Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to connect a tap0 and en0 interface with the natd. The (simplified) background is:

I have one application running on a smartphone and a simple UDP Server running on my laptop. The UDP Server is listening on the tap-Interface and I want to speak to the server with my smartphone application. (As I said this is a bit simplified, the UDP Server has to listen on the tap Interface and cannot listen on en0.)

I tried the following:

  • Open tap0:

    $ su
    $ exec 5<>/dev/tap0   (running in one terminal-tab)
  • Set the tap0-address, netmask, etc.

    $ sudo ifconfig tap0 inet netmask broadcast
  • Enable Port forwarding

    $ sudo sysctl -w net.inet.ip.forwarding=1
  • Start natd:

    $ sudo /usr/sbin/natd -alias_address MY_EN0_IP \
        -interface tap0 -use_sockets -same_ports -dynamic -clamp_mss \
        -enable_natportmap -natportmap_interface en0 \
        -redirect_port udp 50000 -l
  • Start a sample UDPServer, listening on

Netstat shows the opened port:

$ netstat -n | grep 50000
udp4       0      0       *.*

When I send a packet from my smartphone to the laptop with target:MY_EN0_IP:50000 I can see the packet with Wireshark arriving at en0, but the laptop is answering with an "ICMP port unreachable" message.

I have no clue what is going wrong, shouldn't the natd open port 50000 on en0, accept the packets and NAT them to the tap0 interface? What am I missing?

share|improve this question
up vote 2 down vote accepted

It seems like I have found the solution myself by using pf and pfctl. This seems to work:

  • activate port forwarding:

    $ sudo sysctl net.ipv4.ip_forward=1
  • Add the following rule to the pf.conf (located in /private/etc/)

    "rdr on en0 proto udp from any to any port 50000 -> port 50000" (without quotation marks and right below the "rdr-anchor"

  • read pf rules:

    $ sudo pfctl -f /private/etc/pf.conf
  • activate pf:

    $ sudo pfctl -e
share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .