting to port 1234 as per the command telnet 1234. Jun 30, 2019 at 21:19

1 Answer 1


This is how I got it to work.

My example uses three hosts on my network ( = Linux client = Mac "real server" providing a service on port 3000 = Mac "server" performing pf redirection, listening on port 2004, interface vlan0


rdr on vlan0 inet proto tcp from to port 2004 -> port 3000
nat on vlan0 inet proto tcp from to port 3000 ->

The specificity ensures your server isn't NATting traffic that it shouldn't.

For those doing this from scratch, after creating your natrdr.pf file above, run the following commands from the command line or a shell script, sudo or as root. Integrating the pf rules with Apple's pf.conf files is an exercise left to the reader.

# Enable packet forwarding

sysctl -w net.inet.ip.forwarding=1

# Unless you have any rules you want to keep, let's flush existing NAT rules
pfctl -F nat

# Enable packet filtering
pfctl -e

# Load rules from our file
pfctl -f natrdr.pf

# Confirm rules are loaded
pfctl -s nat

# Check to see connections 
pfctl -s states

I then used telnet 2004 and was immediately forwarded to the Node/express server running on port 3000 on

Example output of pfctl -s states to verify it's working:


So, to make it match your setup:

rdr on en0 inet proto tcp from to port 1234 -> port 80
nat on en0 inet proto tcp from to port 80 ->

The order of rules is important.

The redirect rule does what's expected: it forwards all traffic coming into the server to the real server.

The NAT rule changes the (now redirected) packets to have a source IP address of the redirecting server instead of the original client.

The combination of these rules ensures that a reverse path for the return packets to follow is automatically created.

  • It seems to be working! Thank you so much! One last question, if I wanted to make the client a remote computer (accessing from a different network) how would I adapt the rules? The pf server is located at (public ip) and client is at lets say, however the client address is dynamic. Jul 3, 2019 at 16:58
  • At that point you'd have to change the "from" address to "any" (unless you know the range from which the IP's will come) and the "to" address to the IP of the public-facing interface. Jul 3, 2019 at 19:56
  • After some trial an error, I only had to change the from address to any. I speculate that this is because I am behind a router and not connected the outside directly. Everything works! Thanks so much, been looking to solve this for a while. Jul 4, 2019 at 5:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .