Thanks @Donald_v, this helped me to found a workaround.
In Big Sur or in Fusion 12 the network handling changed. Previously there were no bridge interfaces to manage nat data it was inside the network stack of fusion vmnet devices. In F12 and BS there is a new bridge device bridge100 in my case which needs packetfilter nat rules to route through the other interfaces. (Big Sur disallow to load external kexts - so this is probably because of this new rule)
And the main reason is F12 only add the necessary rules to the main interfaces (en0, en1 - in my case) and the openvpn utun8 has no rules to allow address translations so that's why @Donald_v sees the patckets with the guest internal ips.
If you run this command in the terminal it will lists the created rules by vmware after the guest started:
sudo pfctl -a com.apple.internet-sharing/shared_v4 -s nat 2>/dev/null
The result would be something like this:
nat on en1 inet from 192.168.29.0/24 to any -> (en1:0) extfilter ei
nat on en0 inet from 192.168.29.0/24 to any -> (en0:0) extfilter ei
no nat on bridge100 inet from 192.168.29.1 to 192.168.29.0/24
If you are familiar with this or brave enough to run this commands, then here is the workaround:
I copied the output of this command to a text file newrules.conf with the first command
sudo pfctl -a com.apple.internet-sharing/shared_v4 -s nat 2>/dev/null >newrules.conf
Need to add a new rule with the tun interface of your vpn client. In my case this is utun8.
echo "nat on utun8 inet from 192.168.29.0/24 to any -> (utun8) extfilter ei" >>newrules.conf
It is really important, that the interface and ip address you see above needs to be changed to yours. The address can be copied from the results of the first command. You can find the vpn interface with the ifconfig terminal command.
And the last part it needs to be added to the specific anchor's nat rules. This command will do that and if something goes wrong you only need to reboot your computer and it will be repaired automatically.
sudo pfctl -a com.apple.internet-sharing/shared_v4 -N -f newrules.conf 2>/dev/null
You can check the result with the first command and if you see the utun device you specified, then you can try in the guest if you can reach the vpn network.
Important note: This ruleset is reset every time you start a vm, so it needs to be repeated every time after the vm starts.
As I see this problem is because VMWare don't add extra interfaces related to vpn, only active ethernet ones.
Hope it helps, but it's clearly a temporary fix for the problem!
