VMware ESXi and vSphere Cluster Management

Configure Internal Networking in Oracle VirtualBox

Learn how to connect existing VirtualBox guest VMs on an isolated Internal Network, configure guest IP addresses, verify connectivity, and troubleshoot common problems.

VirtualBox Internal Network mode connects guest virtual machines to a private virtual network contained within the host computer. It is useful for isolated labs, private server-client testing, and multi-VM environments that must not connect to the physical LAN or internet.

What Internal Network mode does

In VirtualBox, a guest VM is a virtual machine running inside the host, which is the physical computer and its operating system. Each VM can have one or more virtual network adapters, also called virtual network interfaces.

When an adapter is attached to Internal Network, VirtualBox places that adapter on a private virtual network. Traffic between participating guests remains inside the host machine. The traffic is visible only to guest VMs whose adapters are connected to the same internal network.

  • The host is the containment boundary for the internal-network traffic.
  • Every participating guest adapter must use the Internal Network attachment mode.
  • Participating adapters must use exactly the same internal network name.
  • Internal Network does not inherently provide access to the host, physical LAN, or internet.
  • The network can continue operating even when the host is disconnected from Wi-Fi and Ethernet.

Typical uses include testing a web server against a database server, building an offline security lab, and practicing distributed applications without exposing them to the surrounding network.

How the network is identified

The VirtualBox setting Attached to selects the adapter's network attachment mode. When the value is Internal Network, a second setting identifies the private network by name. For example, two adapters named lab-internal are placed on the same virtual network.

The name is a local VirtualBox identifier, not a DNS name and not an IP address. Names are case-sensitive in practice, so use the same spelling and capitalization on every participating VM.

Internal Network does not automatically assign IP addresses. The guests still need compatible IP configuration, supplied by static settings or by a DHCP service running on one of the guest VMs.

Prerequisites and network planning

  • Identify the VMs that must communicate.
  • Choose one shared internal network name, such as lab-internal.
  • Choose an IP subnet for the lab.
  • Decide whether guests will use static addresses or a DHCP server supplied by a guest VM.
  • Make adapter changes while the VMs are powered off, unless the installed VirtualBox version supports the required live change.

An IP subnet is a logical range of addresses that can communicate directly. A simple plan for two guests is:

Network:  192.168.50.0/24
Guest 1:  192.168.50.10/24
Guest 2:  192.168.50.11/24
Gateway:  omit when traffic stays on this subnet
DNS:      omit unless a DNS server is configured

The /24 prefix is equivalent to the subnet mask 255.255.255.0. Both guests are in the same subnet, so they can communicate directly without a router. A default gateway is unnecessary when all required traffic stays on this isolated subnet.

Configure an existing VM in VirtualBox Manager

Oracle VM VirtualBox Manager is the graphical management application used to edit VM settings. Repeat the following procedure for every VM that should join the private network.

  1. Power off the target VM if it is running, when required by your VirtualBox version or the adapter change.
  2. Open Oracle VM VirtualBox Manager.
  3. Select the existing VM in the VM list.
  4. Open Settings.
  5. Open the Network section.
  6. Select the adapter to configure, such as Adapter 1.
  7. Enable the network adapter.
  8. Set Attached to to Internal Network.
  9. Enter or select a shared internal network name, such as lab-internal.
  10. Save the settings.
  11. Apply the same attachment mode and network name to each peer VM.

For a basic two-VM lab, both Adapter 1 devices should be enabled, attached to Internal Network, and assigned the name lab-internal.

Configure networking inside each guest

VirtualBox supplies the virtual link, but the guest operating system must configure its own interface. For each guest, configure an IP address and subnet mask or prefix. Use unique addresses from the same subnet.

  • Guest 1: 192.168.50.10/24
  • Guest 2: 192.168.50.11/24

Leave the gateway empty when the guests only need to communicate with one another. Configure a gateway only when another device or guest will route traffic beyond the internal subnet. Configure DNS only when the guests need name resolution through a reachable DNS server.

The exact guest configuration method depends on the operating system. Linux guests can use their distribution's network manager or configuration files. Windows guests can use the adapter's IPv4 properties. The important requirements are a powered-on interface, unique addresses, and matching subnet definitions.

Internal Network alone does not provide internet access. If a guest needs internet or management access, add another adapter with an appropriate attachment mode and configure routing deliberately.

Example: two-VM isolated test network

  1. Select or create two guest VMs.
  2. Enable Adapter 1 on both VMs.
  3. Attach both adapters to Internal Network.
  4. Use lab-internal as the network name on both adapters.
  5. Assign 192.168.50.10/24 to the first guest.
  6. Assign 192.168.50.11/24 to the second guest.
  7. Start both VMs and test communication.

