How to reach a private service through a Windows VM VPN

Treat the guest and the Mac as two separate networks joined by one narrow door. The Windows VM keeps its VPN client and its own internet path; the Mac reaches exactly one service through a host-only adapter and a single forwarded port. Nothing else should cross. Follow the steps in order, and stop when one fails, because every later step assumes the earlier ones held.

Record the two paths before changing anything

On the guest, ipconfig /all prints the adapter that carries the VPN transport and the address it received from the virtual network's DHCP. On the Mac, record the virtual interface the hypervisor created for that segment; with VMware Fusion the host-only device is usually vmnet1, and Parallels names its own. Note who hands out addresses there, then write all of it down, because the host-only subnet is frequently reassigned when a virtual network is recreated. Check the virtual machine's network mode in the hypervisor rather than in your memory of it. Shared or NAT mode for the internet-facing adapter plus host-only mode for the Mac-facing adapter is the arrangement these steps assume.

Two adapters, two purposes. Mixing them so that one adapter serves both the Mac and the internet is what turns a narrow door into a routed path.

Confirm the guest's own VPN first

Start the client inside Windows and confirm it terminates, using whatever test the vendor documents. Do not move on until the guest alone reaches the private service, because a forwarding problem layered on a broken tunnel has two causes and no useful error message. Record the private address the service resolves to from inside the guest. That address is the only thing the forwarding rule should name.

If the client pushes a full tunnel, the host-only adapter still carries local traffic, but verify that the private destination is not captured by the tunnel in a way that changes its address. A split-tunnel profile makes this simpler and is worth requesting from whoever owns the VPN.

Add the host-only leg and test it alone

Attach a host-only adapter to the guest, give it a static address on a subnet nothing else uses, and confirm the Mac can ping it. Test with the VPN connected and with it disconnected, because the address has to survive both. A guest that answers only while its tunnel is up has a routing problem you have not found yet.

Windows may classify the new adapter as a public network, which blocks inbound traffic by default. Set the profile before you debug anything else.

Forward one port, not the subnet

Prefer a single forwarded port over general IP forwarding. Windows ships netsh interface portproxy, which forwards a listening port to a destination host and port, and it needs the IP Helper service running.

Always set listenaddress to the host-only address. Omitting it binds every interface, which exposes the service to whatever network the VM happens to sit on. Add a firewall rule scoped to the host-only interface and that one port, so the listener and the permission agree. A proxy-aware application may instead want a small proxy inside the guest, which terminates the connection and needs no return route to the Mac. Choose the proxy when the protocol allows it, because it fails closed by construction.

Verify, then write the rollback

From the Mac, resolve the private name, run the intended operation, then stop the guest's VPN and confirm the operation fails instead of silently falling back. That last check is the one that proves the path is the one you built. Record which identity the gateway sees and who is allowed to use the forward.

Write the rollback as three steps: remove the portproxy entry, remove the firewall rule, detach the host-only adapter. Then run it once, before you need it, and confirm the guest's own VPN still works afterwards. If your organisation requires each Mac to enrol independently, stop here and use that model instead, since a shared forwarding point concentrates access on one guest. Either way, put the addresses and the port in the change record; the next person will not want to rediscover them.