Bring RNDIS Tethering to macOS
ThruRNDIS is a Swift app based on the Virtualization framework that enables Android RNDIS USB tethering on macOS.
- macOS 27 or later
- Privileged Helper approval
brew install --cask afcoo/tap/thrurndis-
Install VM Assets: Install the latest compatible VM Assets during onboarding or in Settings.
-
USB device passthrough: In Virtual Machine Accessories in the menu bar, connect the USB device to ThruRNDIS.
-
(Optional) Port forwarding: Before connecting the device, configure the TCP/UDP ports to expose through the RNDIS device in Settings → Network Routing.
-
Confirm the USB device connection: Approve the connection in the USB device connection pop-up.
Warning
ThruRNDIS 0.4.0+ does not use WireGuard.
[macOS]
IPv4 routes
→ Ethernet Bond
→ feth0 (Bond member) ↔ feth1 (VZNAT bridge member)
⌃
│ VZNAT bridge
⌄
[Linux VM]
eth0
→ IPv4 forwarding + nftables masquerade
→ usb0
⌃
│ USB passthrough
⌄
[RNDIS Device]
Reference: Virtualization Framework: VZUSBPassthroughDevice
ThruRNDIS runs a lightweight Linux VM and passes the RNDIS device connected to macOS through to the VM using USB passthrough.
ThruRNDIS's Network Helper configures an Ethernet Bond and feth pair and attaches the feth peer to the VM's VZNAT bridge so that macOS IPv4 traffic is routed through the VM. The VM forwards this traffic and applies NAT masquerade before sending it through the USB RNDIS interface.
TCP/UDP port forwarding is handled by nftables DNAT/SNAT rules in the Linux VM, which forward matching RNDIS traffic to macOS without changing the destination port.
(Legacy) Before v0.4.0
ThruRNDIS WireGuard Network System Extension
-> VZNAT guest endpoint UDP/<ListenPort>
-> Linux VM wg0
-> nftables masquerade
-> Linux VM usb0
-> RNDIS USB tethering device
Reference: Virtualization Framework: VZUSBPassthroughDevice
ThruRNDIS runs a lightweight Linux VM and passes the RNDIS device connected to macOS through to the VM using USB passthrough.
macOS and the VM are connected by a WireGuard tunnel over VZNAT, and the VM forwards macOS traffic received through WireGuard to the recognized RNDIS device.
ThruRNDIS uses a modified wireguard-apple fork to establish the WireGuard tunnel over VZNAT.
ThruRNDIS source code is distributed under the MIT License.