Internet sharing with 802.1X auth. on

Perhaps this will help...
http://www.macosxhints.com/article.php?story=20060616150640529

I am having the exact same problem. Once I join a wireless network with 802.1x, Internet Connection Sharing will not work again until I disable the Airport and reboot.

This seems like a bug.

Anyhow, the problem is that I can't find an error anywhere. I've searched all the logs in /Library, ~/Library, and /var/log to no avail.

Does anyone know where I could look to begin troubleshooting this issue?



Macbook Pro 15" Mac OS X (10.4.7)

I would say that this is good design. You've taken a machine and authenticated it to a network...Then you're trying to take other unauthenticated machines and route it through the authenticated one? That would be a security issue.

It would still be good design, IMO 🙂

There isn't much difference from having a physical machine sharing your connection and a virtual machine sharing your connection. It has the same security issues.

I'll agree that it's a good design, but it's very frustrating when you're trying to get Parallels working on an 802.x wireless network. Why should I register the MAC of a virtual machine and spoof a MAC address? Seems there should be an exception made in the case of virtual clients

Various Mac OS X (10.4.7)

Well, I think everyone's missing the biggest point which is that the OS gives no indication of why it isn't working, it just silently fails. This sounds like a bug, not an intentional design consideration.

Furthermore, once it fails, I can't determine any way to restore ICS functionality without rebooting. (am I wrong here, or do others have the same issue?)

Finally, whether or not it is a good security practice to reshare an authenticated connection is completely moot since that is completely outside the scope of what 802.1x guarantees. It just says that the computer on the other end of the link can't pass any messages (other than AUTH messages) onto the network until they pass some authentication steps. It doesn't say what can occur beyond that.

Macbook Pro 15" Mac OS X (10.4.7)

So there is definately a bug because I can setup the nat by hand (with the following commands) and it seems to work just fine:

sudo /usr/sbin/sysctl -w net.inet.ip.forwarding=1
sudo /usr/sbin/natd -interface en1 -dynamic
sudo /sbin/ipfw add divert natd all from any to any via en1

Note: I don't think the ipfw divert is 100% correct, but it works as a proof of concept.

I've only been using this for a couple minutes, so it has by no means been thoroughly tested.

If it works for people here, I would be more than happy to write a prettier wrapper...

Macbook Pro 15" Mac OS X (10.4.7)

I went ahead and made a shell script because I got sick of typing those commands: http://www.aloof.org/mynat.txt

Macbook Pro 15" Mac OS X (10.4.7)

To be clear, I have setup both my Mac and the hosted OS in parallels to use static IP addresses on the Host-Only network. Therefore, I didn't setup a DHCP server or anything like that.

So, make sure that you have valid IP addresses for both OSX (on en2) and the hosted OS. Also, make sure the hosted OS is using the Mac's address as it's default gateway.

If you're still stuck, run natd with the -v argument which will keep it from becoming a daemon and show you what it is doing.

Here is how my mac is configured:

<pre>
ahehnb-cva:~ $ ifconfig en2
en2: flags=8963<UP,BROADCAST,SMART,RUNNING,PROMISC,SIMPLEX,MULTICAST> mtu 1500
inet6 fe80::201:23ff:fe45:6789%en2 prefixlen 64 scopeid 0x8
inet 10.37.129.5 netmask 0xffffff00 broadcast 10.37.129.255
ether 00:01:23:45:67:89
media: autoselect status: active
supported media: autoselect
</pre>

And here is how XP (in parallels) is configured:

<pre>
Windows IP Configuration


Ethernet adapter Local Area Connection:

Connection-specific DNS Suffix . :
IP Address. . . . . . . . . . . . : 10.37.129.3
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 10.37.129.5

C:\Documents and Settings\cva>