OS X El Capitan port forwarding to Parallels VM using pfctl I have Parallels Desktop 11, which does not have support port forwarding to VMs (just the Pro version supports it). So I am trying to use pfctl to forward ports to my Parallels VM. 

I have followed this answer to setup the port forwarding.
Forwarding is enabled with sysctl net.inet.ip.forwarding=1

I have specified this rule.

rdr pass inet proto tcp from any to any port 51414 -&gt; 10.211.55.9 port 51414


10.211.55.9 is the static IP of the Parallels VM.

However the port forwarding does not work for VM. It can successfully forward port x to port y on 127.0.0.1 but can not forward port x from Mac to port x on Parallels VM.

What could be going wrong? Is it Parallels which is dropping packets etc?
There are two solutions for your problem with Parallels Desktop 11 (this doesn't apply to Parallels Desktop Pro/Enterprise 11, which both provide a convenient interface to configure port forwarding - nonetheless the solutions should work also in those enhanced versions):

Instead of attaching the VM's network interface to the "Shared Network" use a bridged interface (e.g. en0 or en1) and configure it with a IP/netmask in the respective network. Then you don't need NAT/port forwarding.



If you insist on a NAT'ed network do the following:

In the example below I use nc as server. To run a server enter nc -l -4 port and to connect to this server use nc server-IP port. You may also specify a source port: nc -p source-port server-IP port.

Here I use nc -l -4 11111 on the VM. To connect to this server I would run nc server-IP 11111 from a host in the same network. After starting the server and connecting the client you can simply enter some text, which is sent to the other console. To connect from a third host in a different network to the VM nc-server I want to use nc NAT-host-IP 22222. So I have to forward NAT-host-IP:22222 to VM-IP:11111. NAT-host in this case is the Mac hosting the Parallels VM.


attach the VM guest's network interface to the "Host-only Network". Usually Parallels' host-only network has the following host configuration (check this by entering ifconfig on the host machine):

vnic1: ...
...
inet 10.37.129.2 netmask 255.255.255.0 broadcast 10.37.129.255


So configure the VM guest as following:


IP: 10.37.129.x (with x ≠ 0,1,2,255) - below I assume it's 10.37.129.10
Netmask: 255.255.255.0
Gateway: 10.37.129.2 
DNS: a real DNS server like 8.8.8.8

On the NAT-host machine enable forwarding in /etc/sysctl.conf:

net.inet.ip.forwarding=1
net.inet6.ip6.forwarding=1


and reboot the host.
On the NAT-host machine (with an example IP of en0: 192.168.0.2) create an anchor file org.user.forwarding in /private/etc/pf.anchors

sudo touch /private/etc/pf.anchors/org.user.forwarding


with the following content and a trailing empty line:

rdr pass on en0 inet proto tcp from any to any port 22222 -&gt; 10.37.129.10 port 11111

On the NAT-host machine modify the file /private/etc/pf.conf but keep a trailing empty line

original file:

...
scrub-anchor "com.apple/*"
nat-anchor "com.apple/*"
rdr-anchor "com.apple/*"
dummynet-anchor "com.apple/*"
anchor "com.apple/*"
load anchor "com.apple" from "/etc/pf.anchors/com.apple"


to

...
scrub-anchor "com.apple/*"
nat-anchor "com.apple/*"
rdr-anchor "com.apple/*"
rdr-anchor "org.user.forwarding"
nat on en0 proto {tcp, udp, icmp} from 10.37.129.0/24 to any -&gt; en0
pass from {lo0, 10.37.129.0/24} to any keep state
dummynet-anchor "com.apple/*"
anchor "com.apple/*"
load anchor "com.apple" from "/etc/pf.anchors/com.apple"
load anchor "org.user.forwarding" from "/etc/pf.anchors/org.user.forwarding"

Parse and test your anchor and your pf.conf file to make sure that there are no errors:

sudo pfctl -vnf /etc/pf.anchors/org.user.forwarding
sudo pfctl -vnf /etc/pf.conf

Enable pf with:

sudo pfctl -e -f /etc/pf.conf

To test this start the nc server on the VM with  nc -l -4 11111. Now on a third host in your physical network enter nc 192.168.0.2 22222.




After a reboot you have to start pf again. If you want to enable pf permanently check my other pf related answers.

After a system update or upgrade some of the original files above may have been replaced and you have to reapply all changes.