VMware ESXi and vSphere Cluster Management

Configure NAT Networking in VMware Workstation Player

Learn how to configure VMware Workstation Player NAT networking, verify guest IP and DNS settings, troubleshoot connectivity, and understand port forwarding limitations.

NAT, or Network Address Translation, lets a virtual machine use the host computer’s network connection without joining the physical network as a separate device. This is useful for Windows and Linux guests that need internet or outbound LAN access while keeping their private virtual addresses hidden from the physical network.

This lesson assumes that you understand the difference between a host and guest operating system, can operate a VMware Workstation Player virtual machine, and know the basic roles of an IP address, subnet mask, default gateway, DNS, and DHCP.

How NAT networking works

In NAT mode, the virtual machine is placed on a private subnet created by VMware. The guest does not normally receive an address from the physical LAN’s DHCP server. Instead, VMware provides a virtual network, commonly named VMnet8, and routes guest traffic through the host.

When the guest sends traffic outward, VMware translates the source information. A remote server normally identifies the connection using the host’s outward-facing network identity, such as the host’s address on the physical LAN or the public address assigned by the host’s router. The guest’s private NAT address is not directly advertised to that remote system.

NAT generally supports outbound connections to the internet and to reachable LAN resources, subject to host, guest, and network security policies. The host and NAT-connected guests can also communicate through the VMware virtual network when local firewall rules permit it.

NAT network components

A VMware NAT network is made of several cooperating components. Understanding their responsibilities makes configuration and troubleshooting easier.

Component

VMnet8 NAT virtual network: The private VMware subnet used by default for NAT-connected guests.

Host virtual adapter: A virtual network adapter created on the host. It connects the host operating system to the VMware virtual network and allows host-to-guest communication where permitted.

Virtual DHCP service: A VMware service that assigns guests an IP address, subnet mask, default gateway, DNS information, and lease details when DHCP is enabled.

NAT service/device: The virtual routing and translation function that forwards traffic between the VMnet8 subnet and the host’s external network connection.

Guest network adapter: The virtual adapter presented to the operating system inside the VM. It must be enabled and connected for the guest to use NAT.

NAT addressing and network identity

A NAT guest has at least two relevant network identities:

  • Guest private address: An address on the VMware NAT subnet, such as the VMnet8 network. This is used by the guest to communicate with the host, the NAT gateway, and other compatible virtual machines.
  • Host physical-network address: The address the host uses on a wired or wireless LAN, or the outward identity presented by the host’s router on the internet.

The guest normally receives its IP address, subnet mask, default gateway, and DNS servers from VMware’s virtual DHCP service. The default gateway points toward VMware’s virtual routing and NAT service rather than directly toward the physical LAN router.

Changing a VM from bridged networking to NAT can change every major network setting. The IP address, subnet mask, gateway, DHCP server, and DNS configuration may all be different because the guest has moved from the physical LAN subnet to the VMware NAT subnet.

Expected Guest Configuration Before and After Switching to NAT

IP address: Bridged example: an address leased by the physical LAN. NAT example: an address leased on VMnet8. Why it changes: the guest moved to a different subnet.

Subnet mask: Bridged example: the mask used by the physical LAN. NAT example: the mask configured for VMnet8. Why it changes: each network defines its own address range.

Default gateway: Bridged example: the physical LAN router. NAT example: VMware’s virtual NAT gateway. Why it changes: outbound traffic now passes through VMware.

DHCP server: Bridged example: the physical network’s DHCP server. NAT example: VMware’s virtual DHCP service. Why it changes: address assignment is now internal to the virtual network.

DNS server: Bridged example: values supplied by the physical LAN. NAT example: values supplied or relayed through the NAT configuration. Why it changes: DHCP and host-side DNS settings may differ.

VMware networking modes compared

Mode

NAT: The guest address comes from VMware’s virtual DHCP service. The guest is not normally visible as an independent device on the physical LAN. Outbound connectivity usually works through the host. Host-to-guest communication normally works through the virtual network. Typical use: portable labs, internet access, and isolated outbound testing.

Bridged: The guest usually receives an address from the physical LAN’s DHCP server. The guest appears as a separate device on that LAN. Outbound connectivity is direct through the physical network. Host-to-guest communication depends on LAN and firewall rules. Typical use: services that need their own LAN identity.

Host-only: The guest receives an address from an isolated VMware network. It is not normally connected to the internet or physical LAN. Host-to-guest and VM-to-VM communication are the primary functions. Typical use: private labs and isolated testing.

Configure NAT for an existing virtual machine

  1. Open VMware Workstation Player and select the target virtual machine in the library.
  2. Open the Player management menu.
  3. Choose Manage, then Virtual Machine Settings.
  4. In the Hardware list, select Network Adapter.
  5. Select NAT: Used to share the host’s IP address, or the equivalent NAT option shown by your Player version.
  6. Confirm that the adapter is connected and enabled. If the interface offers a connection-at-power-on option, enable it when the VM should connect automatically.
  7. Select OK to save the setting.
  8. Start the VM, or restart its guest networking if it was already running.

Inside the guest, set the network adapter to obtain an IP address and DNS server automatically when using VMware DHCP. A compatible static NAT-subnet configuration is possible, but it must use the correct VMnet8 address range, subnet mask, gateway, and DNS settings. An arbitrary static address can prevent NAT from working.

