Configure NAT Networking in Oracle VirtualBox
Learn how to configure NAT networking for an existing Oracle VirtualBox VM, understand DHCP and traffic flow, troubleshoot access, and use port forwarding.
Network Address Translation (NAT) is the simplest way to give an Oracle VirtualBox guest VM access to external networks. With NAT enabled, the guest uses a private virtual network managed by VirtualBox and reaches the internet through the host computer.
This lesson covers NAT behavior, guest addressing, configuration, inbound access, port forwarding, troubleshooting, and when to choose bridged or another network mode.
What NAT Networking Does
NAT stands for Network Address Translation. In VirtualBox, NAT allows a guest VM to send network traffic through the host operating system without requiring the guest to have its own address on the physical network.
The host is the physical computer running VirtualBox. The guest VM is the virtual machine and its installed operating system. A virtual network adapter is the network interface assigned to the guest.
NAT is the default VirtualBox network attachment mode because it usually works without changes to the host's physical network or to the network configuration of other devices. The guest experience is similar to connecting a computer behind a home or office router:
- The guest can normally initiate connections to external networks.
- The guest receives private network settings.
- External devices do not normally initiate connections directly to the guest.
- The guest is hidden behind the host's network connection from the perspective of remote networks.
How VirtualBox NAT Traffic Flows
When a NAT-attached guest sends traffic, the traffic follows this general path:
- The guest operating system sends a packet through its virtual network adapter.
- The packet reaches the VirtualBox NAT engine.
- The NAT engine translates the guest's TCP/IP traffic and relays it through the host operating system.
- The host sends the translated traffic to the destination network, such as a website or software repository.
- The remote network sees the traffic as originating from the host's network connection, not directly from the guest.
- When a reply returns, the NAT engine tracks the connection, translates the reply back, and delivers it to the correct guest process.
The NAT engine is the VirtualBox component that processes, translates, tracks, and relays traffic between the guest and external networks.
Guest Addressing and DHCP
A NAT-attached guest uses a private network between the guest and VirtualBox. This network is normally separate from the host's physical LAN. For example, the host might be connected to a home router using one address range while the guest receives an address from a different, VirtualBox-managed range.
VirtualBox normally provides the guest's network settings through its built-in DHCP service. DHCP, or Dynamic Host Configuration Protocol, automatically supplies settings such as:
- A private IP address
- A subnet mask
- A default gateway
- DNS settings
As a result, most guest operating systems do not need a manually configured IP address for basic NAT access.
NAT Mode Behavior at a Glance
| Capability | Behavior with NAT | Implication |
|---|---|---|
| Guest outbound internet access | Normally allowed | The guest can browse, download packages, and receive updates through the host. |
| Automatic guest addressing | Provided by VirtualBox DHCP | The guest normally receives an IP address, gateway, and DNS settings automatically. |
| Direct inbound access from the host or LAN | Blocked by default | Use port forwarding or another network mode to expose a guest service. |
| Communication between separately NAT-attached VMs | Isolated by default | Do not expect two independent NAT guests to communicate directly. |
| Guest visibility on the physical LAN | Not directly visible | Remote devices see traffic as coming from the host-side network connection. |
| Need for host network changes | Usually none | NAT is convenient for basic guest internet access. |
Outbound Connectivity and Isolation
A NAT guest can normally initiate outbound connections, including:
- Web browsing
- Operating system updates
- Package downloads
- Connections to external APIs or repositories
Default NAT is also an isolation boundary. A service running in the guest cannot normally be reached automatically from the host, another computer on the LAN, or an external network. Separately NAT-attached VMs are also isolated from one another by default.
A VM can use more than one virtual network adapter, and more than one adapter on the same VM can use NAT when separate NAT connections are useful. However, adding adapters does not by itself make independently NAT-attached VMs able to communicate.
Configure NAT for an Existing Virtual Machine
Use Oracle VM VirtualBox Manager to configure the selected VM:
- Open Oracle VM VirtualBox Manager.
- Select the target virtual machine.
- Open the VM's Settings dialog.
- Open the Network section.
- Select the adapter to configure, commonly Adapter 1.
- Enable Network Adapter.
- Set Attached to to NAT.
- Save the configuration with Apply or OK.
- Start the VM, or restart it if it was already running and the guest does not detect the change immediately.
- Confirm connectivity from inside the guest.
