How to route traffic through VPN only accessible within VM (without a bridged adapter)?

Question

I have an interesting situation where I have a corporate VPN that can only connect through a specific (outdated) version of Ubuntu (and/or Windows) using a vendor-supplied client that creates a VPN interface on tun0 upon successful authentication. I use a different distribution on my personal Linux machine, on which the VPN client will not run because of library issues.

As a workaround, I have more-or-less figured out how to configure the Ubuntu VM (on VirtualBox) to work as a router when the VM is configured in bridge mode. Unfortunately, this works on some networks (like my home one) because I can get another IP no problem for my bridged VM, but on many public networks, this does not work.

I believe I should be able to do this with two network adapters on the VM, one with NAT, and one as a Host-Only connection, but I'm not sure how to set up the routing so that I can send traffic on my host through the VPN tunnel.

Here's the setup so far:

[host]$ VBoxManage list hostonlyifs 

Name:            vboxnet0
GUID:            786f6276-656e-4074-8000-0a0027000000
DHCP:            Disabled
IPAddress:       192.168.56.1
NetworkMask:     255.255.255.0
IPV6Address:     fe80::800:27ff:fe00:0
IPV6NetworkMaskPrefixLength: 64
HardwareAddress: 0a:00:27:00:00:00
MediumType:      Ethernet
Wireless:        No
Status:          Up
VBoxNetworkName: HostInterfaceNetworking-vboxnet0

The guest interfaces (after connecting to the vpn - enp0s3 is the NAT adapter, enp0s8 is the host-only adapter):

[guest]$ ip addr show
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
2: enp0s3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether 08:00:27:b2:d9:c2 brd ff:ff:ff:ff:ff:ff
    inet 10.0.2.15/24 brd 10.0.2.255 scope global dynamic noprefixroute enp0s3
       valid_lft 83176sec preferred_lft 83176sec
3: enp0s8: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether 08:00:27:3c:81:82 brd ff:ff:ff:ff:ff:ff
    inet 192.168.56.101/24 brd 192.168.56.255 scope global dynamic noprefixroute enp0s8
4: tun0: <POINTOPOINT,UP,LOWER_UP> mtu 1384 qdisc fq_codel state UNKNOWN group default qlen 500
    link/none 
    inet XXX.XXX.XXX.XXX peer 1.1.1.1/32 scope global tun0

On the guest, I enable translation between the host-only adapter and the VPN tunnel with the following commands:

sudo sysctl net.ipv4.conf.all.forwarding=1
sudo sysctl net.ipv6.conf.all.forwarding=1
sudo iptables -A FORWARD -i enp0s8 -o tun0 -j ACCEPT
sudo iptables -A FORWARD -i tun0 -o enp0s8 -j ACCEPT
sudo iptables -t nat -A POSTROUTING -o tun0 -j MASQUERADE

On the host, I can replace the default route with 192.168.56.1 (the host-only VM adapter), but then obviously no data can get out at all. Since the VM is not getting it's own access to the internet, I need to have some traffic coming in/out to the internet through the host, but then I would like to force as much as possible of that to go through the VM's VPN connection. It feels like I'm close, and this should be possible, but I'm not sure what the missing piece is.

On a side note, I think I could get this to work for certain applications by perhaps doing an SSH SOCKS proxy to the VM, perhaps? I'd like to route all traffic through the VPN, if possible.

EDIT:

Here's a diagram more or less showing what I'm talking about, in hopes it makes it more clear. My confusion is that the traffic originating from tun0 in the VM will have to through the bridged adapter to get out to the internet. I'm not sure if it's possible to set up the routing such that traffic does not go over the dashed line, and instead goes entirely through the VM and out that way. If I send all traffic through the VM (change the default route to the host-only adapter), then it gets into a loop or something, and no traffic can get out to the internet at all:

Answer 1

As I see it, you have two options:

1. Add a non-default route for the specific range of (corporate) hosts that is inaccessible without the VPN. For example, assuming you are trying to access the 10.0.0.0/8 corporate subnet, then you could simply add a route with: ip route add 10.0.0.0/8 via 192.168.56.101, where 192.168.56.101 is the IP address of the guest on the host-only adapter (vboxnet0/enp0s8). Of course, you should also update your /etc/resolv.conf with the corporate DNS servers.

   • Pros: It works without a bridged adapter. In fact, I routinely use this configuration with a NAT adapter.
   • Cons: Only corporate traffic is routed through the VPN. This can be a nice side-effect actually, but according to your question it is not desirable.

2. Use device passthrough so that the guest has full access to a dedicated adapter, eliminating the need for a bridged adapter (such as wlp2so). For example, you could use a USB Wi-Fi dongle.

   • Pros: All traffic can be routed through the VPN.
   • Cons: You need a dedicated device for the guest.

Answer 2

This looks like a good use case for a travel router. You can put it between your computer and the network and use it for a local DHCP server. Something like this would work well GL-iNet GL-AR750S "Slate". Then you can just use a bridged-mode setup everywhere. Even if you are somewhere that doesn't take kindly to "rogue wireless access points," you can just use the ethernet ports.

There are a lot of other nice uses for devices like this. They double as power banks and little file servers too. Jeff Atwood, the founder of StackExchange, wrote about his personal use of one of the first travel routers that works well here: https://blog.codinghorror.com/your-own-personal-wifi-storage/