Example: switching a Windows guest from bridged mode

Suppose a Windows guest previously received an address from the physical LAN while using bridged networking. After selecting NAT and renewing networking, the guest should receive an address from VMware’s DHCP service on the VMnet8 subnet. It can browse external sites, but its private guest address is not directly advertised on the physical LAN.

Validate the NAT connection

Validation should test configuration, local routing, DNS, and outbound access separately. This helps identify whether a failure is caused by DHCP, routing, name resolution, or a firewall.

Windows guest checks

Open Command Prompt and inspect the complete adapter configuration:

ipconfig /all

Check the IPv4 address, subnet mask, default gateway, DHCP server, and DNS servers. Confirm that the address belongs to the NAT virtual network rather than the physical LAN subnet.

If the lease is missing or stale, request a new one:

ipconfig /release
ipconfig /renew

Test the NAT gateway and DNS resolution:

ping <default-gateway>
nslookup example.com

You can then test a LAN resource or an internet destination. A successful gateway test shows local virtual routing is working; a successful name lookup shows that DNS is working; a successful external connection shows that NAT forwarding and the host’s external connection are working together.

Linux guest checks

Inspect addresses and routes:

ip addr
ip route
resolvectl status

Test the gateway, raw IP connectivity, and name resolution:

ping -c 4 <default-gateway>
ping -c 4 1.1.1.1
getent hosts example.com

If the numeric IP test succeeds but the hostname lookup fails, the problem is probably DNS rather than NAT routing.

Confirm the outward-facing identity

When the guest connects to an external service, that service normally sees the host-side network identity or the public address used by the host’s router. It does not normally see the guest’s private VMnet8 address. This shared identity is one reason NAT conserves physical-LAN addresses and works well on changing networks.

NAT behavior and limitations

NAT is primarily an outbound connection model. A connection initiated by the guest creates translation state, allowing reply traffic to return to the guest. An unsolicited connection initiated from the internet or physical LAN does not normally have a translation entry and is not automatically delivered to a VM.

To publish a guest service, create a port-forwarding rule using VMware’s virtual network configuration tools where available. A forwarding rule maps a selected host port to a service port on the guest’s private NAT address.

  1. Give the guest a stable address, preferably through a DHCP reservation or a carefully managed compatible static configuration.
  2. Create a host-port to guest-address-and-port mapping, such as a selected host TCP port to the guest’s TCP port 80 or 8080.
  3. Confirm that the web service is running and listening on the guest.
  4. Allow the service through the guest firewall and, when required, the host firewall.
  5. Test locally first, then test through the host port from an allowed client.

When NAT is preferable to bridged networking

NAT is convenient when direct physical-LAN addressing is unavailable, undesirable, or restricted. It is especially useful for a portable training lab that moves between home, campus, and office networks. Several VMs can use outbound access without each requesting a separate physical-LAN address.

Bridged networking is more appropriate when the VM must be independently addressable by other physical-LAN devices, must receive LAN-specific access controls, or must provide a service without host-side port forwarding. NAT provides isolation and convenience; bridged networking provides a direct LAN presence.

Troubleshooting NAT networking

The VM has no IP address or shows an automatic fallback address

  • Confirm that NAT is selected in the VM’s Network Adapter settings.
  • Confirm that the virtual adapter is enabled, connected, and configured to obtain settings automatically.
  • Renew the DHCP lease or restart guest networking.
  • Check whether VMware’s DHCP service and the VMnet8 network are operating on the host.
  • If using a static address, verify that it belongs to the NAT subnet and uses the correct gateway, mask, and DNS values.

The VM has an IP address but cannot reach the internet

  • Verify that the host itself can reach the intended network.
  • Inspect the guest’s default gateway and route table.
  • Ping the NAT gateway first, then test a public IP address.
  • Check host firewall and endpoint-security rules affecting VMware virtual adapters or services.
  • Verify that VMware’s NAT service is operating.

The VM can reach an IP address but cannot open websites by name

  • Inspect the configured DNS servers.
  • Renew DHCP and repeat a lookup with nslookup on Windows or getent hosts and resolvectl on Linux.
  • Compare a known IP test with a hostname test to separate routing problems from DNS problems.
  • Consider whether the host network restricts DNS traffic.

Another LAN device cannot connect to a NAT guest service

  • Remember that NAT does not automatically deliver unsolicited inbound traffic to private guests.
  • Create an appropriate port-forwarding rule.
  • Test the service locally inside the guest before testing through the forwarded host port.
  • Review both host and guest firewall rules.
  • Use bridged networking instead if the VM must be independently addressable on the physical LAN.

The VM cannot reach a local LAN resource after changing modes

  • Confirm that the resource is reachable from the host itself.
  • Check whether the resource accepts only traffic from the physical LAN subnet.
  • Review access-control rules and firewall logs for traffic translated through the host.
  • Update allowlists if appropriate, or choose bridged mode when the VM requires its own LAN identity.

Exam-relevant notes

  • VMnet8 is commonly the default VMware NAT network.
  • The virtual DHCP service supplies guest settings when DHCP is enabled; it is distinct from the physical LAN’s DHCP server.
  • The NAT guest’s default gateway points toward VMware’s virtual NAT service.
  • NAT changes the guest’s subnet and usually changes its IP, gateway, DHCP, and DNS details compared with bridged mode.
  • Outbound NAT does not imply automatic inbound reachability.
  • Port forwarding is required to map selected host ports to guest services.
  • Use bridged networking when a VM needs a direct, independent presence on the physical LAN.

For related configuration practice, continue with NAT networking setup.