1

how can I split traffic on OSX so that only some certain subnet are routed to ethernet interface and the rest is routed to Wifi?

I've been using this script for more that 1 and a half year but today it stopped working. All it does is it deletes the default gateway and sets the desired one (i.e. en2 = wifi) as default and it adds record for each subnet telling it to route it through desired "tunnel" interface (i.e. en0 = ethernet).

#! /usr/bin/env zsh

if (( EUID != 0 )); then
    echo "Please, run this command with sudo" >&2
    exit 1
fi

if [ "$#" -ne "2" ]; then
    echo "Usage: $0 tunnel_interface default_interface" >&2
    exit 1
fi    

TUNNEL_INTERFACE=$1
DEFAULT_INTERFACE=$2

GATEWAY=$(netstat -nrf inet | grep default | grep $DEFAULT_INTERFACE | awk '{print $2}')

if [ "$GATEWAY" = "" ]; then
    read "GATEWAY?Enter gateway IP address: "
fi

echo "Resetting routes with gateway => $GATEWAY"
echo

route -n delete default -ifscope $DEFAULT_INTERFACE 1>/dev/null
route -n delete -net default -interface $TUNNEL_INTERFACE 1>/dev/null
route -n add -net default $GATEWAY 1>/dev/null

for subnet in 10.89 10.153 10.162 10.168 172.24.0.0/13
do
    route -n add -net $subnet -interface $TUNNEL_INTERFACE 1>/dev/null 2>&1
done

echo "google.cz -> $(route get google.cz | grep interface | sed 's/^ *//')"
echo "r5d00 -> $(route get r5d00 | grep interface | sed 's/^ *//')"

I run this script like this

$ sudo tunnel-ips.sh no en0 en2
Password:
Resetting routes with gateway => 172.20.10.1

google.cz -> interface: en2
r5d00 -> interface: en0

I'm connected via Wifi to my iPhone Personal hotspot, it assigns me IP 172.20.10.4 and mask 255.255.255.240. The r5d00 server has IP set to 172.24.146.155, which matches with 172.24.0.0/13.

My routing table looks like this: $ netstat -rn Routing tables

Internet:
Destination        Gateway            Flags        Refs      Use   Netif Expire
default            172.20.10.1        UGSc            3        0     en2
10.89/16           link#4             UCSc            1        0     en0
10.153/16          link#4             UCSc            1        0     en0
10.162/21          link#4             UCS             6        0     en0
10.162/16          link#4             UCSc            1        0     en0
10.162.0.1/32      link#4             UCS             2        0     en0
10.162.0.1         0:0:c:9f:f0:1      UHLWIi          2        4     en0   1167
10.162.0.241       0:20:4a:e6:5c:2c   UHLWIi          1        0     en0   1149
10.162.0.242       0:20:4a:54:87:a0   UHLWIi          1        0     en0   1079
10.162.0.243       0:20:4a:d7:d8:3e   UHLWIi          1        0     en0   1132
10.162.1.22        0:1e:b:ed:21:b8    UHLWIi          1       18     en0   1136
10.162.7.241/32    link#4             UCS             1        0     en0
10.167/16          link#4             UCSc            1        0     en0
10.168/16          link#4             UCSc            1        0     en0
10.255/16          link#4             UCSc            1        0     en0
127                127.0.0.1          UCS             1        0     lo0
127.0.0.1          127.0.0.1          UH              5     2329     lo0
169.254            link#4             UCS             1        0     en0
169.254            link#5             UCSI            1        0     en2
172.20.10/28       link#5             UCS             1        0     en2
172.20.10.1/32     link#5             UCS             2        0     en2
172.20.10.1        36:e2:fd:74:7b:64  UHLWIir         5       11     en2   1067
172.20.10.4/32     link#5             UCS             1        0     en2
172.24/13          link#4             UCSc            7        0     en0
255.255.255.255/32 link#4             UCS             1        0     en0
255.255.255.255/32 link#5             UCSI            1        0     en2

Internet6:
Destination                             Gateway                         Flags         Netif Expire
::1                                     ::1                             UHL             lo0
fe80::%lo0/64                           fe80::1%lo0                     UcI             lo0
fe80::1%lo0                             link#1                          UHLI            lo0
fe80::%awdl0/64                         link#7                          UCI           awdl0
fe80::a4a8:81ff:fe02:a44d%awdl0         a6:a8:81:2:a4:4d                UHLI            lo0
fe80::%utun0/64                         fe80::db39:e7b8:6234:7841%utun0 UcI           utun0
fe80::db39:e7b8:6234:7841%utun0         link#9                          UHLI            lo0
ff01::%lo0/32                           ::1                             UmCI            lo0
ff01::%awdl0/32                         link#7                          UmCI          awdl0
ff01::%utun0/32                         fe80::db39:e7b8:6234:7841%utun0 UmCI          utun0
ff02::%lo0/32                           ::1                             UmCI            lo0
ff02::%awdl0/32                         link#7                          UmCI          awdl0
ff02::%utun0/32                         fe80::db39:e7b8:6234:7841%utun0 UmCI          utun0

When I ping r5d00, it says "No route to host"

$ ping r5d00     
PING r5d00.cezdata.corp (172.24.146.155): 56 data bytes
Request timeout for icmp_seq 0
Request timeout for icmp_seq 1
Request timeout for icmp_seq 2
Request timeout for icmp_seq 3
ping: sendto: No route to host
Request timeout for icmp_seq 4
ping: sendto: Host is down
Request timeout for icmp_seq 5
ping: sendto: Host is down
Request timeout for icmp_seq 6
ping: sendto: Host is down
Request timeout for icmp_seq 7
ping: sendto: Host is down
Request timeout for icmp_seq 8
ping: sendto: Host is down
Request timeout for icmp_seq 9
ping: sendto: Host is down
Request timeout for icmp_seq 10

I downloaded Wireshark and I recorded the traffic but the ICMP packets are nowhere to find (when I disable Wifi and reset routing table, it does get recorded and ping is successfull). It seems like the IP isn't matched with the routing table record, but when I check it via route get, it says it's routed through en0 (which is correct).

$ route get r5d00
   route to: r5d00
destination: r5d00
  interface: en0
      flags: <UP,HOST,REJECT,DONE,LLINFO,WASCLONED,IFSCOPE,IFREF>
 recvpipe  sendpipe  ssthresh  rtt,msec    rttvar  hopcount      mtu     expire
       0         0         0         0         0         0      1500      -138 

Like I said, it was working yesterday, but today it's not. I didn't download any update or anything. AFAIK it's problem on my Mac, not on the internal network, since nobody else has a problem.

0

The single ping: sendto: No route to host message at first suggests that something changed during testing. According to your routing table, 172.24.0.0/13, is directly connected off of Link#4, which means reaching that host ought not to need routing, nor even generate that message.

Subsequently, except for the first one, the other messages reflect the routing table. The ping: sendto: Host is down suggests that host is on a network that is directly connected, and that host or its proxy has not replied to an ARP request.

Try having route monitor running in another window when you repeat the test, as well as watching the Console for any interface transitions, or other network changes.

  • Hello, sorry I didn't answer, I must have missed the notification. I was able to alter the script for it to work. Thank you for your help. – Hologos May 5 '17 at 8:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.