11

I'm trying to setup my iMac running 10.6 to be a wireless bridge. I have it working, but I need to disable DHCP and let my network's DHCP server provide an IP for the connected device(s). I can't seem to find a way to disable DHCP in Internet Connection Sharing. Does anyone know if this is possible? I'm guessing there's a key one could set in /Library/Preferences/SystemConfiguration/com.apple.nat.plist, but I can't find it. I checked the man page for InternetSharing and it doesn't mention anything useful, except changing the subnet that the DHCP server uses.

  • AFAIK, OS X Internet Sharing only does NAT, not true bridging. So the devices using your iMac for connectivity are on their own private network, and your iMac acts as a router. Because of this, the connected devices need to get an IP from your iMac. They wouldn't be able to contact your existing DHCP server. I'm not familiar enough with the guts of Internet Sharing to be certain, but that's my best quasi-informed guess. – robmathers Sep 11 '12 at 18:40
2

From the bootpd man page:

For each of the properties dhcp_enabled, bootp_enabled, old_netboot_enabled, netboot_enabled, and relay_enabled, the corresponding service can be enabled or disabled for all interfaces, or enabled for just a specific set of interfaces. To enable or disable globally, use a boolean value true or false respectively. To enable just for a specific set of interfaces, use either a string, for a single interface, or an array of strings, one element for each interface.

 For example, to enable DHCP on interfaces en0 and en1, disable BOOTP on all
 interfaces, enable NetBoot on en1, and enable relay agent on interface en1,
 /etc/bootpd.plist could contain:
 <?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <dict>
         <key>bootp_enabled</key>
         <false/>
         <key>dhcp_enabled</key>
         <array>
                 <string>en0</string>
                 <string>en1</string>
         </array>
         <key>netboot_enabled</key>
         <string>en1</string>
         <key>relay_enabled</key>
         <array>
                 <string>en1</string>
         </array>
 </dict>
 </plist>

To disable dhcp globally, use:

    <key>dhcp_enabled</key>
    <false/>

Don't forget to send a SIGHUP (kill -1) to bootpd after making changes to the configuration file.

1

InternetSharing is performing 2 tasks:

  • dynamically providing an IP address to devices connected on the secondary network interface (bootpd)
  • managing the IP addresses translation (NAT) for these dynamically attributed addresses (natd on Snow Leopard & natpmpd on Lion)

InternetSharing doesn't let you configure a MacOS X as an IP bridge. See man InternetSharing (available on Snow Leopard but not on Lion).

This would be a bad idea: most notably because of the risks involved with a plain bold transparent bridge: Internally InternetSharing is performing a:

sysctl -w 'net.inet.ip.forwarding=1'

which permits any IP traffic to go through. To alleviate this problem, only IP addresses attributed on the secondary interface through bootpd and translated through natd or natpmpd are correctly translated to the outside.

  • Thanks for your response, Daniel. Two questions: (1) What's your level of confidence that InternetSharing doesn't allow one to disable DHCP (and can you provide any evidence/resources)? (2) Can you please elaborate on why you feel this would be a bad idea? What are the risks of which you speak? Again, evidence and references would be appreciated. Thanks – Matthew Boynes Sep 12 '12 at 2:01
  • I tried to improve my explanations thanks to your questions. – dan Sep 12 '12 at 8:40
  • The man page specifically says, "Details of the com.apple.nat.plist ... are not completely documented here," so it's entirely possible that there's a setting that would disable DHCP. Unfortunately, we're still left without hard evidence on whether or not this can be done. Thanks for adding detail all the same – Matthew Boynes Sep 12 '12 at 12:52
  • In fact I went further than just reading the disclaimer within the man page ;). I'm pretty sure there is no backdoor to debug without forking bootpd. But, at least, you may try the -d option within the plist. – dan Sep 12 '12 at 18:47
  • com.apple.nat is not what configures bootpd. /etc/bootpd.plist is. – dcow Nov 4 '16 at 22:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .