- iMac Pro 2017 running 10.14.5 Mojave (as the gateway)
- Android S10+ running Android 9
- iPhone XS
- iPad Pro 11"
On my home LAN, my iMac is connected on en0 with a static IP of 192.168.1.100. I can browse the internet but I have limitation due to my ISP’s firewall. My goal is run software on the iMac which connects to a VPN. Once that is done, I will use the iMac as a gateway so that other devices on my LAN can route via it and make use of the VPN connection.
Important to note that the VPN connects using OpenVPN XOR protocols which are only available using the custom software provided by the VPN provider so I cannot load VPN software directly onto devices like phones or iPads.
I am very close to having this work, I’m just missing a step somewhere. Here are my findings so far:
A. To test things, I leave the VPN disconnected so that the iMac has regular internet browsing.
A1. I alter the wifi settings on my phone to use the static IP 192.168.1.84 with a custom gateway 192.168.1.100 (iMac). I connect to the WLAN as usual but browsing does not work.
A2. On the iMac i run
sudo sysctl -w net.inet.ip.forwarding=1 to enable port forwarding and now i am successfully browsing the internet on my phone via the iMac.
Conclusion: phone -> iMac -> internet is working
B. Now we'll try that again, but with the VPN connected:
B1. iMac connects to the VPN successfully. It is evident that all internet browsing is now being routed through utun1. I can see this by running nettop or netstat -rn.
B2. Phone is still connected to WLAN using the iMac as a gateway. But since the VPN has connected, browsing is no longer working.
B3. I add
nat on utun1 from 192.168.1.0/24 to any -> (utun1) to /private/etc/pf.conf and then i run
sudo pfctl -d then
sudo pfctl -F all then
sudo pfctl -f /etc/pf.conf -e ... then I run
sudo pfctl -s nat and all appears to have loaded correctly. At this point, I am successfully browsing VPN, unblocked internet.
**NOTE*"* When adding to pf.conf make sure to insert at the correct point in the file because if the code is in the wrong place it will not run.
Conclusion: phone -> iMac -> VPN -> unblocked internet is working
The interesting thing is that I have been trying various combinations of the same steps mentioned above for 72 hours and I had little success. Only now after I have defined the process and followed it step-by-step it appears to work. Even after a restart, I follow the steps in order and it seems to be a reliable process.
The next step will be to build some kind of script that can automate the process at the click of an icon - maybe even run it at startup of the iMac.
Will revert with any updates.