Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Good day,

I am attempting to replicate a setup I have between a router and an Ubuntu PC, and have the same setup working on my MacBook (10.6, Snow Leopard).

First, I have a router that has a USB port. When I plug it into my Ubuntu PC, it creates an RNDIS connection, allowing me to connect to the router over the USB cable via an IP connection. When I plug it into my computer via USB, it gets assigned an IP address of, and a new adapter appears when I type ifconfig. I can then SSH into the device via ssh admin@

When I log in to the device, I flush the routes, then create the default route:

admin@localhost> route -f
admin@localhost> route add default

Now, in my Ubuntu machine, I use iptables to enable IP masquerading:

root@Valhalla> sudo iptables -t nat -A POSTROUTING -s -j MASQUERADE

Once this is all done, the router has internet access over the USB connection to my PC.

I am trying to replicate this exact setup on my MacBook now (Snow Leopard), but iptables does not exist for OSX, not even a Macports version exists. I have scoured through other questions on StackOverflow that cover the usage of the ipfw command, which apparently works as a drop-in replacement for iptables. However, the syntax is significantly different, and I'm pretty much lost.

Does anyone with some experience with ipfw have some suggestions on how I could accomplish this and create a NAT connection via IP masquerading like I could with my Ubuntu PC?

Thank you for your assistance.

share|improve this question

migrated from Dec 13 '12 at 18:04

This question came from our site for professional and enthusiast programmers.

up vote 1 down vote accepted

well, the easiest way to do it using OSX is simply by using the System Preferences->Sharing->Internet Sharing. You check Internet Sharing, and configure it so it states Share your connection from Ethernet 2 (as I suppose your USB network device appears as), To computers using Ethernet (as I suppose you want your local network to be on Ethernet, otherwise choose airport or anything relevant).

The bearded way to do it is to indeed use ipfw and route. A simple google search gives a good tutorial on both methods at the following URL: (the commandline way is after the GUI way)


share|improve this answer
I'm not familiar with the term "bearded way". What does that mean? I'm looking for a programmatic non-GUI approach. – DevNull Dec 14 '12 at 15:05
"bearded" is a joke to say "for real men that has a beard" :-) for the non-GUI approach, you can use the link I gave you. In that link, they even show you how you can set things up using the UI, and then print the rules to be able to replay them later on. – zmo Dec 14 '12 at 15:51

why you just not use simple internet sharing on you macosx ? System Preferences > Sharing > Internet Sharing

for ipfw nat rules are (lats say that your internet is en0 and local interface en1)

  1. sysctl -w net.inet.ip.fw.one_pass=1 (you need to be root)
  2. sysctl -w net.inet.ip.forwarding=1
  3. /sbin/ipfw add 1040 allow ip from any to any via en1 (allow everything that will pass via local interface)
  4. /sbin/ipfw add divert natd all from any to any via en0
  5. /sbin/ipfw add pass all from any to any natd -interface en0 (where en0 your outgoing interface)
  6. /usr/sbin/natd -interface en0 (nat itself)
share|improve this answer
This is close to what I'm trying to do, but steps 3 and 4 generated "bad command/file not found" errors. Are these sysctl or ipfw commands? – DevNull Dec 13 '12 at 19:51
those are ipfw commands – NauT Dec 13 '12 at 19:59
The first three commands work, but the fourth has issues: local$> ipfw nat 1 config log if en1 reset same_ports deny_in ipfw: bad command `nat' – DevNull Dec 13 '12 at 21:55
ok, looks like I made a mistake, by trying to use same rule-set like on BSD on OSX, here we go with valid command /sbin/ipfw add divert natd all from any to any via en0 /sbin/ipfw add pass all from any to any natd -interface en0 (where en0 your outgoing interface) – NauT Dec 13 '12 at 23:00
All but step 5 worked: > sudo /sbin/ipfw add pass all from any to any natd -interface en0 ipfw: unrecognised option [-1] -interface\n – DevNull Dec 14 '12 at 15:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .