I forgot my travel router at home. I would like to set up my MacBook as a VPN Travel router with 2 devices connected to it via Ethernet. I have 2 adapters that I can connect to my MacBook Pro but I'm not sure if it will work? Essentially, I wanted to set up my Mac as Wiregaurd Client. I want to attach 2 ethernet adapters to the Mac and connect to my VPN server though the MacBook. I understand hotspot does not work without my Mac connecting directly to a router but this is not an issue for me.
1 Answer
This is not meant to be a HOWTO for your particular application (it would be much too long for thus site) but an overview of what needs to be done to accomplish your goal.
macOS can function as a router. You will need:
- 2 network interfaces: one connecting to the Internet, the other for your LAN
- The WireGurad macOS client configured and working.
- DHCP, DNS, and routing services configured and running
- pf firewall configured to block all incoming Internet traffic by default, creating routes to forward traffic from the LAN to Internet or VPN as desired, and opening ports to allow VPN traffic to/from LAN.
- Your default route must must be bound to the VPN tunnel (created by the WG client) if you want all traffic going through the VPN. If you want only specific traffic to go through the VPN (i.e. browsing through local Internet and email through VPN), you’ll need to configure this in your routing table and pf firewall
While it’s technically a simple and straightforward setup, it’s not an easy one. There have been many existing questions/answers posted to this site on how to configure each of the elements described above. Here is a sampling:
- Mac DHCP Server
- How to use mac as a full router with DHCP, DNS, Port Fowarding etc.?
- How to configure MacOS firewall to block outgoing IP ranges?
- How to open a port in macOS Sierra 10.12.4
- Passing L2TP over IPSec VPN through a `pf` Firewall
This is by no means a comprehensive list, but it should give you some points of reference for each of the components you’ll have to configure to make this work