VMware ESXi and vSphere Cluster Management

Configure NAT Networking for Virtual Machines in Oracle VirtualBox

Learn how to enable VirtualBox NAT networking, verify DHCP and DNS, configure port forwarding, use multiple adapters, and troubleshoot guest connectivity.

What NAT Networking Does

Network Address Translation (NAT) is a mechanism that translates private guest traffic so it can use the host's network connection for outbound communication. The host is the physical computer and operating system running VirtualBox. The guest VM is the operating system running inside a virtual machine.

NAT is the standard attachment mode commonly used when a VM needs simple outbound internet access. A NAT guest can usually browse the web, download operating-system updates, and contact external services without changes to the physical LAN configuration.

With NAT enabled, a guest is not normally placed directly on the same physical network as the host. Instead, VirtualBox gives the guest a private virtual network and handles traffic between that network and the host's network connection.

How VirtualBox NAT Traffic Flows

A virtual network adapter is a configurable virtual network interface assigned to a VM. When that adapter uses NAT, traffic follows this general path:

The guest creates a TCP or UDP packet for an external destination.
The packet travels through the guest's virtual network adapter to the VirtualBox NAT engine.
The NAT engine translates the guest's private source address and source port into an address and port usable through the host's network connection.
The host sends the translated packet to the local router or another external network.
The remote system sees the connection as originating from the host's network identity, not as a directly routable connection from the guest's private address.
When reply traffic arrives, the NAT engine uses its connection-state mapping to associate the reply with the original guest connection and delivers it to the correct VM.

TCP is a connection-oriented transport protocol commonly used by SSH, HTTP, and HTTPS. UDP is a datagram transport protocol used by DNS and many other application protocols. For both protocols, NAT must track enough connection information to translate outgoing traffic and return replies correctly.

The translation process is why several guests can use private addresses while sharing the host's external network connection. The remote network generally cannot start a new, unsolicited connection to a guest because there is no existing translation entry for that traffic.

Guest Addressing, DHCP, Gateway, and DNS

When NAT is used, VirtualBox normally provides private guest-side network configuration through its built-in DHCP service. DHCP automatically supplies an IP address, subnet information, default gateway, and often DNS settings.

A private IP address is used inside a local or virtual network and is not directly routable on the public internet. The guest's private address normally belongs to a subnet different from the host's physical-network address.

The guest should normally use automatic or DHCP addressing. Manually choosing an address is appropriate only when a specific network design requires it and the address matches the virtual network's subnet.

A default gateway is the next-hop address used to reach destinations outside the guest's local subnet. DNS translates names such as example.com into IP addresses. A guest can have a valid IP address but still fail to browse if its route or DNS configuration is missing.

Check a Linux Guest

ip addr
ip route
ping -c 3 <gateway-or-known-IP>
getent hosts example.com
curl -I https://example.com
ss -lntup

Use ip addr to find the assigned address and interface state. Use ip route to check for a default route. The name lookup command checks DNS, while curl tests an application request over HTTPS. The ss command shows listening TCP and UDP services when diagnosing inbound access.

Check a Windows Guest

ipconfig /all
route print
ping <gateway-or-known-IP>
nslookup example.com
Test-NetConnection example.com -Port 443
netstat -ano

ipconfig /all displays the address, gateway, DHCP, and DNS information. route print shows routes, and Test-NetConnection tests a TCP connection to a destination port.

Enable NAT on an Existing VM

Open Oracle VM VirtualBox Manager.
Select the target VM. Shut it down first if the settings cannot be changed while it is running.
Open Settings, then select Network.
Select an available adapter, such as Adapter 1.
Enable Enable Network Adapter.
Set Attached to to NAT.
Save the configuration.
Start or restart the VM as needed.
Inside the guest, confirm that the interface is enabled and configured for DHCP.
Test the gateway, an IP address, DNS resolution, and an application request.

For a basic Linux VM, the expected result is an automatically assigned private address, a default route through the VirtualBox NAT gateway, successful name resolution, and a successful HTTPS request.

Isolation and Reachability

NAT-mode guests are not directly reachable from external devices by default. A remote system cannot normally initiate an unsolicited connection to a guest service simply because that service is listening.

Outbound connections initiated by the guest are different. When the guest starts a connection, the NAT engine creates state for it and permits matching reply traffic to return. This permits web browsing and updates while reducing unsolicited inbound exposure.