The guests should communicate with each other while remaining isolated from the host's physical LAN. If the host loses its Wi-Fi or Ethernet connection, the internal guest-to-guest link should still function.

Verify connectivity

Start all participating VMs and check the interface state and address inside each guest. On a Linux guest, these commands display interface addresses and routes:

ip addr
ip route

From Guest 1, test Guest 2:

ping 192.168.50.11

From Guest 2, test Guest 1:

ping 192.168.50.10

Use equivalent interface-inspection and ping tools for other guest operating systems. An application-level test, such as connecting to a test web service or database port, is also valuable because a firewall may block ICMP while allowing the application.

To verify network separation, attach one VM to lab-internal and another to a differently named network such as other-lab. Those adapters should not communicate through their Internal Network connections, even if their IP addresses appear to be in the same subnet.

VirtualBox network mode comparison

Internal Network

Guest-to-guest: yes, when adapters use the same name. Host-to-guest: no through that adapter. Physical LAN access: no by default. Internet availability: no by default. Typical use: isolated guest-only labs.

Bridged Adapter

Guest-to-guest: usually yes through the physical network. Host-to-guest: depends on the physical network and host configuration. Physical LAN access: yes, through a host physical interface. Internet availability: possible when the physical network provides it. Typical use: making a guest appear as a device on the external LAN.

Host-Only Adapter

Guest-to-guest: yes when guests use the same host-only network. Host-to-guest: normally yes. Physical LAN access: not directly through the host-only link. Internet availability: no by default. Typical use: host administration and private host-guest labs.

Internal Network can operate while the host is completely disconnected from external networks. Bridged Adapter can expose guests to the physical LAN, while Host-Only Adapter normally creates a host-accessible private network.

Isolation and multi-adapter designs

Use Internal Network when guest-only isolation is required. A common more advanced design gives a VM two adapters:

  • Adapter 1: Internal Network named lab-internal for private application or database traffic.
  • Adapter 2: NAT, Bridged Adapter, or Host-Only Adapter for controlled internet or management access.

For example, an application VM and database VM can communicate over lab-internal, while administrators use a separate management adapter. Configure routes carefully so private application traffic uses the internal interface and the intended default route uses the external or management interface.

Internal Network configuration checklist

Adapter enabled — Enable the selected adapter. — A disabled adapter cannot carry guest traffic.

Attachment mode — Set Attached to to Internal Network. — This selects the private guest-only attachment type.

Internal network name — Enter a name such as lab-internal. — The name identifies the private virtual segment.

Matching name across participating guests — Use exactly the same name on every participating adapter. — Different names create separate internal networks.

Guest IP addresses in one subnet — Assign unique, compatible addresses such as 192.168.50.10/24 and 192.168.50.11/24. — Guests need a common IP subnet for direct communication.

Connectivity test — Check interfaces, routes, ping, and the application service. — Testing confirms both network configuration and service reachability.

Troubleshoot failed communication

Two guests cannot ping each other

  • Verify both adapters use Internal Network.
  • Confirm the internal network names match exactly.
  • Confirm the adapters are enabled.
  • Check that both interfaces are up and have IP addresses.
  • Check that the addresses belong to the same subnet and are not duplicates.
  • Check guest firewall rules. A firewall may block ICMP or the application port.

A guest has no internet connection

This is normally expected. Internal Network does not provide external routing. If internet access is required, add a separate NAT, bridged, or other suitable adapter. Review the guest's routing table and ensure the intended external adapter supplies the default route.

The host cannot access a guest service

Internal Network is guest-only through that adapter, so it does not attach the host to the private segment. Use Host-Only networking when direct host-to-guest access is required, or add a separate host-accessible management adapter.

Only some VMs can communicate

  • Compare the attachment mode and network name on every participating adapter.
  • Look for duplicate IP addresses.
  • Check whether all guest interfaces are up.
  • Compare firewall rules and confirm that the tested service is listening on the expected address and port.

Exam-relevant notes

  • Internal Network traffic is contained within the host and is visible to guests on the same named internal network.
  • Internal Network does not automatically provide DHCP, DNS, a gateway, host access, LAN access, or internet access.
  • The internal network name is essential: matching names join guests to the same virtual segment.
  • Host-Only differs because it normally permits host-to-guest communication.
  • Bridged Adapter differs because it connects through a physical host interface and can expose guests to the external LAN.
  • A second adapter can provide controlled management or internet access, but it also changes routing and isolation.