How to share Guest VM's VPN Connection with Host

Asked 1/12, 2018 at 17:31 Answered 4/6, 2023 at 1:53

I've found it impossible to find an answer to this amidst the legion of How Tos explaining how to share your wireless connection or how to share a Host's VPN with a Guest.

I have a Guest Windows 10 VM (using VirtualBox) which I set up with a Bridged Connection via the Host (also Windows 10). I used Bridged because I need the host to be able to access the Guest and the Guest to also be able to access the outside world. I have installed VPN software on the Guest which works and enables me to access my company's network from that Guest. Installing the VPN software on the Host is not an option. I am attempting to share the Guest VM's network connection with the Host. Ultimately I want other VMs on the same Host to be able to connect via the Guest's VPN connection. But so far, I'm just trying to get the Host to use it on the basis that the rest should be straight-forward after that.

On the Guest, I see Ethernet 1 which is the network adaptor I configured for it in VirtualBox. I also see Ethernet 2 which is the adaptor the VPN software created when it ran. I tried sharing Ethernet 1 and 2 but that seems to end the VPN connection. I created a second Ethernet adaptor for the Guest in VirualBox. I've tried both Sharing that connection and creating a Bridge between it and Ethernet 1 and 2 (I tried both). None of this seems to have worked and I'm not sure how to progress. Ethernet 3 is currently a Host Only network adaptor as I think that should be all I need.

How can I use the Guest's VPN from the Host and other VMs?

Standby answered 1/12, 2018 at 17:31 Comment(3)

What does this question have to do with programming? This appears to be a question for Super User. – Garrity 9/1, 2019 at 15:9

Thanks. Didn't know networking questions were supposed to be on a different site. – Standby 11/1, 2019 at 10:37

Doesn't seem to be any way to withdraw or close my question here. :( – Standby 11/1, 2019 at 10:41

I went through k010mb0's steps with a lot of trial and error, and finally I got my windows-only VPN to work on a virtualbox guest Windows 10 and also access it from my Linux (Ubuntu) host machine.

I will only try to elaborate a little bit further. I assume you have already installed virtualbox on your Linux host, you have created a guest virtual machine and you have installed Windows 10 on it.

1. Setup a NAT network adapter for your virtualbox guest Windows

This is required so that your Windows guest virtual machine has access to the internet. In order to do that, you open virtualbox with your guest virtual machine in stoped state, you click on your Windows virtual machine, click the settings button and then navigate to "Network" from the list on your left. Then you'll need to configure something like this:

The reason you see the options grayed out here is because I'm currently running my virtualbox, but, as mentioned earlier, you should do this with your VM stopped.

2. Setup a host-only network on your host machine

This step is host-specific, not guest-specific. This is why you create this network from the global settings menu of virtualbox and not a guest's settings (guest will be configured later).

Go to your virtualbox manager window, click File -> Host Network Manager... Ctrl+H. You'll probably get a screen with an empty list of networks and some buttons among which there's a Create button. Click it and you'll get your first network:

Note that apart from the IP settings, which you can leave as is, there's also a tab for configuring DHCP on this new network. This DHCP is for assigning IPs of the new network's subnet on the guest virtual machines. You can leave the default settings there as we're going to set network settings manually on the guest OS anyway.

3. Enable the host-only network on your guest virtual machine

Now that we have a new network interface on our host machine (Linux), we can go back to the guest virtual machine, again in stopped state, and add a new network adapter, this time pointing to our newly created host-only network.

From the virtualbox manager, select your guest machine, click Settings again, go to Network and switch to Adapter 2 (or 3 or anything other than the first adapter which we configured earlier):

4. Start your guest virtual machine

Now we can start up our Windows 10 guest virtual machine and verify that there are two network adapters configured, by going to the Network & Internet settings:

In my case, the NAT network (adapter 1) appears as Ethernet (first network on the screenshot) and the host-only network (adapter 3) appears as Ethernet 4. Don't mind the numbering, just make sure you remember which Windows network corresponds to which network adapter we've setup from our virtualbox console.

