Oracle Virtualbox

Oracle VirtualBox Network Modes

Learn how VirtualBox NAT, NAT Network, Host-only, Bridged, Internal Network, and advanced modes work, with setup examples and troubleshooting guidance.

VirtualBox network modes determine how a virtual machine's network adapter connects to other systems. The correct choice depends on whether the guest needs internet access, host access, guest-to-guest communication, visibility on the physical LAN, or complete isolation.

In this lesson, host means the physical computer and its operating system. Guest means the operating system running inside the virtual machine (VM). An attachment mode is the VirtualBox setting that determines how a VM's virtual network adapter connects to a network.

Virtual network adapter fundamentals

Each VM can have one or more virtual network adapters. You select the attachment mode for each adapter in the VM's Settings > Network page. A virtual adapter belongs to the guest, while a physical Ethernet or Wi-Fi adapter belongs to the host. The guest interface is software-defined; it is not the same device as the host's physical network adapter.

Multiple adapters can operate at the same time. For example, one adapter can use NAT for internet access while a second uses Host-only networking for private management. In that design, the guest has one interface for outbound updates and another interface for communication with the host or lab VMs.

The attachment mode does not always configure the guest operating system completely. Depending on the mode, the guest may need DHCP enabled or a manually assigned static IP address, subnet mask, default gateway, and DNS servers. The guest firewall must also permit the traffic you expect.

VirtualBox network modes at a glance

Not Attached mode

With Not Attached, the guest still sees a network adapter, but the adapter has no active network connection. The effect is similar to unplugging an Ethernet cable.

No traffic can pass through that adapter until you change its attachment mode or connect its virtual cable. This mode is useful when testing how an application behaves without a network, or when temporarily disabling connectivity without removing the adapter configuration.

NAT mode

NAT means Network Address Translation. It is commonly the default attachment mode for a new VM. VirtualBox places the guest behind a virtual NAT service, allowing the guest to initiate connections through the host's network connection.

A NAT guest can normally browse the web, install packages, download updates, and connect to LAN or internet resources outbound. The guest's address is translated, so the guest is normally not visible as a separate peer on the physical LAN. NAT typically requires little host-side setup and commonly provides guest DHCP.

Unsolicited inbound connections from the host, LAN, or internet do not normally reach a NAT guest. To publish a guest service, configure port forwarding: a rule that maps a host port to a port on the guest.

NAT port forwarding example

Suppose a web service listens on guest TCP port 80. A rule can map host TCP port 8080 to that service. If the rule binds to 127.0.0.1, the host can test it at http://127.0.0.1:8080, but other LAN devices cannot use that loopback address.

VBoxManage modifyvm "LabVM" --nic1 nat
VBoxManage modifyvm "LabVM" --natpf1 "ssh,tcp,127.0.0.1,2222,,22"
ssh -p 2222 user@127.0.0.1

In the SSH example, host port 2222 is forwarded to guest port 22. The service must be running, listening on the expected address, and allowed by the guest firewall. A host port must not already be in use.

NAT Network mode

A NAT Network is a shared virtual NAT segment. Multiple VMs can join the same named NAT Network, communicate with one another on its private subnet, and initiate outbound connections through NAT.

Unlike ordinary per-VM NAT, where separate VMs are generally isolated from one another by default, NAT Network provides a shared segment. Its configuration includes a subnet, an optional DHCP service, and optional port forwarding rules.

VBoxManage natnetwork add --netname "LabNAT" --network "10.10.20.0/24" --enable --dhcp on
VBoxManage modifyvm "Client1" --nic1 natnetwork --nat-network1 "LabNAT"
VBoxManage modifyvm "Client2" --nic1 natnetwork --nat-network1 "LabNAT"

Choose a subnet that does not overlap with networks used by the host or the surrounding environment. NAT Network is useful for application stacks, client-server exercises, and multi-VM test environments that need both private inter-VM traffic and outbound updates.

Host-only networking

Host-only networking creates a virtual network interface on the host. The host and attached VMs share a private network through that interface. Guests can communicate with the host and with other guests connected to the same Host-only network.

Host-only networking does not provide direct external-network or internet access by itself. VirtualBox may provide a DHCP service for the Host-only network, or you can assign static addresses. This mode is appropriate for SSH administration, testing a development server from the host, and private multi-VM labs.

VBoxManage hostonlyif create
VBoxManage modifyvm "LabVM" --nic2 hostonly --hostonlyadapter2 "vboxnet0"

A common design uses two adapters: NAT for outbound internet access and Host-only for private management. The host connects to the guest's Host-only address, while the guest uses its NAT interface for updates.

Bridged Adapter networking

Bridged Adapter connects the guest to a selected physical or host network interface. The guest appears as a separate device on the same LAN as the host. It normally obtains an address from the same DHCP server as other LAN devices, or it uses a valid static address for that LAN.

A bridged guest can communicate with the host, other LAN systems, and external networks, subject to normal routing, firewall, authentication, and organizational policies. This is the usual choice when other devices must reach a guest web server, API, or test service using the guest's LAN IP address.

VBoxManage list bridgedifs
VBoxManage modifyvm "LabVM" --nic1 bridged --bridgeadapter1 "en0"

Select the correct active adapter, such as wired Ethernet or Wi-Fi. Bridging may be affected by enterprise Wi-Fi restrictions, captive portals, VPN software, wireless adapter limitations, MAC-address controls, DHCP limits, 802.1X, and other network policies. Wired Ethernet is often a useful comparison test when wireless bridging fails.

Internal Network mode

Internal Network creates an isolated virtual Layer 2 network available only to VMs on the same host that use the same internal network name. The host and external networks cannot access it by default.