Ordinary NAT adapters also generally use isolated per-VM NAT environments. Two VMs using ordinary NAT may both reach outward but cannot necessarily communicate directly with each other. Use a NAT Network, Host-Only Adapter, or Internal Network when guest-to-guest communication is required.

Using Multiple Virtual Network Adapters

A VM can have more than one virtual NIC. A common lab design uses:

Adapter 1: NAT for package updates and general outbound internet access.
Adapter 2: Host-Only Adapter or Internal Network for private communication with the host or other lab VMs.

In this design, the NAT adapter should normally supply the default route. The private adapter should carry traffic intended for the lab subnet. The guest's routing order, default gateways, and interface metrics determine which interface handles a destination.

Avoid assigning competing default gateways on multiple adapters unless you understand the resulting routing table. Competing defaults can cause asymmetric paths, intermittent connectivity, or traffic to leave through the wrong interface.

Two-Adapter Lab Example

Set Adapter 1 to NAT and leave the guest configured for DHCP.
Set Adapter 2 to Host-Only Adapter or Internal Network.
Boot the guest and verify that the NAT interface has the default route.
Verify that the second interface has an address on the private lab network.
Test external access through the NAT interface and private lab traffic through the second interface.

Port Forwarding for Inbound Access

Port forwarding is a rule that maps a connection arriving at a host port to a service port in the NAT guest. It is required when a service inside a NAT guest must be reached from the host or another permitted source.

For example, an SSH rule can map TCP port 2222 on the host to TCP port 22 in the guest. A web-development rule can map host port 8080 to guest port 80, or host port 8000 to guest port 8000.

Create a Forwarding Rule

Power off the VM if necessary and open its Settings.
Go to Network, select the NAT adapter, and open Advanced.
Open Port Forwarding.
Add a rule with a name, protocol, host address and port, and guest address and port.
Save the rule, start the VM, and confirm that the guest service is listening.
Test the service through the host address and mapped host port.

Field	Purpose	Example Value	Common Mistake
Rule name	Identifies the mapping	SSH to guest	Using a confusing or duplicate name
Protocol	Selects the transport protocol	TCP	Choosing UDP for an SSH or HTTP service
Host IP	Limits which host address accepts the connection	127.0.0.1	Binding to an address that is not present or exposing it more widely than intended
Host port	Port a client contacts on the host	2222 or 8080	Choosing a port already used by another application
Guest IP	Optional destination address inside the guest	Guest private address	Using a stale address when the guest address changes
Guest port	Port where the guest service listens	22, 80, or 8000	Confusing the guest service port with the host port

If the host IP is set to 127.0.0.1, the service is reachable through the host itself, but not normally through other LAN devices. Leaving the host address unspecified can listen on more host interfaces, which may increase exposure. A host port must be unused, and overlapping rules can send connections to the wrong service or prevent the rule from being created.

SSH Example

Ensure the SSH server is running in the guest and listening on port 22.
Permit SSH through the guest firewall if the firewall is enabled.
Create a TCP rule from host port 2222 to guest port 22.
From the host, connect with:

ssh -p 2222 <guest-user>@127.0.0.1

Development Web-Service Example

Start the web application in the guest and confirm its listening port.
Forward host port 8080 to guest port 80, or forward host port 8000 to guest port 8000.
Open the service through the host loopback address:

curl http://127.0.0.1:8080

Some development servers bind only to the guest loopback address, such as 127.0.0.1. Such a service may not accept traffic arriving through the guest's virtual adapter. Configure the application to listen on the appropriate guest interface when needed, while restricting exposure to the intended host address and port.

NAT Compared with Other VirtualBox Attachment Modes

Mode	Outbound Internet Access	Reachable from Host/LAN by Default	Guest-to-Guest Communication	Typical Use Case
NAT	Usually yes through the host	Not directly; port forwarding is needed	Generally isolated between ordinary NAT adapters	Simple outbound access for one VM
NAT Network	Yes through a shared NAT network	Not directly by default; forwarding can be configured	Yes, for VMs attached to the same NAT Network	Several VMs that need private communication and outbound access
Bridged Adapter	Usually yes through the physical LAN	Often yes, as a peer on the LAN	Usually through the physical network	A VM that must appear as another device on the physical network
Host-Only Adapter	Not by itself	Host-to-guest access is supported	Usually, for guests on the same host-only network	Private host and lab communication
Internal Network	Not by itself	Not directly from the host or physical LAN	Yes, for VMs on the same named internal network	Fully isolated multi-VM labs

Choose NAT when outbound access is the main requirement and inbound access should be restricted. Choose Bridged Adapter when the VM must be visible as a peer on the physical LAN. Choose NAT Network when multiple VMs need to communicate with one another while retaining NAT access outward. Choose Host-Only Adapter for host-to-guest labs, or Internal Network for guest-only isolated networks.

