Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to connect a tap0 and en0 interface with the natd. The (simplified) background is:

I have one application running on a smartphone and a simple UDP Server running on my laptop. The UDP Server is listening on the tap-Interface and I want to speak to the server with my smartphone application. (As I said this is a bit simplified, the UDP Server has to listen on the tap Interface and cannot listen on en0.)

I tried the following:

  • Open tap0:

    $ su
    $ exec 5<>/dev/tap0   (running in one terminal-tab)
  • Set the tap0-address, netmask, etc.

    $ sudo ifconfig tap0 inet netmask broadcast
  • Enable Port forwarding

    $ sudo sysctl -w net.inet.ip.forwarding=1
  • Start natd:

    $ sudo /usr/sbin/natd -alias_address MY_EN0_IP \
        -interface tap0 -use_sockets -same_ports -dynamic -clamp_mss \
        -enable_natportmap -natportmap_interface en0 \
        -redirect_port udp 50000 -l
  • Start a sample UDPServer, listening on

Netstat shows the opened port:

$ netstat -n | grep 50000
udp4       0      0       *.*

When I send a packet from my smartphone to the laptop with target:MY_EN0_IP:50000 I can see the packet with Wireshark arriving at en0, but the laptop is answering with an "ICMP port unreachable" message.

I have no clue what is going wrong, shouldn't the natd open port 50000 on en0, accept the packets and NAT them to the tap0 interface? What am I missing?

share|improve this question
up vote 2 down vote accepted

It seems like I have found the solution myself by using pf and pfctl. This seems to work:

  • activate port forwarding:

    $ sudo sysctl net.ipv4.ip_forward=1
  • Add the following rule to the pf.conf (located in /private/etc/)

    "rdr on en0 proto udp from any to any port 50000 -> port 50000" (without quotation marks and right below the "rdr-anchor"

  • read pf rules:

    $ sudo pfctl -f /private/etc/pf.conf
  • activate pf:

    $ sudo pfctl -e
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.