My iMac has software which connects to a remote VPN. It works well - but only that specific device.

I now want to allow other devices on my network to access the same VPN connection via the iMac. The reason for doing this is because my phone cannot connect to the VPN itself as it does not support the OpenVPN protocol.

I have enabled port forwarding with: sysctl -w net.inet.ip.forwarding=1

I have tried to add the following to line 32 in my /etc/pf.conf file: nat on utun1 from en0:network to any -> (utun1) where en0 is my ethernet port that the internet comes from and utun1 is where all the traffic is once the vpn is connected

When I run sudo pfctl -e -f /etc/pf.conf I get the error:

/etc/pf.conf:32: Rules must be in order: options, normalization, queueing, translation, filtering pfctl: Syntax error in config file: pf rules not loaded

Can anyone tell me why I'm getting this error? Am i using the nat command incorrectly?

FYI - I have been following the tutorial Set up Internet Sharing on Mac OSX using Command Line Tools

  • "my phone cannot connect to the VPN itself as it does not support the OpenVPN protocol" - Android? Download the "OpenVPN for Android" app by Arne Schwabe. – roaima Sep 5 at 6:31
  • 1
    Thanks but the desktop software connects using XOR protocols (to bypass firewall restrictions) and the phone cannot achieve that type of connection. Using regular l2tp/ikev2 connections are not smart enough to bypass the firewall – user293932 Sep 5 at 7:08
  • Have you added this NAT rule into the right block of the file (the error message specifies an ordering)? It would seem to me that you've possibly added your translation rule after a filtering rule, and this apparently isn't allowed. – roaima Sep 5 at 7:58
  • Thanks for the suggestion - you were right, i moved that line up and then ran sudo pfctl -e -f /etc/pf.conf again and it didn't give an error this time. Now, the next question - what pfctl syntax can i run to see that nat on utun1 from en0:network to any -> (utun1) is actually implemented and running? – user293932 Sep 5 at 8:25
  • 1
    Update - it has something to do with bridge100. Will keep experimenting and then revert when i have the solution. – user293932 Sep 5 at 14:01

Devices used:

  • iMac Pro 2017 running 10.14.5 Mojave (as the gateway)
  • Android S10+ running Android 9
  • iPhone XS
  • iPad Pro 11"

On my home LAN, my iMac is connected on en0 with a static IP of I can browse the internet but I have limitation due to my ISP’s firewall. My goal is run software on the iMac which connects to a VPN. Once that is done, I will use the iMac as a gateway so that other devices on my LAN can route via it and make use of the VPN connection.

Important to note that the VPN connects using OpenVPN XOR protocols which are only available using the custom software provided by the VPN provider so I cannot load VPN software directly onto devices like phones or iPads.

I am very close to having this work, I’m just missing a step somewhere. Here are my findings so far:

A. To test things, I leave the VPN disconnected so that the iMac has regular internet browsing.

A1. I alter the wifi settings on my phone to use the static IP with a custom gateway (iMac). I connect to the WLAN as usual but browsing does not work.

A2. On the iMac i run sudo sysctl -w net.inet.ip.forwarding=1 to enable port forwarding and now i am successfully browsing the internet on my phone via the iMac.

Conclusion: phone -> iMac -> internet is working

B. Now we'll try that again, but with the VPN connected:

B1. iMac connects to the VPN successfully. It is evident that all internet browsing is now being routed through utun1. I can see this by running nettop or netstat -rn.

B2. Phone is still connected to WLAN using the iMac as a gateway. But since the VPN has connected, browsing is no longer working.

B3. I add nat on utun1 from to any -> (utun1) to /private/etc/pf.conf and then i run sudo pfctl -d then sudo pfctl -F all then sudo pfctl -f /etc/pf.conf -e ... then I run sudo pfctl -s nat and all appears to have loaded correctly. At this point, I am successfully browsing VPN, unblocked internet.

**NOTE*"* When adding to pf.conf make sure to insert at the correct point in the file because if the code is in the wrong place it will not run.

Conclusion: phone -> iMac -> VPN -> unblocked internet is working

The interesting thing is that I have been trying various combinations of the same steps mentioned above for 72 hours and I had little success. Only now after I have defined the process and followed it step-by-step it appears to work. Even after a restart, I follow the steps in order and it seems to be a reliable process.

The next step will be to build some kind of script that can automate the process at the click of an icon - maybe even run it at startup of the iMac.

Will revert with any updates.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.