# trying to use PF on iPad,share VPN connection



## im0theros (Nov 16, 2011)

Hello everyone, this is my problem. I'm trying to share my VPN connection in my iPad to many other devices. What I'm trying:


first IP Forwarding (to make my iPad act like gateway)
then redirect ALL traffic to the VPN interface (ppp0)
set ppp0 as a NAT

I did this with a Mac with this little script:


```
#!/bin/sh

natd -same_ports -use_sockets -unregistered_only -dynamic -interface ppp0 -clamp_mss
ipfw add divert natd ip from any to any via ppp0
ipfw add pass all from any to any
sysctl -w net.inet.ip.forwarding=1
```

Now I was trying to do the same but using my iPad instead of my Mac. What is the problem? In iOS ipfw or ipf don't work because there isn't kernel support. I can't use iptables either. But pf and pfctl actually work. IP forwarding works the same way.

`# sysctl -w net.inet.ip.forwarding=1`


```
iPad ip 192.168.1.64
gateway. 192.168.1.254
DNS. 8.8.8.8
```


```
Mac 192.168.1.69
gateway. 192.168.1.64
dns. 8.8.8.8
```

nternet sharing from iPad to Mac at this point works. My VPN works with this interface: ppp0. To set up the NAT I use 
`# natd -same_ports -use_sockets -unregistered_only -dynamic -interface ppp0 -clamp_mss`

I think this isn't the problem because my Mac can read my modem's IP and MAC adress (192.168.1.254 ) so it's passing through ppp0 and reaching my modem properly. As I'm using pf I start it and load my configuration file with `# pfctl -e -f /pf.conf`

Here's my pf.conf file:


```
ext_if = "ppp0"
pass out on $ext_if from any to any
pass in on $ext_if from any to any
```

I think it loads fine because if you use `# pfctl -s rules` this shows me the rules I just added:


```
pass out on ppp0 from any to any
pass in on ppp0 from any to any
```

But I can't make it work :/. All commands in this post are from my iPad command line (not my Mac). 
`# pfctl -s all`

After I open a website in my iPad:


```
172.25.0.22 (iPad IP on the interface, see [FILE]ifconfig[/FILE] photo, for example) â€”> (IP from site im visiting) ESTABLISHEDâ€”->ESTABLISHED
```

After I open a website on my Mac:


```
192.168.1.69 â€”â€”> 8.8.8.8 (I established this as DNS, but I don't know why it's appearing here). SIMPLEâ€”â€”â€”>NO_TRAFFIC (sometimes other error message)
```

Some photos
*netstat -rn*: http://db.tt/rICiIphJ
*ifconfig*: http://db.tt/CPYvgBIe


----------



## phoenix (Nov 16, 2011)

If you are using PF, then you don't need to use natd.  PF includes NAT support.  And redirection support, and anything else you can think of.  Just write PF rules to do what you need.

You'll want to read the PF docs, FAQ, etc to see how to do this (I'm an IPFW user, so can't help with PF syntax).


----------



## _martin (Nov 17, 2011)

Interesting .. I do have an ipad2, but I didn't jailbreak it yet. I'm kinda surprised PF is included in ipad.. but .. @phoenix is right, if there is PF, you don't need anything else. 

If I got you correctly you want to share your VPN connection to iMac via ipad. Mac and ipad share the same network - 192.168.1.0/24, (en0 interface on ipad). 

If so, I guess very simple pf.conf can look like:


```
ext_if="ppp0"

nat pass on $ext_if from 192.168.1.0/24 to any -> 172.25.0.24

pass out all 
pass in all
```

And let the forwarding on (as you have).


----------



## haohaolee (Nov 17, 2011)

BTW, can OP tell us which version of iOS includes PF, and with or without jailbreak?
Thanks


----------



## SirDice (Nov 17, 2011)

haohaolee said:
			
		

> BTW, can OP tell us which version of iOS includes PF, and with or without jailbreak?


Not sure but most likely iOS 5. I know for sure OS-X Lion also has PF included.


----------



## im0theros (Nov 17, 2011)

Hello, thank for your replies, tonight I was trying to fix it and finally solve it. I'm using iOS 4.3.3 but iOS has PF support since 2008.

