Using Server 5.0.15 to share internet WITHOUT internet sharing
The newest OS X Server versions don't provide any tools to enable NAT/Routing in OS X.

To get NAT working without using Internet Sharing you have to use a pf rule and create a plist to enable forwarding and load the pf rule:

Below I assume en0: the interface connected to the cable modem and en1: the interface connected to the LAN. DHCP and DNS are set up properly in the internal LAN.


Create a pf NAT rule:

Create a file named nat-rules in /private/etc/ with the following content

nat on en0 from en1 to any -&gt; (en0)

Create a shell script named nat-pf.sh enabling forwarding and loading the pf rule. I saved it in /usr/local/:

#!/bin/sh

sysctl -w net.inet.ip.forwarding=1
sysctl -w net.inet.ip.fw.enable=1

#disables pfctl
pfctl -d

sleep 1

#flushes all pfctl rules
pfctl -F all

sleep 1

#starts pfctl and loads the rules from the nat-rules file
pfctl -f /private/etc/nat-rules -e

Create a plist named org.user.natpf.plist with the following content and save it in /Library/LaunchDaemons/ to execute the above shell script at start-up:

&lt;?xml version="1.0" encoding="UTF-8"?&gt;
&lt;!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"&gt;
&lt;plist version="1.0"&gt;
&lt;dict&gt;
    &lt;key&gt;Disabled&lt;/key&gt;
    &lt;false/&gt;
    &lt;key&gt;KeepAlive&lt;/key&gt;
    &lt;dict&gt;
        &lt;key&gt;SuccessfulExit&lt;/key&gt;
        &lt;false/&gt;
    &lt;/dict&gt;
    &lt;key&gt;Label&lt;/key&gt;
    &lt;string&gt;org.user.natpf&lt;/string&gt;
    &lt;key&gt;ProgramArguments&lt;/key&gt;
    &lt;array&gt;
        &lt;string&gt;/usr/local/nat-pf.sh&lt;/string&gt;
    &lt;/array&gt;
    &lt;key&gt;RunAtLoad&lt;/key&gt;
    &lt;true/&gt;
    &lt;key&gt;StandardErrorPath&lt;/key&gt;
    &lt;string&gt;/tmp/org.user.natpf.stderr&lt;/string&gt;
    &lt;key&gt;StandardOutPath&lt;/key&gt;
    &lt;string&gt;/tmp/org.user.natpf.stdout&lt;/string&gt;
&lt;/dict&gt;
&lt;/plist&gt;


All three files need a trailing empty line so don't simply copy the above code/lines.
Modify ownership and file modes:

sudo chown root:wheel /private/etc/nat-rules
sudo chown root:wheel /usr/local/nat-pf.sh
sudo chmod 755 /usr/local/nat-pf.sh
sudo chown root:wheel /Library/LaunchDaemons/org.user.natpf.plist

Load the launch daemon:

sudo launchctl load /Library/LaunchDaemons/org.user.natpf.plist

After testing everything you can delete the following part in the plist:

    &lt;key&gt;StandardErrorPath&lt;/key&gt;
    &lt;string&gt;/tmp/org.user.natpf.stderr&lt;/string&gt;
    &lt;key&gt;StandardOutPath&lt;/key&gt;
    &lt;string&gt;/tmp/org.user.natpf.stdout&lt;/string&gt;


org.user.natpf.stderr provides error messages to debug your plist.
On my local router I had to add a static route:

192.168.3.0/24 (the internal network) -> 192.168.0.2 (Mac mini IP-address of the external interface connected to the router)

This last step may not apply to your network environment!