Is it possible to route traffic from the outside to a virtualbox VM on the inside of a macOS Mojave? I have a Mac (hermione, IP 192.168.2.86) that runs a Virtualbox VM with address 192.168.97.1. netstat -rn on that machine says:

192.168.97         link#23            UC              2        0 vboxnet      !
192.168.97.1       a:0:27:0:0:2       UHLWI           0        4     lo0       
192.168.97.100     8:0:27:f0:e0:3e    UHLWIi          1        2 vboxnet    961


When I'm on that Mac, everything is fine, I can ping 192.168.97.1 (VirtuaBbox itself) and 192.168.1.100 (the VM).

Now, I want to be able to reach these from the outside. So on another Mac (luna) I've tried setting up routes to do that, e.g.

sudo route -v -t add -net 192.168.97 192.168.2.86


or

sudo route -v add -host 192.168.97.1 192.168.2.86


Telling luna to route traffic for 192.168.97.1 to 192.168.2.86 (the IP address of hermione).

But traffic won't get through. Is macOS capable of this at all and if so, what am I doing wrong?
You have to set up NAT port forwarding rules then access your services by using the IP address of your Mac much like you would if it were a host behind a traditional firewall/router.

You can do this via the VirtualBox GUI in the Port Forwarding rules setup in the Network Settings preference pane for the individual VM.  In the example below, I show how you can set port forwarding for SSH on port 2222 of your host to port 22 of your guest (using the IPs from your question).





Alternatively, you can do this via the CLI using VBoxManage modifyvm.  So using the same example as above:

$ VBoxManage modifyvm "VM NAME" --natpf1 "SSH,tcp,192.168.2.86,2222,192.168.97.1,22"