I would appreciate receiving a short-list of a few good web sites that point me to how to set up the following scenario. (You may assume that I am by-now quite familiar with OpenVPN in general.)

I want to set up one always-on (Macintosh, OS/X El Capitan,using "TunnelBlick") computer, within an in-house network, to act as a secure router to a remote network from any machine within the in-house network.

Here are my thoughts ... and questions ... so far:

  1. First, the Mac must be set up (of course ...) so that it can, as a client, reach and connect to the remote system. (Assume that this has already been done.)

  2. The Mac's on-board firewall will need to be turned off or modified to allow (in this case) HTTP and HTTPS traffic to be directed to it.

  3. The physical router for the in-house network must have static routing rules which direct traffic to/from the remote-side IP addresses to first be directed to this Macintosh, as a "gateway."

  4. (Now, my thinking gets fuzzy ...) The OpenVPN client running on this machine must somehow correctly handle those "multiple connections" as they are coming to it from various in-house IP addresses. Is this, in fact, a special case?

Here, for your edification, is an sanitized excerpt of the present client-side config.ovpn file: (You may assume that it works, because it does.)

dev tun0
proto udp
remote 111.222.333.444 1194
resolv-retry infinite
ca ca.crt
cert thisMacintosh.crt
key  thisMacintosh.key
ns-cert-type server
tls-auth ta.key 1
cipher AES-256-CBC
verb 3

My question is specifically about employing this machine as a router which will act as a gateway for "any other machine on its local network."

Further details:

  • We are communicating with a server on the Internet at "some address." Let's say, for the sake of example, that it's (Apologies to whoever's address that really is ...)
  • One machine, "on the in-house network" say at, is to be acting as a router "the rest of the in-house network": 192.168.1.x. It will never need to be concerned with any other internal subnet.
  • The secure network on the remote side has an IP-address range of (say) 10.2.3.x.
  • The Mac in question currently has the necessary OpenVPN software installed, using a .conf similar to the above, and it is now successfully communicating with the Internet host.
  • ... so, all I need to do are "the last few steps." And therefore, to know what "those last few steps" are!

FYI: The "TunnelBlick" software of which I speak is simply a "really nice Macintosh-friendly wrapper" for OpenVPN. (Similar flavors also exist for Windows and so-on.) It takes care of, for example, making sure that OpenVPN will start every time this machine is rebooted, and other otherwise-meddlesome details. But it simply hosts the otherwise-normal OpenVPN process which handles the actual communication. Therefore, I believe that my questionings are "essentially generic to any OS," and that "my answer must be terribly easy."

You don't need to answer "in terms of iptables," nor in terms of the actual equivalent commands that a Macintosh uses. (Unless you -want- to "speak Mac to me.") If you'll just help me grok what needs to be done, I can figure out what steps to take to persuade a Macintosh and the local hardware-router to do it.

Pages I have recently studied, and am continuing to study (especially the second one)

(Based on the second page, I have a now-murky gut feeling that what I need to do "has something to do with iroute ... but that I could also be totally mistaken about that." (Does this client-machine "have the rest of the in-house network to which it belongs 'behind it?'" Or, "is it not-relevant (i.e. wrong), since all other machines that will be talking through this machine "are right here?") Ooh, so confused. That's why I'm now asking you kind folks!)

(When you post an answer, please also post a comment because I can see the presence of comments but I have not yet discovered how to get a list of "my recent questions ...")

  • "router for the in-house network must have static routing rules which direct traffic to/from the remote-side IP addresses to first be directed to this Macintosh". No--all devices in the house should have the forwarding Mac as their default gateway; you don't want them to keep the old router as their gateway and then bounce back to the Mac. Your DHCP server (assuming thats how you manage local addresses) should be pushing the Mac's IP as the default router on your network. – user4556274 Aug 4 '16 at 19:54
  • No, this Mac should not be "the default router for this network." It should be the gateway only for traffic destined to/from 10.2.3.x and none other. I definitely do not 100% of the network traffic to become directed to and through this machine! – Mike Robinson Aug 4 '16 at 19:57
  • Ah--in that case, you should push a static route 10.2.3.x/24 via ${MAC_IP_ADDR} to all the end nodes. You still probably don't want traffic to bounce through your router if its not necessary. Many SOHO grade router products will not perform "one-armed routing." – user4556274 Aug 4 '16 at 20:00
  • I think that I can accomplish this step by editing the configuration of the hardware router which services this subnet. They have a pretty sophisticated router, not just something that was bought at a convenience store. I know that there needs to (somehow, somewhere) be a routing-rule that directs 10.2.3.x through a gateway at My question is really very-specifically directed at the proper OpenVPN-client configuration, so that it does act as a router when traffic from other 192.168.1.x nodes is being sent to it as a gateway. – Mike Robinson Aug 4 '16 at 20:03
  • To clarify: "the traffic that this OpenVPN client is to handle is not coming just from the machine that's running the client, but from any other machine in the 192.168.1.x subnet. And I'm specifically focusing on how to tell OpenVPN that." I'm confident that, with a sledgehammer and a little persuading ;-) I can get the hardware router to deliver the packets to it. (And of course I'm thinking about the entire round-trip, to make sure that the returned packets get back home.) I want to confirm OpenVPN settings, and to confirm what the hardware router's rules must be. – Mike Robinson Aug 4 '16 at 20:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.