VMware ESXi and vSphere Cluster Management

Oracle VirtualBox Network Modes Explained

Learn how VirtualBox NAT, Host-only, Bridged, Internal Networking, UDP Tunnel, VDE, and Not Attached modes control guest connectivity and isolation.

A VirtualBox virtual machine (VM) can have one or more virtual network adapters. A virtual network adapter is an emulated network interface card (NIC) presented to the operating system inside the VM. VirtualBox determines how that adapter connects by using an attachment mode, also called a network mode.

The selected mode controls whether the guest can reach the host computer, other local guests, the physical LAN, and external networks such as the internet. The host is the physical computer and operating system running VirtualBox. The guest is the operating system running inside the VM.

Two separate conditions are important: the adapter can be enabled and visible inside the guest, while its virtual link can still be disconnected. For example, Not Attached leaves the virtual NIC present but makes it behave like an Ethernet port with no cable connected.

VirtualBox network modes at a glance

Configure an adapter before choosing a mode

1. Open the VM's network settings in VirtualBox.
2. Select the adapter number you want to configure.
3. Enable the adapter if the guest should see a network card.
4. Choose the required attachment mode.
5. Apply any mode-specific setting, such as a physical adapter, host-only interface, or internal-network name.
6. Start or restart the guest networking service if the guest does not detect the change automatically.

Several modes can be combined by enabling multiple virtual adapters. For example, a guest can use Host-only for private administration and a second adapter using NAT for outbound updates.

Not Attached mode

In Not Attached mode, the guest detects the virtual NIC, but VirtualBox reports the link as disconnected. The physical analogy is an Ethernet interface with no cable plugged into it.

This differs from disabling the adapter in VM settings. With Not Attached, the adapter remains installed and visible to the guest, which is useful when testing how software reacts to link loss or when temporarily disabling connectivity without removing the virtual hardware.

When to use Not Attached

• Test an offline or disconnected state.
• Temporarily prevent all network traffic while retaining the installed NIC.
• Diagnose whether an application requires an active link.
• Preserve a guest's network-device configuration for later use.

NAT: straightforward outbound connectivity

NAT means Network Address Translation. VirtualBox gives the guest a private network identity and translates its outbound traffic so it can use the host's network connection. The guest is not normally presented as a direct peer on the physical LAN.

NAT generally works without initial host-side network configuration or special guest-side setup. It is a good choice for a desktop Linux VM that needs web access, software updates, DNS lookups, or other ordinary outbound connections.

NAT's inbound limitation

Default NAT allows the guest to initiate connections outward, but systems outside the guest cannot automatically initiate connections to services running inside it. A web server or SSH server in a NAT guest is therefore hidden unless a forwarding rule is added.

Port forwarding is a NAT rule that maps a port on the host to a port exposed by a service in the guest. For example, host port 8080 can forward TCP traffic to port 80 in the guest.

Configure NAT port forwarding

1. Choose NAT as the VM adapter's attachment mode.
2. Open the adapter's port-forwarding settings.
3. Create a rule with a name and protocol, usually TCP or UDP.
4. Set a host port that clients will contact.
5. Set the guest port on which the service listens. Add a guest IP when the configuration requires a specific guest address.
6. Ensure that the service is running and that the guest firewall permits the selected port.

With this example, a client connecting to the selected host address on TCP port 8080 is forwarded to the guest's web service on TCP port 80. The exact guest address depends on the guest's NAT configuration.

Host-only networking

Host-only networking creates a virtual interface on the host. Guests attached to the same host-only network can communicate with that host interface and with one another. This creates a private network shared by the host and selected local VMs.

Host-only networking does not directly provide access to external networks. A host-only guest can reach the host and peer guests on that segment, but it cannot normally browse the internet through that adapter alone.

Typical Host-only uses

• Access a development web application from the host without exposing it to the office LAN.
• Administer a guest using SSH, remote desktop, or another private management service.
• Build a multi-VM lab where the host and guests need private communication.
• Keep test services away from the physical LAN.

If a lab needs both private administration and internet access, add a second adapter using NAT. Give each adapter a distinct role and configure the guest's routing carefully.

Bridged networking

Bridged networking connects the guest through a selected physical adapter on the host, such as an Ethernet or wireless interface. A VirtualBox virtual interface and filtering mechanism passes guest traffic to the physical adapter, allowing the guest to behave as a participant on the surrounding network.

A correctly configured bridged guest can communicate with the host, other LAN devices, compatible VMs, and external networks, subject to ordinary LAN rules, firewalls, and access controls. Services hosted in the guest can therefore be visible to other devices on the physical network.

Configure Bridged networking

1. Choose Bridged networking as the attachment mode.
2. Select the host's active physical adapter, not an unused Ethernet, wireless, VPN, or disconnected interface.
3. Start the guest and configure its network for DHCP or a suitable static address.
4. Confirm that the address belongs to the correct LAN subnet and that the gateway and DNS settings are usable.

DHCP commonly supplies a bridged guest with an IP address, subnet information, gateway, and DNS settings. Some wireless networks, enterprise access points, or security policies restrict additional MAC addresses or bridged guests, so successful bridging depends on the physical network as well as VirtualBox.

