Using Server 5.0.15 to share internet WITHOUT internet sharing I am running a mid 2010 MacMini as a server. OS X 10.11.3 and Server 5.0.15. I am connecting to the internet on the built in Ethernet (Ethernet) and have a USB to GigaBit Ethernet adapter (Ethernet 2) going to a wireless AP (WAP).

I have DHCP and DNS services configured and enabled. If I turn ICS on in the sharing control panel it ignores the DHCP service from the server, yet allows me to connect to the internet from my clients. This also breaks the local DNS unless I start changing IPs and such. If I turn it off, I get control over the DHCP server, but nothing connects to the internet.

How can I use BOTH? Or at least configure the settings on the server correctly to "bridge" the Ethernet and Ethernet 2 adapters to allow internet access to my clients?

I am looking for a NAT function someplace that is NOT the Internet Connection Sharing on the Sharing Control Panel.

Built in Ethernet config:


IP: DHCP from Cable Modem
Subnet Mask: 255.255.255.0 - DHCP from Cable Modem
DNS: 127.0.0.1 to use the Servers own DNS Service
Search Domain: My FQDN of the server.
Router: DHCP from Cable Modem


USB to GigaBit Adapter Config:


IP: 192.168.3.1
Subnet Mask: 255.255.255.0
DNS: 127.0.0.1
Search Domain: My FQDN of the server.
Router: Address acquired from DHCP for the Built in Ethernet


DHCP:


Name: Home
IP Pool: 192.168.3.2 - 192.168.3.253
Lease: 1 Hour
Interface: USB to GigaBit Adapter
Router: 192.168.3.1 - Must be on the same network as the IP Pool and Interface.
Note: 16+ IP Reservations for devices in the house.


WAP:


IP: 192.168.3.254


DNS:


Permissions: All Networks
Client Lookup: All Clients
Forwarding Servers: 8.8.8.8, 8.8.4.4


Not sure what other information to put in here, it is late and I am tired...

Ask me some questions and let me know if you have any insight into the new 5.0.15 server.app
The newest OS X Server versions don't provide any tools to enable NAT/Routing in OS X.

To get NAT working without using Internet Sharing you have to use a pf rule and create a plist to enable forwarding and load the pf rule:

Below I assume en0: the interface connected to the cable modem and en1: the interface connected to the LAN. DHCP and DNS are set up properly in the internal LAN.


Create a pf NAT rule:

Create a file named nat-rules in /private/etc/ with the following content

nat on en0 from en1 to any -&gt; (en0)

Create a shell script named nat-pf.sh enabling forwarding and loading the pf rule. I saved it in /usr/local/:

#!/bin/sh

sysctl -w net.inet.ip.forwarding=1
sysctl -w net.inet.ip.fw.enable=1

#disables pfctl
pfctl -d

sleep 1

#flushes all pfctl rules
pfctl -F all

sleep 1

#starts pfctl and loads the rules from the nat-rules file
pfctl -f /private/etc/nat-rules -e

Create a plist named org.user.natpf.plist with the following content and save it in /Library/LaunchDaemons/ to execute the above shell script at start-up:

&lt;?xml version="1.0" encoding="UTF-8"?&gt;
&lt;!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"&gt;
&lt;plist version="1.0"&gt;
&lt;dict&gt;
    &lt;key&gt;Disabled&lt;/key&gt;
    &lt;false/&gt;
    &lt;key&gt;KeepAlive&lt;/key&gt;
    &lt;dict&gt;
        &lt;key&gt;SuccessfulExit&lt;/key&gt;
        &lt;false/&gt;
    &lt;/dict&gt;
    &lt;key&gt;Label&lt;/key&gt;
    &lt;string&gt;org.user.natpf&lt;/string&gt;
    &lt;key&gt;ProgramArguments&lt;/key&gt;
    &lt;array&gt;
        &lt;string&gt;/usr/local/nat-pf.sh&lt;/string&gt;
    &lt;/array&gt;
    &lt;key&gt;RunAtLoad&lt;/key&gt;
    &lt;true/&gt;
    &lt;key&gt;StandardErrorPath&lt;/key&gt;
    &lt;string&gt;/tmp/org.user.natpf.stderr&lt;/string&gt;
    &lt;key&gt;StandardOutPath&lt;/key&gt;
    &lt;string&gt;/tmp/org.user.natpf.stdout&lt;/string&gt;
&lt;/dict&gt;
&lt;/plist&gt;


All three files need a trailing empty line so don't simply copy the above code/lines.
Modify ownership and file modes:

sudo chown root:wheel /private/etc/nat-rules
sudo chown root:wheel /usr/local/nat-pf.sh
sudo chmod 755 /usr/local/nat-pf.sh
sudo chown root:wheel /Library/LaunchDaemons/org.user.natpf.plist

Load the launch daemon:

sudo launchctl load /Library/LaunchDaemons/org.user.natpf.plist

After testing everything you can delete the following part in the plist:

    &lt;key&gt;StandardErrorPath&lt;/key&gt;
    &lt;string&gt;/tmp/org.user.natpf.stderr&lt;/string&gt;
    &lt;key&gt;StandardOutPath&lt;/key&gt;
    &lt;string&gt;/tmp/org.user.natpf.stdout&lt;/string&gt;


org.user.natpf.stderr provides error messages to debug your plist.
On my local router I had to add a static route:

192.168.3.0/24 (the internal network) -> 192.168.0.2 (Mac mini IP-address of the external interface connected to the router)

This last step may not apply to your network environment!