5. Connect to your company's VPN from Windows

This step is completely custom to your needs. Just download any clients, certificates, credentials, etc. provided by your IT administrator and connect your Windows machine to your VPN.

After successfully connecting to your VPN, you will get a new network connection on your Windows settings panel. Go to Network & Internet Settings, then click Network and Sharing Center. You'll see something like this:

In my case, I had two adapters, Ethernet and Ethernet 4. Now that I connected to my VPN, I also got Ethernet 3. You can always click on the network, then Details and see from the IP configuration which connection is which.

6. Share your VPN connection with the host-only network

Still on our Windows guest virtual machine, we now need to share our VPN connection (Ethernet 3 in my case) with the host-only adapter (Ethernet 4 in my case). For that, click on Ethernet 3 connection from Network and Sharing Center (see previous step), go to Properties and then hit the Sharing tab:

Click on Allow other network users to connect... and then select your host-only connection. In my case, that's Ethernet 4. As soon as you do it, you'll get the following warning:

This effectively says that our Ethernet 4 IP settings will be messed up, but that's ok, we'll fix this right afterwards. Click Yes here.

7. Fix host-only IP settings

As mentioned in the previous step, Windows sets an arbitrary IP address to our host only interface: 192.168.137.1. However, on our host's side (Linux), we have configured a 192.168.56.xxx network. If we leave these settings, Linux and Windows won't be able to communicate.

Let's go Ethernet 4 from the Internet & Network Center, click Properties, then Internet Protocol Version 4 (TCP/IPv4), then Properties:

You see this 192.168.137.1 IP there? Change it to 192.168.56.2.

8. Try to ping your Windows guest from your Linux host

Let's go back to our Linux host machine and see if networking is properly setup between the two machines. Open up a terminal and type ping 192.168.56.2. We should get something like this back:

$ ping 192.168.56.2
PING 192.168.56.2 (192.168.56.2) 56(84) bytes of data.
64 bytes from 192.168.56.2: icmp_seq=1 ttl=128 time=0.282 ms
64 bytes from 192.168.56.2: icmp_seq=2 ttl=128 time=0.181 ms
64 bytes from 192.168.56.2: icmp_seq=3 ttl=128 time=0.506 ms
64 bytes from 192.168.56.2: icmp_seq=4 ttl=128 time=0.262 ms
^C
--- 192.168.56.2 ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 3067ms
rtt min/avg/max/mdev = 0.181/0.307/0.506/0.120 ms

If you don't get a ping response, you need to repeat some of the previous steps.

9. Try to ping a VPN machine from your Linux box

Now pick an IP that is only accessible from your VPN and let's try to ping it. Usually the IP of your VPN's nameserver will respond to ping.

First try to ping this IP from your Windows box. Let's say the protected IP is 10.0.0.1:

C:\Users\XXX>ping 10.0.0.1

Pinging 10.0.0.1 with 32 bytes of data:
Reply from 10.0.0.1: bytes=32 time=76ms TTL=57
Reply from 10.0.0.1: bytes=32 time=76ms TTL=57

Ping statistics for 10.0.0.1:
    Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 76ms, Maximum = 76ms, Average = 76ms
Control-C
^C

Now that we have verified our VPN connection is up and running on Windows, and that 10.0.0.1 is pingable, let's go back to Linux.

The first thing you'll need to do is add a route so that 10.0.0.1 goes through our host-only network, and not your standard ethernet/wifi adapter:

ip route add 10.0.0.1/32 via 192.168.56.2

There are a few things to note here:

We've used the Windows IP 192.168.56.2 in via. Not the Linux IP 192.168.56.1
In this particular example has a netmask of 32. Other routes you might add later won't necessarily have the same netmask.