When Bridged networking is appropriate

• Test a service as though it were another computer on the LAN.
• Allow other LAN devices to reach a guest-hosted web, SSH, or application service.
• Build network simulations involving real LAN participants.
• Give a server guest direct visibility on a controlled network.

Internal Networking

Internal Networking connects VMs through a private virtual network that exists on the same physical host. It supports communication among appropriately connected local guests while preventing direct access to the host, the physical LAN, and external networks through that segment.

Every VM that should share the segment must use the same internal-network name. For example, attach both a client VM and a database VM to an internal network named training-net. A VM attached to other-net is on a different isolated segment even though both segments are hosted by the same computer.

Unlike Host-only networking, Internal Networking does not include the host by default. Unlike Bridged networking, it does not place the guests directly on the physical LAN.

Typical Internal Networking uses

• Secure client-server exercises.
• Malware-analysis or defensive-security labs that must remain isolated.
• Router, firewall, and network-segmentation simulations.
• Multi-VM training environments with manually assigned private addresses.

Internal Networking does not automatically solve IP addressing. Configure compatible static addresses or provide DHCP through a lab service running on one of the guests.

UDP Tunnel sub-mode

UDP Tunnel is an Internal Networking option for connecting guests hosted on separate physical computers. It carries the virtual interconnection over existing network infrastructure while presenting the guests with a direct, transparent virtual link.

Each tunnel endpoint needs information about the other endpoint's host address and UDP port. The two sides must use mutually compatible settings, and firewalls or intermediate networks must permit the selected UDP traffic.

High-level UDP Tunnel setup

1. Choose UDP Tunnel for the relevant VM adapter.
2. Configure each physical host with the remote host's address and the corresponding UDP port.
3. Use compatible endpoint settings on both sides.
4. Verify host-to-host reachability and allow the required UDP traffic.
5. Configure the guests with compatible addresses for the virtual segment.

UDP Tunnel is useful when two VMs on different machines must act as though they share an internal lab network, without placing either guest directly on the physical LAN.

VDE networking

VDE means Virtual Distributed Ethernet. VDE networking connects a VM to a VDE switch rather than using one of the simpler local VirtualBox network segments.

This option is intended for Linux or FreeBSD hosts and may require a VirtualBox build compiled with VDE support. A standard installation may not include that capability. VDE is preferable when an advanced virtual-switch environment already provides the switching, topology, or integration needed by the lab.

Prepare VDE networking

1. Use a supported Linux or FreeBSD host environment.
2. Confirm that the installed VirtualBox build includes VDE support.
3. Ensure that the intended VDE switch exists and is accessible.
4. Connect the VM adapter to that VDE switch.
5. Configure guest addressing according to the VDE topology.

Choosing a mode for a use case

A practical decision process

1. Decide whether the guest should have any active link. If not, choose Not Attached.
2. If the guest only needs outbound internet access, start with NAT.
3. If the host and local guests need private access, choose Host-only.
4. If other physical LAN devices must discover or use a guest service, choose Bridged networking.
5. If only local VMs should communicate, choose Internal Networking and assign a shared network name.
6. If the private VM segment must cross physical hosts, evaluate UDP Tunnel.
7. If the lab already uses a VDE switching fabric, use VDE networking when the host and VirtualBox build support it.

Troubleshooting common problems

The guest sees an adapter but has no link

Check whether the adapter is set to Not Attached and whether the adapter is enabled in the VM settings. The guest can display an installed NIC even when VirtualBox has not connected it to a network.

NAT works outward but inbound access fails

Default NAT does not automatically expose guest services. Add a port-forwarding rule, verify its protocol and host and guest ports, confirm that the service listens inside the guest, and check the guest firewall.

Host-only networking cannot reach the internet

This is expected behavior for a Host-only adapter. Use NAT or Bridged networking for external access. For a deliberate combination, add a second adapter using NAT alongside the Host-only adapter.

Bridged networking receives no address

Verify that the selected physical adapter is the host's active Ethernet or wireless connection. Check guest DHCP status and IP configuration, and confirm that the physical network permits additional bridged clients or MAC addresses.

Internal guests cannot communicate

Confirm that every participating adapter uses the identical internal-network name. Then check that guest IP addresses and subnet masks are compatible and that guest firewalls permit the test traffic.

UDP Tunnel peers cannot exchange traffic

Compare both endpoint configurations, including remote host addresses and UDP ports. Test host-to-host reachability, inspect firewalls, and allow the selected UDP traffic through the underlying network.

The VDE option is unavailable

Confirm that the host is Linux or FreeBSD and that the installed VirtualBox build includes VDE support. If either condition is false, use a simpler supported mode or an installation with the required capability.

Exam-relevant distinctions

• NAT provides convenient outbound connectivity but normally requires port forwarding for inbound access to guest services.
• Host-only includes the host and compatible local guests but does not directly reach external networks.
• Internal Networking connects compatible local guests while excluding the host and external networks by default.
• Bridged networking attaches the guest to a selected physical host adapter so it can participate on the physical LAN.
• Not Attached leaves the virtual NIC present but disconnected.
• UDP Tunnel extends an internal guest connection between separate physical hosts using UDP.
• VDE connects a guest to a Virtual Distributed Ethernet switch and requires suitable host and VirtualBox support.

For a broader review, return to VirtualBox network modes and compare the connectivity boundaries before configuring each VM.