Well, I ran into a couple bumps getting this system up and running. To be specific I needed sessions to be initiated from both directions (from work to the local VM, and from the local VM to work).
So, basically, the configuration looked like this: There's a VPN tunnel established between work and my home computer. On the home computer there's a VM that needs to reach a system at work, and the system at work needs to reach the VM at home.
Or similar to the illustration below:
So, I guess why I found this interesting is that it wasn't as simple as I initially thought. First stab was to set up the VM and bridging the network on the VM to the host systems interface. But the bridged VM ended up getting the dhcp advertised default route from my home router and therefore packets would not travel through the VPN tunnel. The routing table on the VM looks like (where 10.0.1.1 is the IP of my home router):
root@debian:~# ip route 10.0.1.0/24 dev eth0 proto kernel scope link src 10.0.1.48 default via 10.0.1.1 dev eth0
Which ended up sending packets out to my home router, rather than over the VPN tunnel.
Now I want packets to routed over the VPN tunnel from my VM. The next shot was to set up the VM with a NATed interface--this should let the packet that leaves the VM access the hosts routing table and therefore be directed over the VPN tunnel.
root@debian:~# ip route 10.0.2.0/24 dev eth0 proto kernel scope link src 10.0.2.15 default via 10.0.2.2 dev eth0
And in fact that's what happens (I suppose the Virtual router is the 10.0.2.2 address). The packet is NATed by the VM container, and then the packet is routed by the hosts routing table towards the VPN tunnel.
All is good.
Except that traffic originated from the lab (work located) system will still be unable to reach my local VM due to the NATed interface. I suppose if I had more control over my NATed configuration (VirtualBox) I could set this up to do the right thing.
That leaves my last option (but I know this will work) left which is to set up a VPN tunnel directly from the VM to work's network.