When to Use a NAT Network

A NAT Network is a shared VirtualBox NAT-based virtual network. Unlike ordinary per-VM NAT, it is intended to allow multiple participating VMs to communicate on the same virtual network while retaining outbound NAT access.

Create or select a shared NAT Network in VirtualBox's network management settings.
Attach both VMs to that NAT Network instead of attaching each one to ordinary NAT.
Allow both guests to obtain addresses through DHCP, unless a deliberate static design is being used.
Test each VM's private address, mutual reachability, and external connectivity.

This design is useful for a two-VM application and database lab, where the guests need to communicate privately but do not need to appear on the physical LAN.

Validation: Test Connectivity in Layers

Test	What It Confirms	Failure Suggests
Adapter state	The VM has an enabled virtual adapter attached to the intended mode	VirtualBox configuration or guest interface problem
DHCP address assignment	The guest received an address and local network settings	Disabled interface, DHCP failure, or wrong attachment
Default route	The guest knows where to send traffic outside its subnet	Missing gateway or incorrect routing
IP connectivity	Packets can reach a gateway or known IP address	Virtual network, host connectivity, firewall, or routing problem
DNS lookup	Names can be translated into IP addresses	Incorrect or unreachable DNS configuration
Application connection	The destination service and protocol are working	Service outage, application firewall, proxy, or port policy
Forwarded-port connection	A host-to-guest mapping reaches the intended service	Missing rule, wrong port, collision, service listener, or guest firewall

Follow this order rather than starting with a browser. First check the VirtualBox adapter. Then check the guest address and route, test an IP address, test DNS, and finally test an application. For an inbound service, separately verify the guest listener, forwarding rule, host port, and guest firewall.

Troubleshooting NAT Connectivity

The Guest Has No Network Connectivity

Check that Enable Network Adapter is selected.
Confirm the adapter is attached to NAT rather than an unintended isolated mode.
Check that the guest interface is enabled and configured for DHCP.
Confirm that the host itself can reach the intended network.
After correcting the configuration, restart the guest network connection or reboot the VM if necessary.

The Guest Has an IP Address but Cannot Reach External Addresses

Inspect the routing table and confirm a default route exists.
Test a known public IP address before testing a domain name.
Compare the guest's behavior with the host's connectivity.
Review host firewall software, VPN clients, endpoint security, and network policies, since they can affect VirtualBox NAT traffic.

IP Tests Work but Domain Names Fail

Inspect the DNS servers supplied by DHCP.
Run getent hosts example.com or nslookup example.com.
Check whether the configured resolver is reachable and whether guest security policy blocks DNS.
Renew the DHCP configuration if DNS should be supplied automatically.

The Host Cannot Connect to a NAT Guest Service

Confirm that a port-forwarding rule exists.
Check the protocol and guest port in the rule.
Confirm that the host port is not already in use.
Use the host loopback address and mapped port for a host-only test.
Verify that the service is listening in the guest and that its firewall permits the connection.

Two NAT VMs Cannot Communicate

Ordinary NAT adapters generally provide separate NAT environments. Confirm the attachment modes, then use a shared NAT Network when the VMs need NAT-based mutual communication. Alternatively, add a Host-Only Adapter or Internal Network for private VM-to-VM traffic.

A Forwarding Rule Cannot Be Saved or Reaches the Wrong Service

Choose a different unused host port if another application is already listening there.
Review existing rules for overlap.
Check whether the selected host IP restricts the listener unexpectedly.
Confirm that the guest service is listening on the expected address and port.

Exam-Relevant Summary

NAT translates private guest traffic so the guest can initiate outbound connections through the host.
VirtualBox NAT normally supplies guest addressing through DHCP.
The guest's private address, default gateway, and DNS settings are separate from the host's physical-network configuration.
NAT does not normally allow unsolicited inbound connections to the guest.
Port forwarding maps a host listening port to a guest service port.
Ordinary NAT adapters generally isolate guests from one another; NAT Network provides shared guest communication with outbound NAT access.
Bridged Adapter makes the VM more like a peer on the physical LAN.
Host-Only Adapter and Internal Network are intended for private or isolated lab communication.
NAT improves isolation but does not replace guest firewalls, patching, or access controls.

For related configuration guidance, see Configure NAT Networks.