VirtualBox does not inherently provide a DHCP server for an Internal Network. Configure static guest addresses, or deploy a DHCP-capable guest such as a router or server. Every VM intended to communicate must use the identical internal network name.

VBoxManage modifyvm "RouterVM" --nic1 intnet --intnet1 "isolated-lab"
VBoxManage modifyvm "ClientVM" --nic1 intnet --intnet1 "isolated-lab"

Internal Network is useful for client-server labs, isolated routing and firewall exercises, and controlled security simulations where organizational policy permits. It differs from Host-only networking because Host-only includes the host by default, while Internal Network excludes the host.

Generic networking and advanced backends

Generic Driver is an advanced attachment category rather than a normal beginner configuration.

UDP Tunnel links VM network segments across different physical hosts by transporting virtual network traffic through an existing IP network. Each side has local and remote UDP endpoints, and the tunnel peers must use matching configuration. The existing IP path must permit the selected UDP traffic.

VDE, or Virtual Distributed Ethernet, connects a VM to a VDE switch on supported host systems. VDE support may require a VirtualBox build or installation with the necessary feature and host-side VDE components, particularly on Linux or FreeBSD.

UDP Tunnel and VDE are specialized distributed or virtual-switching options. They should not be confused with the ordinary VM-only behavior of Internal Network.

Choosing the right mode

Use NAT for simple outbound connectivity. Use NAT with port forwarding when only the host needs a guest service. Use Host-only for host-managed private networks, Bridged Adapter when the guest must be a visible LAN device, Internal Network for VM-only isolation, and NAT Network for multiple guests that need a shared private segment plus outbound access.

When one mode cannot satisfy all communication paths, use multiple adapters. A server VM with NAT and Host-only networking is a common example: NAT supplies updates, while Host-only supplies private administration.

Configuration and verification workflow

1. Power off the VM when required, then open VirtualBox Manager, select the VM, and open Settings > Network.
2. Choose the adapter tab, enable the adapter, select the attachment mode, and select the correct host adapter or virtual network name when the mode requires one.
3. Check Cable Connected. A selected mode with a disconnected virtual cable behaves like an unplugged cable.
4. Start the guest and verify that its interface is enabled and has an appropriate DHCP or static configuration.
5. Check the guest IP address, subnet mask, default gateway, DNS settings, and firewall rules.
6. Test connectivity from narrowest to broadest scope: loopback, interface status, peer or host, gateway, DNS, and internet access.

# Common Linux guest checks
ip addr
ip route
ping -c 3 <gateway-ip>
ping -c 3 <peer-or-host-ip>
nslookup example.com

# Common Windows equivalents
ipconfig
route print
ping <gateway-ip>
ping <peer-or-host-ip>
nslookup example.com

Interpret test results carefully. A successful ping to an IP address followed by a failed DNS lookup usually indicates a DNS problem, not a failed attachment. ICMP ping may be blocked by a firewall, so test the actual service as well, such as an HTTP request or an SSH connection.

Troubleshooting common problems

NAT guest cannot browse the web

• Confirm the adapter is enabled, set to NAT, and cable-connected.
• Check for a guest IP address and default route.
• Test a known IP separately from a DNS name.
• Check host connectivity, VPN behavior, host security software, and guest firewall rules.

Likely causes include failed guest DHCP, a missing route, incorrect DNS, no working host connection, or local security software interference.

Host cannot reach a NAT guest service

• Confirm the service listens on the expected guest port and the guest firewall permits it.
• Verify the port-forwarding rule and its protocol.
• Check that the host port is not already in use.
• Test using the configured host IP and port.

Bridged guest receives no LAN address

• Verify that the correct active physical interface is selected.
• Renew DHCP or test a valid static LAN configuration.
• Try wired Ethernet if wireless bridging is unreliable.
• Check DHCP capacity, MAC filtering, 802.1X, captive portals, and organizational policy.

Host-only guest cannot reach the internet

This is expected for Host-only networking alone. Add a NAT adapter or configure deliberate routing through another VM. Verify the Host-only subnet and the host's virtual interface for private communication.

Internal Network VMs cannot communicate

• Ensure every intended adapter uses Internal Network with exactly the same name.
• Check static addresses, subnet masks, interface status, and guest firewalls.
• Do not expect the host to join the segment directly.
• Remember that the segment has no inherent DHCP service.

Forwarding works on the host but not from another LAN device

Inspect the host IP binding. A rule bound to 127.0.0.1 intentionally accepts only local host connections. Check the host firewall and LAN policy. If the service should be a normal LAN device, Bridged Adapter may be a better topology.

Security and network exposure

NAT and isolated modes generally reduce exposure compared with Bridged Adapter because the guest is not automatically a peer on the physical LAN. Bridged networking can expose guest services to other permitted LAN devices, so treat the guest like another computer on that network.

Port forwarding intentionally exposes selected NAT guest services to the host or to another address, depending on the host binding. Use guest firewalls, strong credentials, minimized exposed services, current software, and the network policies required by your organization.

Practical topologies

• Package updates: one Linux VM with NAT.
• Host browser to guest application: NAT with host TCP port 8080 forwarded to guest TCP port 80 or 8080.
• Two test VMs with internet and peer communication: both attached to the same NAT Network.
• Private SSH administration: Host-only Adapter with an address on the Host-only subnet.
• Home-LAN web server: Bridged Adapter using the active Ethernet or Wi-Fi interface.
• Isolated router lab: router and clients on the same named Internal Network, with static addressing or DHCP supplied by the router VM.
• Private management and updates: Host-only plus NAT.
• Distributed lab: Generic Driver with UDP Tunnel and matching tunnel peers.

For related configuration procedures, see Configure Bridged Networks, Configure Host Only Networks, Configure Internal Networking, Configure Nat Networks, and Virtual Networking.