For a new Linux VM, the expected result is outbound internet access without requiring a separate IP address on the physical LAN. Test by opening an external website or refreshing the operating system's software repository.
Inbound Access and Port Forwarding
Outbound NAT does not automatically publish guest services. If an SSH server, web server, or other service is running inside the guest, clients cannot normally connect to it through the guest's private NAT address.
Port forwarding maps a port on the host to a service port on the NAT guest. A typical rule might map an unused host TCP port to guest TCP port 22 for SSH, or to guest TCP port 80 for HTTP.
| Setting | Example | Purpose |
|---|---|---|
| Protocol | TCP | Matches the protocol used by the guest service. |
| Host port | 2222 | An unused port on the host that clients connect to. |
| Guest port | 22 | The port on which the guest SSH service listens. |
| Host IP | Optional | Restricts listening to a specific host interface when needed. |
| Guest IP | Usually optional | Can be omitted when the guest address is assigned dynamically. |
After creating a rule from host TCP port 2222 to guest TCP port 22, a permitted client connects to the host address and port 2222. VirtualBox forwards the connection to the guest SSH service. The guest service must be running and its firewall must allow the connection.
NAT and Bridged Networking Comparison
| Characteristic | NAT | Bridged Networking |
|---|---|---|
| External connectivity | Guest reaches external networks through the host. | Guest connects more directly to the physical network. |
| Physical LAN visibility | Guest is normally hidden behind the host. | Guest can appear as a separate device on the LAN. |
| Inbound reachability | Requires port forwarding or another adapter. | Can be reachable directly if LAN and guest firewall rules permit it. |
| Typical use case | Simple internet access and isolated lab work. | Testing a VM that must behave like a physical LAN device. |
| Address assignment source | Normally VirtualBox's built-in DHCP service. | Usually the physical LAN's DHCP service or a static LAN configuration. |
| Isolation level | Higher default isolation from the physical LAN and inbound clients. | Less isolation because the guest participates more directly in the physical network. |
Choose bridged networking when the VM must appear as a directly reachable device on the physical LAN. Choose a network configuration intended for multi-guest communication when several VMs must communicate with one another. For example, an additional adapter can retain NAT for internet access while using another network for a lab connection.
When NAT Is Not the Best Choice
- Use bridged networking when other physical LAN devices must reach the VM directly.
- Use a host-only network when the main requirement is communication between the host and guest.
- Use an internal network when multiple guests need an isolated network without direct host or internet access.
- Use multiple adapters when the VM needs both NAT internet access and a separate lab or host-accessible network.
See VirtualBox network modes for a broader comparison, or review host-only networking and internal networking for isolated communication designs.
Troubleshoot NAT Connectivity
The guest has no network connection
- Confirm that the selected virtual adapter is enabled.
- Confirm that Attached to is set to NAT.
- Verify that the guest operating system recognizes and enables its network interface.
- Check that the guest obtained an IP address, default route, and DNS settings through DHCP.
- Restart the guest network interface or reboot the VM after changing adapter settings.
- Check whether the host itself has working network access.
The guest has internet access, but another computer cannot reach its service
- Recognize that this is expected with default NAT behavior.
- Confirm that an appropriate port-forwarding rule exists.
- Confirm that the guest service is running and listening on the intended port.
- Check the guest firewall and host firewall.
- Connect to the host address and forwarded host port, not the guest's private NAT address.
Two NAT VMs cannot communicate
- Independently NAT-attached guests are isolated by default.
- Use a network mode designed for guest-to-guest communication when required.
- Consider retaining NAT for internet access while adding a second adapter for an internal or host-accessible network.
The guest receives an address but cannot resolve host names
- Distinguish a DNS failure from a general connectivity failure.
- Inspect the DNS settings received through DHCP.
- Test reachability to an IP address and then test a domain name.
- Review host connectivity and local firewall, VPN, proxy, or security software that may affect VirtualBox traffic.
Key Points
- NAT translates guest traffic through the host, much like a device behind a home router.
- VirtualBox normally provides the guest's private address and network settings through DHCP.
- NAT is well suited to outbound internet access with default inbound isolation.
- Separate NAT-attached VMs should not be expected to communicate directly.
- Port forwarding exposes a selected guest service through a host port.
- Use bridged, host-only, internal, or multiple-adapter configurations when the lab requires direct or guest-to-guest communication.
For related fundamentals, review VirtualBox virtual networking and the Oracle VirtualBox online course.