Sharing a TUN VPN connection with Android & iOS for traffic interception
First on the Mac do a network configuration (a location in Apple wording) appropriate for your need. Never use the too infamous and too magic "Automatic" location.
A configuration with a "Wi-Fi" and "Bluetooth PAN" interfaces and nothing else. Configure them (I guess you are familiar with this aspect to start playing with a VPN and the problems of security around this).

Once this is set, with nothing connected yet on the "Bluetooth PAN" interface, just configure an "Internet Sharing" (which in fact should be correctly named a "network gateway") as follows:


The correct sysctl, nat and pf settings will be done by many subprocesses hidden (and undocumented) behind Internet Sharing.