How to make the VM work as a **router** on MacOS UTM??

[lesca]

Hello,

I have set up a Debian virtual machine (VM) using UTM on macOS, configured with a bridge network to obtain an IP in the same subnet as the host. The debian VM has ipv4 forward setup correctly, as another Windows VM on the same bridge network can access the internet through Debian's forwarding.

However, external devices like my phone, despite being configured to use Debian as the router (192.168.0.66), cannot access the internet.

The macOS firewall is disabled.

My question is - How to make the VM work as a router on MacOS UTM??

What I observed:

I can ping the Debian VM successfully from my phone.

On Mac, using tcpdump -i en0 and tcpdump -i vmenet0, I observed that web requests from my phone reach en0 but do not pass to vmenet0.

Interface Configurations:

• bridge100:

$ ifconfig bridge100
bridge100: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500
       options=3<RXCSUM,TXCSUM>
       ether 86:94:37:8e:5f:64
       Configuration:
               id 0:0:0:0:0:0 priority 0 hellotime 0 fwddelay 0
               maxage 0 holdcnt 0 proto stp maxaddr 100 timeout 1200
               root id 0:0:0:0:0:0 priority 0 ifcost 0 port 0
               ipfilter disabled flags 0x0
       member: en0 flags=8003<LEARNING,DISCOVER,MACNAT>
               ifmaxaddr 0 port 12 priority 0 path cost 0
       member: vmenet0 flags=3<LEARNING,DISCOVER>
               ifmaxaddr 0 port 19 priority 0 path cost 0
       Address cache:
               24:df:a7:94:ad:56 Vlan1 en0 1196 flags=0<>
               7a:74:15:5c:dd:2a Vlan1 en0 1170 flags=0<>
               c8:3a:35:f4:2d:a5 Vlan1 en0 1099 flags=0<>
               12:5e:9d:e1:6b:4d Vlan1 vmenet0 1190 flags=0<>
               84:7c:9b:3f:d5:91 Vlan1 en0 1199 flags=0<>
       MAC NAT list:
               vmenet0 192.168.0.66 12:5e:9d:e1:6b:4d 1190
               en0 192.168.0.52 84:94:37:xx:xx:xx 1199
               vmenet0 fe80::105e:9dff:fee1:6b4d 12:5e:9d:e1:6b:4d 1164
               en0 fe80::1092:7996:563:fd92 84:94:37:xx:xx:xx 1090
       nd6 options=201<PERFORMNUD,DAD>
       media: autoselect
       status: active

• en0:

$ ifconfig en0
en0: flags=8b63<UP,BROADCAST,SMART,RUNNING,PROMISC,ALLMULTI,SIMPLEX,MULTICAST> mtu 1500
       options=400<CHANNEL_IO>
       ether 84:94:37:xx:xx:xx
       inet6 fe80::1092:7996:563:fd92%en0 prefixlen 64 secured scopeid 0xc
       inet 192.168.0.52 netmask 0xffffff00 broadcast 192.168.0.255
       nd6 options=201<PERFORMNUD,DAD>
       media: autoselect
       status: active

• vmenet0:

$ ifconfig vmenet0
vmenet0: flags=8963<UP,BROADCAST,SMART,RUNNING,PROMISC,SIMPLEX,MULTICAST> mtu 1500
       ether 56:08:5d:9b:89:e9
       media: autoselect
       status: active

Any tips are welcome and appreciated!

[lesca]

After futher tcpdumping on en0, I noticed the ARP replies the MAC of en0.

ARP, Reply 192.168.0.66 is-at 84:94:37:xx:xx:xx, length 28

If the destination of a TCP package is 192.168.0.66, it can be correctly MAC NATed to the debian VM. Just like the ping package can response without problem.

For the routed traffic, the destination IP varies, but the Layer 2 MAC desticaiton is still 84:94:37:xx:xx:xx. In this case, the package is handled by the en0 interface, and won't be forwarded to the VM.

I am not sure how to forward the package to the VM. If you have any ideas, please let me know.