MacStadium Blog

Setup a VPN server with macOS Sierra server 10.12

We have a lot of customers who use their Mac mini as a VPN server. This works great when you need an IP address in the US, or a secure internet connection on the road.

We have a lot of customers who use their Mac mini as a VPN server. This works great when you need an IP address in the US, or a secure internet connection on the road, or a number of other reasons. When Apple released Lion, they changed the setup a bit so we wrote a tutorial. This continued in Mountain Lion and MavericksYosemiteEl Capitan, and remains the case in Sierra. By default, Sierra Server VPN will distribute IP addresses in the same range the Mac itself uses. This doesn’t work well in a facility like MacStadium where each Mac mini has a static WAN IP address. 

We asked Rusty Ross to help us put together a tutorial that will help MacStadium customers setup their Mac minis to serve as VPNs. He’s broken it down in a few parts so be sure to take the steps that are best for your situation:  


PART II: Internet Routing (OPTIONAL


PART IV: Client Setup 

If you are simply looking to enable VPN service on your macOS Server for secure connection(s) between your server and client(s), you can skip PART II. That’s right: you can jump straight from PART I to PART III. The procedures discussed in PART II are intended for those who are looking to route internet traffic from their VPN clients over the VPN and out to the internet via their server’s public internet connection at Macminicolo. 

Also, it should be mentioned that server administration (particularly at the command line level) can be tricky. If you do proceed beyond this point, which shall be exclusively at your own risk, then please proceed carefully, and as always, don’t ever proceed without a backup of your server and other irreplaceable data. 

Still here? Okay, let’s get started.


First, let’s set up a VLAN. 

In System Preferences, go to Network, and choose “Manage Virtual Interfaces…”

Image showing where to click to access "manage virtual interfaces"

Then choose “New VLAN…”

Image showing where to access "new VLAN"

Let’s just name our VLAN something like “LAN”, and all other defaults here should be fine:

Image showing how to name your VLAN.

After pressing “Create”, you’ll see this:

Image showing how to confirm your VLAN.

After pressing “Done”, you’ll be able to enter network info for your new VLAN. Make sure to choose “Manually” for “Configure IPv4”, and set the IP Address, Subnet Mask, and Router as shown below. 

(Advanced: We’ll be using a private IP for the server and private network in this walkthrough, but note that the technique documented here will work with any private IP addressing scheme. To accomplish that, you’d substitute that alternate network info here, as well as a few other places further along in this walkthrough.)

Image showing how to configure your VLAN sesttings.

After pressing “Apply”, you should see something like this, indicating that your newly-created VLAN is active:

Image showing what it looks like when your VLAN is active.

Nice work. Now, let’s get basic DNS up and running. Launch Server.app, and click on the “DNS” section of the sidebar, under “Advanced”:

Image showing how to get DNS started.

All DNS defaults in Server.app should be fine, so let’s switch DNS service on:

Image showing how to sswitch the DNS server on.

Great. Now, once again, if you are NOT interested in routing public internet traffic from your VPN client(s) over the VPN and out to the internet via your server’s public internet connection at Macminicolo, you should SKIP from here to PART III.

PART II: Internet Routing (OPTIONAL)

So far, so good. Now things get a little trickier, as we need to dive into the command line a bit to get NAT and routing set up. First, we’ll need to edit two privileged text files, so we are going use a command line text editor called nano. Breathe easy, we've got each other's backs here, and we will take this step by step. 

As we proceed, it is important to remember that in the command line, typos aren't the least bit welcome, and also, uppercase/lowercase needs to match exactly, so it is extremely important to enter text into Terminal.app exactly as it is described here. 

One additional (but important!) point: The quotation marks used here in terminal commands are "straight" quotes. Some web browsers and text editors may automatically convert these marks to smart (curly) quotes, particularly when copying and pasting. It's important to use straight quotes when entering the commands from this tutorial in Terminal.app. 

Okay? Let's forge ahead. 

Launch Terminal.app:

Image showing how to get NAT and routing set up.

Inside the terminal window that appears, enter the following command (as a single line), and press return: 


Orka, Orka Workspace and Orka Pulse are trademarks of MacStadium, Inc. Apple, Mac, Mac mini, Mac Pro, Mac Studio, and macOS are trademarks of Apple Inc. The names and logos of third-party products and companies shown on the website are the property of their respective owners and may also be trademarked.

©2023 MacStadium, Inc. is a U.S. corporation headquartered at 3525 Piedmont Road, NE, Building 7, Suite 700, Atlanta, GA 30305. MacStadium, Ltd. is registered in Ireland, company no. 562354.