Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

The need - This question is relevant for all of those who want to bypass their corporate's annoying VPN, and access their work/corporate network from their private computer, especially if the corporate VPN client software can't run on their private computer.

Homework: this question is very similar to this one and this one, which aren't answered :(

The challange - Can't run the corporate VPN client from the private computer, so converted the work laptop to a VMWare Virtual Machine. The VPN client is working fine inside the Guest VM, now we want to share it with the Host (the private computer)

The specs: * The private computer (Host OS) is Mac OS X Lion 64bit * The corporate laptop (Guest VM) is WinXP 32bit, running in Bridged network mode * The VPN client on the Guest VM is is Checkpoint SecuRemote NGX R60 HFA03 * While the VPN is running in the Guest VM, the Host can still ping the Guest and vice versa

share|improve this question

migrated from stackoverflow.com Aug 27 '11 at 0:25

This question came from our site for professional and enthusiast programmers.

    
I've flagged this for possible migration to superuser.stackexchange.com -- you'll probably get a better answer there. –  Jared Ng Aug 26 '11 at 23:09
    
I don't think this can be done, and I think that's by design for security purposes... What do you need access to the access for on the Host? If you want to file transfer between the two still, you could use VirtualBox Shared Folders. What problem/issue are you trying to solve? What are you attempting to do that this is causing an issue? –  k3yz101 Apr 29 '13 at 4:44
    
Which hypervisor are you using? VirtualBox, VMWare.... –  MariusMatutiae Oct 29 '13 at 17:46

3 Answers 3

The question is to route the traffic from the VM host via the VM guest's VPN (i.e. Checkpoint Secure Remote). NAT & ICS won't work as it is specifically blocked by most cooperate implementations of CSR.

In short: You can set-up a proxy server in your VM Guest and configure the VM host accordingly to use the proxy. As far CSR will be concerned, you traffic originates from inside the Guest VM and happily forward it.

share|improve this answer

I can sketch the solution for you, but, since I do not own a Windows system, whether virtual or physical, I cannot really test it. Yet I have tested it with two Linux systems, and it works (I am writing through exactly this configuration right now). I will assume that you are using VirtualBox, it should be possible to achieve the same result in VMWare. Also, don't be discouraged: though it looks complex, most of these steps need to be performed only the first time you set this up, the second time you will want to enable this you will breeze through these steps.

Let me give you the basic idea: we configure the VM as if it were a physical machine: two network cards, one local to talk to the host, the other to talk to the internet. Then we force the host to use the guest as its router, erasing the old gateway.

In order to allow the guest to route correctly the packets from/to the host, we enable IPv4 forwarding on the guest. Then we start the VPN.

1) Configure your VM to start with 2 network adapters, one for bridged access, the other one for Host-only connection. Configure the Host-only connection to have a DHCP server at 192.168.56.100, and to dish out IP addresses 192.168.56.1 (to the host, say) and 192.168.56.2 to the guest.

Let me give a reference on how to do this: see this AskUbuntu excellent answer

2) start your virtual machine, make sure you can connect to the Internet and can ping to/from Host.

3) On the host, diable IPv4 forwarding:

sysctl -w net.inet.ip.forwarding=0

as sudo;

4) again on the host, change your default gateway to be the guest 192.168.56.2:

 route delete default
 route add default 192.168.56.2

5) Now let us go back to the guest, and enable IPv4 forwarding: you can find instructions on this Microsoft page.

6) On the host, check that you have connectivity, for instance ping a pc on your LAN.

7) now start the VPN, and you should be good to go.

Should this fail (and here I apologize because I cannot test this since I do not own a Windows system), you may try to invert the order of steps 5 and 7 (never mind 6).

To cover all the bases, I would also like to add that, still in the case of failure, you should consider also the following point. When you start the VPN, a new interface is created, generally (but not necessarily) called tun0/tap0. Linux demands that you explicitly forward IPv4 traffic from the incoming interface (which in your case is the host-only adapter) to the outgoing one, tun0/tap0. Through Google, I have been unable to find out how Windows manages to do that: in other words, it appears from Googling that you do not need to specify he outgoing interface explicitly. If the above fails, but you have successfully achieved step 6 (that I am quite sure works), you will have to investigate further this point.

Like I said, I am writing right now from exactly the same configuration, realized, however, with tho Linux machines; the set up of Mac OS holds no difficulty, since it is a Unix system. Conceptually, it should make little difference which OS you implement it with, it is just a matter of finding the correct commands for achieving the steps above.

And thank you for providing an amusing project.

share|improve this answer

What do you want to share by host?

  1. Files? Using the sharing utility of VM to access your host drives via \.host
  2. Desktop? Use a remote protocol such as VNC or RDP to share the desktop.
  3. Network? Make your host the default gateway of you gust. Use NAT in that case.
  4. Anything else?
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.