First I use natd because iOS is weird, every time I tried to load my pf.conf file iOS froze, then I tried to fix the NAT problem with natd and use PF only to pass the traffic (but I was thinking "well I could use natd but how do I load the file without freezing", but just after I used natd the file loaded fine ).

Pretty weird, then load my conf file to redirect all traffic but I noticed anything was NATed, so decided to add nat-to in "pass" line (found that on PF:FAQ) but syntax error every time :/

So I tried the old syntax.


```
nat on ppp0 from any to any -> (ppp0)

pass out on ppp0 from any to any
```

and this worked for me (didn't add it to the pass line )

Now I just need to connect my VPN run my script and enjoy playing movies on my PS3 or Xbox (I'm from Mexico and NETFLIX selection isn't good right now, and HULU doesn't work ) without my mac turned on for no reason, all via Wifi, and enhance the wifi range (before 67% now 100% ), and keep NAT 2 and same speed on PS3.

Worth it 

In a few minutes I'll share with you an entry to my post with the script, pretty basic for you guys but there are a lot of people looking to manage and redirect traffic between interfaces on iOS and there isn't much info about it (with luck I saw a script with ipfw and searched for firewalls or someyhing useful on iOS but theres no official documentation even about PF support on iOS)


----------



## im0theros (Nov 17, 2011)

Sorry, I made a mistake in my last reply; even if I use natd NOTHING WAS NATed, that's why I also used PF's NAT (using natd just allowed me to load my conf file, why? I don't know but there's no harm.

I tried this.


```
ext_if="ppp0"

nat pass on $ext_if from 192.168.1.0/24 to any -> 172.25.0.24
```

but 172.25.0.25 changes so it's better to use the interface  -> ($ext_if)


----------



## _martin (Nov 17, 2011)

im0theros said:
			
		

> but 172.25.0.25 changes so it's better to use the interface  -> ($ext_if)



Yeah, true (all my servers are multihomed though so I'm kind of used to specify IP address for NAT). 

Anyway, to your issue. Did you also have problem starting PF with my configuration I wrote? Because your example was only allowing traffic to ppp0 interface. IOS is maybe using default block when PF is started (just guessing) - it might good to specify:

```
set skip on lo0
```
.. or use the pass in/pass out for all interfaces as I wrote it above. Disabling localhost traffic can do a lot of trouble. 

pass line in my nat example is indeed redundant and not needed because all connections to all directions are allowed.


----------



## im0theros (Nov 18, 2011)

your configuration worked ,dont worry,i think i dont need my second line either, when u turn the VPN iOS make ppp0 to do this

172.25.0.24(for example)----->172.25.0.1

in iOS I think ALL traffic is redirected to ppp0 by default or something when you turn on the VPN because even with any rule
packages from my local network reach the ppp0 interface.

obviously with their IPs

NAT is the key for making it work  (I just look your post after I make it work ) 

thank you i was forgetting the loopback.


----------



## _martin (Nov 18, 2011)

im0theros said:
			
		

> your configuration worked ,dont worry,i think i dont need my second line either, when u turn the VPN iOS make ppp0 to do this
> 
> 172.25.0.24(for example)----->172.25.0.1
> 
> in iOS I think ALL traffic is redirected to ppp0 by default



Sorry I didn't quite understand this one. Usually it is desired to route all traffic via VPN interface, though it depends on VPN server settings.

Great that you made it work. You actually made me thinking of jailbreaking my ipad and have a look at it too. But can't shake off the feeling that I'll mess up battery life by doing so (I know, stupid feeling, but .. )


----------



## im0theros (Nov 20, 2011)

I think jailbreaking is useful, jailbreaking by itself just patches the kernel to run unsigned code. The thing that drains your battery are programs using daemons (running in background) so you just don't install things running in background with daemon. Any other app using the native multitasking are just fine. It doesn't matter how many apps you keep in multitasking, this doesn't drain your baterry (RAM used doesn't use batery and this multitasking isn't like PCs).

When you see a tweak (for example a thing that adds the ability to donwload youtube videos or change the font) works with a function that overwrites a class or method in certain app so you are not using more resources or something.


----------



## johnnyfreud786 (Jan 28, 2012)

Well, I am using vpn choice connection for running my internet connection. They provide different types of plans in which I can even hide my identity and they support in all operating system with same speed.


----------