Now that you have added the route, you can try to ping your VPN protected machine from Linux:

ping 10.0.0.1
PING 10.0.0.1 (10.0.0.1) 56(84) bytes of data.
64 bytes from 10.0.0.1: icmp_seq=1 ttl=56 time=78.2 ms
64 bytes from 10.0.0.1: icmp_seq=2 ttl=56 time=79.3 ms
64 bytes from 10.0.0.1: icmp_seq=3 ttl=56 time=77.1 ms
64 bytes from 10.0.0.1: icmp_seq=4 ttl=56 time=77.0 ms
^C
--- 10.0.0.1 ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 3004ms
rtt min/avg/max/mdev = 76.985/77.896/79.320/0.937 ms

If you see a ping response similar to the above, you can prepare for celebrations. But first make sure you've configured some final stuff first.

10. Setup your VPN's DNS servers on your Linux host

The fact that you have connectivity to your VPN is great news, but that doesn't make everything functional. You'll soon try to open a VPN site on your Linux browser and realize the host name cannot be resolved to an IP. For example if you try to hit someservice.internal.mycompany.com, you'll get a DNS resolution error.

In order to fix that, you'll need to go your VPN connection in the Windows box, open up the Details tab and copy the DNS servers you see there. Then you'll have to go to your Linux box and add those two servers. One way to do it is by adding a nameserver entry for each dns server in your /etc/resolv.conf, but other ways are available.

11. Setup your VPN's routes on your Linux host

Having DNS servers in place allows you to resolve internal VPN domain names to IPs. The last thing left is to tell your Linux box that in order to reach those IPs, it will need to go through the 192.168.56.2 gateway, as we did earlier for our test.

You can print a list of all your VPN's routes on Windows by typing route PRINT.

Then you can use that information to add the same routes (or any subset you need) to your Linux box.

12. Windows configuration might occasionally need a restart

For some reason I never figured out, if I restart the Windows guest machine and just try to reconnect to VPN, Linux won't have access to it. I realized that the connection sharing settings of Windows become defunct. The workaround I've used was to:

Connect to VPN from Windows
Unshare the VPN connection
Re-share the connection

Please feel free to suggest ways to persist sharing configuration on windows machines.

Accusative answered 15/7, 2021 at 8:44 Comment(14)

I get all of this setup but my pings don't reach the VPN DNS. I can ping the Windows guest via the host only adapter but after adding the route I still can't ping the vpn DNS server :( what could be the reason for this? – Gaddy 10/11, 2021 at 14:3

It's very strange, but the solution helped me only when I change ip on step #7 and #8 to 192.168.56.17. – Sidoon 2/12, 2021 at 6:42

Because I've turned on DHCP on VirtualAdapter and 192.168.0.2 is dhcp ip. – Sidoon 2/12, 2021 at 7:14

Supercool, but after WM restarts connection is lost, what that could be? – Runt 11/3, 2022 at 15:25

Thanks a lot for this great step-by-step guide. Just 1 thing that didn't work out for me at first was pinging a vpn-only ip from linux. I had this solved finally by editing the windows registry with EnableRebootPersistConnection, following this article about internet connection settings getting lost at learn.microsoft.com/en-us/troubleshoot/windows-client/… – Nonplus 21/3, 2022 at 21:31

In step 7, why bother changing the guest virtual machine's host-only/internal ip address from the default 192.168.137.1 to 192.168.56.2? – Yirinec 10/10, 2022 at 14:35

@JonFreed good point. To be honest I didn't try it with the default 192.168.137.1 IP. If you did and iti still works please let me know so I can make the answer a little shorter. – Accusative 24/10, 2022 at 7:55

@KostasFilios - It works. (Although then the other references to 192.168.56.2 need to be changed to 192.168.137.1.) FWIW, I have found that the setup occasionally stops working, but it will work again after I unshare and reshare the connection. – Yirinec 25/11, 2022 at 3:35

Pros of VPN-in-guest isolated solution is that you don't need to do split tunnel per user process because in first place you don't have any user processes inside VPN VM guest. No need to add VBoxNetNAT.exe/VBoxNetDHCP.exe and others to the split tunnel list and you potentially won't have issue around socket memory leacks because of in user process opened socket handle duplication by VPN software. – Exsert 24/2, 2023 at 20:50

