Up until OS X 10.9 Mavericks, I had been sharing OpenVPN connection in this way .

However, ever since I updated my Mac to the latest OS, this method becomes no longer valid. I did some google searching and it seems that the new network component breaks the function.

Is it possible to restore the sharing function as pre-Yosemite OS? or is there any way to work out a new sharing method with the new network utilities?


  • Not sure how to work around it using discovered, but Apple are dropping that from 10.10.4 & going back to mDNSresponder. Sign yourself up for the beta if you can't wait. – Tetsujin Jun 24 '15 at 4:57

In order to share your OpenVPN connection on OS X Mavericks, Yosemite or El Capitan enter the following commands to enable packet forwarding:

sudo sysctl -w net.inet.ip.forwarding=1
sudo sysctl -w net.inet.ip.fw.enable=1 

Next add the following lines to /etc/pf.conf immediately after rdr-anchor "com.apple/*":

nat on $ext_if from $lan to any -> ($ext_if)
nat on $vpn_if from $lan to any -> ($vpn_if)

Note that you should change the lan address to the lan you want to route over the OpenVPN connection. ext_if should be the interface that is connected to the lan. vpn_if should be the OpenVPN interface. I used VyprVPN which used tun0 rather than utun0 so you may need to change this depending on your particular configuration.

Next run the following to load the config:

sudo pfctl -d
sudo pfctl -F all
sudo pfctl -f /etc/pf.conf -e

The instructions to do this were found here: http://www.douglas.wiki.br/doku.php?id=en:configuring_nat_on_mac_osx_yosemite

Loading with a daemon

If you want this to load automatically you can take a look at this repo https://github.com/essandess/osx-openvpn-server where you'll see an example of using a shell script with a .plist file to create a daemon that's loaded on boot. I just added /sbin/pfctl -f /etc/pf.conf -e to the end of enable-vpn-forward-nat.sh and did the following:

sudo mkdir '/Library/Application Support/vpn'
sudo install -m 755 osx-openvpn-server/enable-vpn-forward-nat.sh '/Library/Application Support/vpn'
sudo install -m 644 net.openvpn.enable-vpn-forward-nat.plist /Library/LaunchDaemons
sudo launchctl load -w /Library/LaunchDaemons/net.openvpn.enable-vpn-forward-nat.plist
| improve this answer | |
  • What is exactly the lan address? I'm trying to setup wifi hotspot with Tunnelblick on El Capitan. So I have the thunderbolt ethernet, wifi, bridge and tunnelblick interfaces. I'm quite confused what needs to be written to the file. – headsvk Jan 6 '16 at 16:32
  • 1
    @headsvk The lan variable should be set to the address range that you want to route through the tunnel. Assuming you want to route traffic to your wifi interface through your tunnelblick tunnel, you need to check the IP and and subnet mask for the wifi interface. An easy way you can do that is to go to System Preferences -> Network -> Wi-Fi -> Advanced -> TCP/IP. Assuming your IP is something like 192.168.1.x and the subnet mask is then you should set lan to "{}". To find the correct value for ext_if run ifconfig in Terminal and match the wifi IP. – nftw Jan 27 '16 at 10:50
  • This answer looks great, I can't get it working on OSX 10.11.4, I'm trying to share my VPN with a device connected with the Thunderbolt Ethernet I've replaced the lan correct & ext_if with en4, any idea? – Rob May 1 '16 at 17:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.