macOS – Fixing Murus Internet Sharing Not Working

firewallhigh sierrainternet-sharingmacos

I have Murus 1.4.12 and am following the directions to share my internet connection from en0 (static IP connected to Comcast modem/router) through en3. Both the client and server are macOS High Sierra 10.13.1. I am successfully able to share it via System Preferences -> Sharing. Regardless of Murus, I am able to use en3 as a network device and ssh into the host over it — just cannot share internet.

After resetting pf to its default state via Murus, installing boot scripts, and restarting, I create an NAT group with 10.0.0.25/32 (en3's IP) with access to all services. I then attempt to share internet connection from en0 (WAN interface) to en3.

On the client machine with its own static IP of 10.0.0.234 and router of 10.0.0.25, I am able to ping and ssh into 10.0.0.25 but do nothing else. When I sniff en3 via Murus I can see my attempts to ping 8.8.8.8 but everything times out on the client. The relevant pf rules Murus is generating are as follows:

table <NatLanInterfaces> { en3 }
pass net proto {tcp, udp} from {10.0.0.25/32 } to !<NATLanInterfaces> port {1:65535}

Can anyone see what I need to add or fix to let 10.0.0.234 access the WAN?

Best Answer

Your set up is probably faulty. A static route on the second router (connected to the ISP) isn't required.

The proper set up looks like this:

  • Open Murus and hit the wrench > Static NAT

enter image description here

  • Choose the proper LAN and WAN interfaces. In your environment the WAN interface probably is en0 or en1 and your LAN interface is en3.

  • Then move the mouse pointer to your NAT group and hit the looking glass:

    enter image description here

    Remove the current IP/network address (in your case 10.0.0.25/32) and add the "NAT-client's" IP address (in your case 10.0.0.234/32) or a network address (e.g. 10.0.0.0/24).

    You added the gateway's address (instead of the NATed network/host) by accident.

    Add "ALL SERVICES" to the Allowed Internet Services.

  • Close the NAT window.

  • In the menubar > Firewall > Interface Forwarding choose "Enable".

  • In the upper right corner of Murus hit the start button (►) - just to be sure.

  • Test the NAT with the client.

Related Question