Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to forward requests from to This is how I'd do it in linux using iptables:

iptables -t nat -A OUTPUT -p tcp --dport 80 -d -j DNAT --to-destination

How do I do the same thing in MacOS X? I tried out a combination of ipfw commands without much success:

ipfw add fwd,8000 tcp from any to 80

(Success for me is pointing a browser at and getting a response back from a development server that I have running on localhost:8000)

share|improve this question
Are we talking OSX Client or Server? – Scott Pack Jan 13 '10 at 21:15
It's snow leopard. – nafe Jan 13 '10 at 21:57
Is there some reason you can't just configure your web server to also listen on – Zoredache Jan 13 '10 at 23:28
@Zoredache Listening on port 80 needs sudo and some webservers don't drop privileges fast enough to safely run them with sudo. – Navin Dec 21 '15 at 10:33
up vote 22 down vote accepted

So I found out a way to do this. I'm not sure if it's the preferred way but it works! At your favourite shell:

sudo ifconfig lo0 alias
sudo ipfw add fwd,9090 tcp from me to dst-port 80

(The alias to lo0 seems to be the missing part)

If you'd like a (fake) domain to point to this new alias then make sure /etc/hosts contains the line:
share|improve this answer
This is great! What I needed! Thanks a lot! – Yoldar-Zi Feb 4 '13 at 15:41

I was able to get this working using the ifconfig and pfctl commands on Mac 10.10.2. With the following approach I'm successfully mapping to locally on my machine.

In your command line enter the following two commands to forward connections to to

sudo ifconfig lo0 alias
echo "rdr pass on lo0 inet proto tcp from any to port 80 -> port 3000" | sudo pfctl -ef -

Then edit your /etc/hosts or /private/etc/hosts file and add the following line to map your domain to

After you save your hosts file flush your local DNS:

sudo discoveryutil udnsflushcaches

Now open in a browser and you'll be seeing the server hosted on your localhost port (i.e. Basically this process maps an <ip>:<port> to a new <ip> so that you can then map a host that IP.

share|improve this answer
Just a tad hacky, but gets the job done. Good show. – Joey Carson Apr 24 '15 at 13:57
Well that works. – user974407 Aug 23 '15 at 18:49
Thank you. How would you undo the alias and the forwarding? – Carlos Nuñez Sep 7 '15 at 19:22
Hi sudo discoveryutil udnsflushcaches gives me command not found but it still matches the entry correctly. But how can I map a second port? I tried to do steps 1+2 with id: and another port, but it always takes only the last connection. So if I do last & port 3000 it forwards 3000, if I do last and port 4000 it forwards 4000. In my /private/etc/hosts I wrote both entries with the (according) different id. – Andi Giga Feb 3 at 10:18

This worked well for me:

share|improve this answer

From 10.5 on, OS X comes with a new, application-oriented firewall instead of ipfw. But ipfw is still installed. If you have trouble with its syntax, check out graphical frontends like WaterRoof or Flying Buttress.


share|improve this answer

order of rules is important, make sure there is no "deny all" before your allow rules, or something like that.

share|improve this answer
Thanks for the advice but I don't think I have that particular problem (ipfw list only shows my rule and 65535 allow ip from any to any). – nafe Jan 13 '10 at 22:13

Your command seems to be missing a rule number; try:

ipfw add 100 fwd,8000 tcp from any to 80

(if you aren't running as root, you'll have to prefix it with sudo). Another thing to check is that the firewall is enabled:

sysctl net.inet.ip.fw.enable

If it comes back with the value 0 (off), turn it on with:

sysctl -w sysctl net.inet.ip.fw.enable=1

... and then arrange for it to get reenabled when the computer reboots. The "proper" way to do this is probably to create a launchd item (Lingon makes this fairly easy). Or just use one of the GUI tools PEra mentioned, and let it take care of the details.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.