Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm not sure I have the right hardware for this, but....

I have a Mac Mini i7 Server with a built-in ethernet (en0) and a thunderbolt ethernet (en1) and the built in airport.

I would like to be able to configure a VPN (PPTP or OpenVPN using a client) connection to another location and then allow another device on the same 192.168.x.x network connect to the VPN via the Mac Mini Server on either en1 or over wireless.

However, I also want the Mac Mini Server to be able to send traffic over en0 bypassing the VPN.

Is this at all possible?

A scenario would be an Apple TV connecting over wifi or en1 to the Mac Mini Server and then being routed via the VPN. Meanwhile the Mac Mini is acting as a Plex Media Server and sending transcoded movies over en0, not via the VPN.

Any help greatly appreciated, thanks for looking.

share|improve this question
up vote 1 down vote accepted

Yes, it should be possible. I don't have a Mac, however I'm sure that it is conceptually similar to doing it under Linux. After setting up your VPN (OpenVPN is a better choice then PPTP, but either should work fine), you need to do 3 things. [ I note it does not really matter if you do it over the ethernet or WIFI interface ]

Let me define the machines for ease of reference: REMOTE = OpenVPN Server outside your network SERVER = Mac Mini CLIENT = "Other device on same 192.168.x.x network"

  1. Enable forwarding on SERVER.
  2. Either enable routing to CLIENT across he VPN on the REMOTE (ie a static route for CLIENT/SERVER Subnet) or get the server to masquerade/nat packets coming from CLIENT destined for remote.
  3. Set a static route for REMOTE on CLIENT to go via SERVER.

I have no way of trying these things, but practically, I believe the following will work:

  1. Enable packet forwarding by entering

    sudo sysctl -w net.inet.ip.forwarding=1
    in a Terminal.

  2. (This will depend on your setup). For OpenVPN you can probably
    affect this change simply by adding a line to the OpenVPN config on REMOTE


    Alternatively try something like

    /sbin/ipfw add divert natd all from any to any via XXX 

    On server to enable masquerading (where XXX is either the wireless or ethernet interface)

    Alternatively have a look at for a starting point for setting up a PPTP tunnel with Masquerading.

  3. Use the command

    route -n add REMOTE.IP gw SERVER.IP

    on the CLIENT.
    (Have a look at on how to make this permanant)

share|improve this answer
Thanks very much for the detailed response, I'll try to follow it and then report back if that's okay? – sgtbeano Mar 7 '13 at 20:39
Thanks again, had to look a few things up but this worked. – sgtbeano Mar 13 '13 at 19:43

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.