Force host internet traffic through an lxc

I have an lxc running a VPN, and where the host needs to access the internet (e.g. doing updates) I want to force that through the lxc VPN.

I dont want to interfere with local lan or cluster traffic - so just setting a default route isn't appropriate. Likewise I'm not sure just installing the VPN on the host is the right idea.

I'm pretty sure there is a way of doing it... its just not coming to me 😅