I have an interesting situation where I have a corporate VPN that can only connect through a specific (outdated) version of Ubuntu (and/or Windows) using a vendor-supplied client that creates a VPN interface on tun0 upon successful authentication. I use a different distribution on my personal Linux machine, on which the VPN client will not run because of library issues.

As a workaround, I have more-or-less figured out how to configure the Ubuntu VM (on VirtualBox) to work as a router when the VM is configured in bridge mode. Unfortunately, this works on some networks (like my home one) because I can get another IP no problem for my bridged VM, but on many public networks, this does not work.

I believe I should be able to do this with two network adapters on the VM, one with NAT, and one as a Host-Only connection, but I'm not sure how to set up the routing so that I can send traffic on my host through the VPN tunnel.

Here's the setup so far:

[host]$ VBoxManage list hostonlyifs 

Name:            vboxnet0
GUID:            786f6276-656e-4074-8000-0a0027000000
DHCP:            Disabled
IPV6Address:     fe80::800:27ff:fe00:0
IPV6NetworkMaskPrefixLength: 64
HardwareAddress: 0a:00:27:00:00:00
MediumType:      Ethernet
Wireless:        No
Status:          Up
VBoxNetworkName: HostInterfaceNetworking-vboxnet0

The guest interfaces (after connecting to the vpn - enp0s3 is the NAT adapter, enp0s8 is the host-only adapter):

[guest]$ ip addr show
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet scope host lo
       valid_lft forever preferred_lft forever
2: enp0s3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether 08:00:27:b2:d9:c2 brd ff:ff:ff:ff:ff:ff
    inet brd scope global dynamic noprefixroute enp0s3
       valid_lft 83176sec preferred_lft 83176sec
3: enp0s8: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether 08:00:27:3c:81:82 brd ff:ff:ff:ff:ff:ff
    inet brd scope global dynamic noprefixroute enp0s8
4: tun0: <POINTOPOINT,UP,LOWER_UP> mtu 1384 qdisc fq_codel state UNKNOWN group default qlen 500
    inet XXX.XXX.XXX.XXX peer scope global tun0

On the guest, I enable translation between the host-only adapter and the VPN tunnel with the following commands:

sudo sysctl net.ipv4.conf.all.forwarding=1
sudo sysctl net.ipv6.conf.all.forwarding=1
sudo iptables -A FORWARD -i enp0s8 -o tun0 -j ACCEPT
sudo iptables -A FORWARD -i tun0 -o enp0s8 -j ACCEPT
sudo iptables -t nat -A POSTROUTING -o tun0 -j MASQUERADE

On the host, I can replace the default route with (the host-only VM adapter), but then obviously no data can get out at all. Since the VM is not getting it's own access to the internet, I need to have some traffic coming in/out to the internet through the host, but then I would like to force as much as possible of that to go through the VM's VPN connection. It feels like I'm close, and this should be possible, but I'm not sure what the missing piece is.

On a side note, I think I could get this to work for certain applications by perhaps doing an SSH SOCKS proxy to the VM, perhaps? I'd like to route all traffic through the VPN, if possible.


Here's a diagram more or less showing what I'm talking about, in hopes it makes it more clear. My confusion is that the traffic originating from tun0 in the VM will have to through the bridged adapter to get out to the internet. I'm not sure if it's possible to set up the routing such that traffic does not go over the dashed line, and instead goes entirely through the VM and out that way. If I send all traffic through the VM (change the default route to the host-only adapter), then it gets into a loop or something, and no traffic can get out to the internet at all:

desired network diagram

  • which VPN is it? – Rui F Ribeiro Apr 11 '19 at 18:29
  • @RuiFRibeiro it's a corporate-supplied custom client that handles the authentication and provides a network interface (tun0) and is not configurable in any way due to security considerations (not a standard OpenVPN, L2TP, PPTP, etc.) – jat255 Apr 11 '19 at 18:46
  • Is it Checkpoint? – Rui F Ribeiro Apr 11 '19 at 21:59
  • @RuiFRibeiro no, it's not. I'd rather not provide more details on the VPN, since the question is more about routing, than the actual VPN – jat255 Apr 11 '19 at 22:03
  • 1
    Part of the VPN connection process is a fairly intrusive "endpoint inspection" process, which is what is failing. I've attempted to debug what is going wrong via strace and such, but have not been able to figure out the failure point. Fixing the VPN software would be the ideal solution, but the company does not offer any support at all for "unsupported configurations", which is anything more modern than Ubuntu from 2016 or one of the enterprise Linux versions... – jat255 Apr 19 '19 at 13:56

As I see it, you have two options:

  1. Add a non-default route for the specific range of (corporate) hosts that is inaccessible without the VPN. For example, assuming you are trying to access the corporate subnet, then you could simply add a route with: ip route add via, where is the IP address of the guest on the host-only adapter (vboxnet0/enp0s8). Of course, you should also update your /etc/resolv.conf with the corporate DNS servers.

    • Pros: It works without a bridged adapter. In fact, I routinely use this configuration with a NAT adapter.
    • Cons: Only corporate traffic is routed through the VPN. This can be a nice side-effect actually, but according to your question it is not desirable.
  2. Use device passthrough so that the guest has full access to a dedicated adapter, eliminating the need for a bridged adapter (such as wlp2so). For example, you could use a USB Wi-Fi dongle.

    • Pros: All traffic can be routed through the VPN.
    • Cons: You need a dedicated device for the guest.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.