Cons is that there is no kill switch as VPN software has from the box, you must configure each user process outside of VPN VM guest to force packet traffic into VPN VM guest IP and try not to leack outside of VPN tunnel. – Exsert 24/2, 2023 at 20:52

Cons VPN Port Forwarding does not work over NAT VM Network Adapter. – Exsert 27/2, 2023 at 14:20

@JonFreed Subnet masks must be equal for ip packets to pass networks boundaries. 192.168.137.1/24 is not on the same network with 192.168.57.1/24 (VM interface), traffic won't go out and in. So yes, it must fit and be changed. – Exsert 28/2, 2023 at 3:8

to me Everything is fine until step 8. When VPN is OFF, I am able to ping guest network 192.168.56.x from host (and vice versa) but when the VPN is ON it is no more possible. The network with host-only IP is still set correctly in guest while I see it in 'ipconfig' result, nothing changed only the VPN network added. I also tried with firewall deactivated but the problem still remains :/ The VPN client I'm using is Cisco AnyConnect – Immunoreaction 11/12, 2023 at 9:58

Hi, In step 9 I have got no ping.could you tell me how to get my vpn IP and what kind of vpn you shared in this way.I used softether vpn client and I want to share that with my host linux from windows guest. – Galahad 2/1, 2024 at 10:42

On VM

Enable network sharing on Ethernet 1
Add Host Only Network (Ethernet 3)
Assign it (Ethernet 3) a static IP

On Host

add route to your company network via Ethernet 3 static IP

Rockyrococo answered 15/1, 2019 at 18:31 Comment(6)

Thanks for the answer. Do you mind elaborating on how to "add route to your company network via Ethernet 3"? How to do that? – Lilla 28/3, 2020 at 2:13

route -p add xxx.xxx.xxx.0 mask 255.255.255.0 192.168.yyy.yyy . where xxx - is your office network IP. yyy - is your local VM ip (Ethernet3) – Rockyrococo 30/3, 2020 at 17:12

For some reason I get this: ~$ route -p add 10.0.0.4 mask 255.255.255.0 192.168.125.0 ~$ route: invalid option -- 'p' – Requisition 2/12, 2020 at 22:8

However its worth mentioning that my "office" is just my personal PC – Requisition 2/12, 2020 at 22:8

@JamieHutber this "route" example is related to windows CMD. Please refer to your OS manual on "route" command format. – Rockyrococo 3/12, 2020 at 22:15

Yes, thank you. I did try this on Linux, but I suspect that the issue is actually with my VPN checkpoint and that it tunnels my connection on the guest... so I could not ping once I had added the route. – Requisition 4/12, 2020 at 23:11

@Kostas Filios answer worked for me. The only thing that I didn't saw there were mentions to the firewall in the Windows guest. You should either add the firewall exceptions or disable it completely. I did the latter for the sake of brevity but I am willing to expand on it if someone deems it necessary.

Vadnais answered 12/8, 2021 at 15:58 Comment(0)

Is there any similar guide for ubuntu as guest VM and Windows 10 as host? I have setup host-only adapter however unable to share the vpn network from Ubuntu VM as it is not visible under network window.

Cesura answered 15/7, 2022 at 20:42 Comment(1)

If you have a new question, please ask it by clicking the Ask Question button. Include a link to this question if it helps provide context. - From Review – Bootlick 20/7, 2022 at 8:59

I encountered multiple bumps and bruises that I thought I'de share as I spent too much time on this topic.

I would recommend highlighting the step about enabling "network discovery" on the windows guest as that was my first show stopper (I was unable to ping the internal address of the windows guest from host).
In Windows11, ICS overrides the host only address to 192.168.137.1.
I have a pesky VPN client that doesnt share its gateway. I tried using one of the DNS server routes to simply add to the linux host and was still unable to reach an internal address. Feedback appreciated and many thanks.

Pigeonhearted answered 4/6, 2023 at 1:53 Comment(0)