VMware ESXi and vSphere Cluster Management

VMware Player Virtual Networking Components: Switches, Adapters, DHCP, and NAT

Learn how VMware Player VMnet switches, virtual adapters, DHCP, NAT, bridged, host-only, and NAT networking connect virtual machines.

VMware Player networking combines several software components to give a virtual machine network connectivity. The most important components are the virtual network adapter presented to the guest, the VMnet virtual switch, the virtual DHCP service, and the NAT device.

These components imitate familiar physical networking roles, but they operate on the host computer. A guest adapter attaches to a VMnet network, and the selected connection mode determines whether the guest can reach the host, other guests, the physical LAN, or external networks. DHCP may assign the guest its address, while NAT may provide outbound connectivity.

This lesson explains the component relationships and provides practical guidance for choosing a mode. For related configuration work, see VMware virtual networking components.

Core VMware Player networking components

Component	Where it operates	Function	Used by which modes	Common dependency
Virtual switch	On the host	Connects virtual network interfaces on one VMnet segment and may connect that segment to the host or an external interface.	All modes	Correct VMnet attachment and network design
Guest virtual network adapter	Inside the VM and exposed to the guest OS	Acts as the guest's network interface and connects it to a selected VMnet.	All modes	A suitable guest driver and enabled adapter
Virtual DHCP server	On the host	Automatically supplies IP configuration to guests on applicable private VMnet networks.	Normally host-only and NAT	DHCP service enabled for the selected VMnet
NAT device	On the host	Translates and forwards traffic between a private NAT VMnet and external networks.	NAT	Working NAT service and host uplink

The end-to-end relationship is straightforward:

A virtual machine contains one or more virtual network adapters.
Each adapter is attached to a virtual network, usually identified by a VMnet number.
The VMnet behaves like a software switch or network segment.
The selected mode determines whether the segment connects to the host, a physical adapter, or a NAT device.
DHCP can provide addresses and related settings on private networks.
Guest and host firewalls still decide whether particular traffic is allowed.

VMnet virtual switches and network segments

A virtual switch is software that forwards frames between connected virtual network interfaces. Depending on its configuration, it can connect guest adapters to one another, to a host-side VMware adapter, or to a physical host network adapter.

VMnet is VMware's naming convention for a virtual network or virtual switch segment. The VMnet number identifies the network segment, not an individual guest adapter. Several virtual machines can attach their adapters to the same VMnet.

Common default VMnet mappings

VMnet name	Default connection type	Primary participants	DHCP source	External network access	Typical use
VMnet0	Bridged	Guests, the selected host physical adapter, and the physical LAN	Normally the physical LAN DHCP server	Through the physical LAN	Making a guest appear as a peer on the LAN
VMnet1	Host-only	Guests on VMnet1 and the host	Normally VMware virtual DHCP	None by default	Private practice networks and host-to-guest administration
VMnet8	NAT	Guests, the private VMnet, the VMware NAT device, and the host uplink	Normally VMware virtual DHCP	Outbound access through the host	Internet access without direct LAN addressing

Additional numbered VMnet networks can be used for custom designs. For example, separate custom VMnets can represent an internal server segment, a management segment, and an isolated malware-analysis segment. A multi-segment lab still needs routing or a router VM if traffic must cross between those segments.

Historically, Windows hosts supported up to 20 virtual switches, while Linux hosts supported up to 255. The historical attachment limit was unlimited virtual network devices per virtual switch on Windows and up to 32 on Linux. A single virtual machine historically supported up to 10 virtual network adapters. These figures are product-dependent: supported limits and available network-editor options can vary by VMware release, edition, and host operating system.

Connection modes

Bridged networking

In bridged networking, the VM connects through a selected physical network connection on the host. VMnet0 normally represents this mode. The guest behaves like another device on the physical LAN and normally receives an address from the physical network's DHCP server.

Because the guest is an apparent LAN peer, other LAN systems may be able to initiate connections to it. Physical-network policy, guest firewalls, host firewalls, VLANs, wireless limitations, VPN software, corporate network admission control, and MAC-address restrictions can change this behavior.

Host-only networking

Host-only networking creates a private network for the host and VMs connected to the same host-only VMnet. VMnet1 normally represents this mode. Guests on that segment can communicate with one another and with the host, subject to IP configuration and firewall rules.

Host-only networking does not provide external routing by default. It is useful for isolated training environments, private service testing, and host-to-guest administration. It is not automatically a complete security boundary: a compromised host, a routing configuration, or a multi-homed guest could provide another path.

NAT networking

NAT networking places guests on a private network, normally VMnet8. The VMware NAT device translates guest traffic as it leaves that private network and forwards it through the host's external connection.

The external network normally sees the host's network identity rather than a separately addressed guest. Multiple guests can therefore use private IP addresses while sharing the host's outbound connectivity. Return traffic is tracked and delivered to the guest that initiated the flow.

Unsolicited inbound connections from external systems do not normally reach a NAT guest. To publish a service, create a port-forwarding rule that maps a host-side port to the guest's IP address and service port. The guest and host firewalls must also permit the connection.

Mode comparison

Mode	Guest address source	Guest visibility on physical LAN	Host-to-guest connectivity	Guest outbound internet access	Inbound access considerations	Best-fit scenario
Bridged	Physical LAN DHCP or valid LAN static configuration	Usually visible as an independent LAN device	Usually possible through the LAN and host networking	Usually available through the LAN	May be directly reachable, subject to LAN and firewall policy	LAN-peer testing and services that need direct LAN reachability
NAT	Normally VMware DHCP on the NAT subnet, or a valid NAT-subnet static address	Not normally visible as an independent LAN device	Normally possible from the host, subject to firewall rules	Normally available through the NAT device	Requires port forwarding or comparable NAT configuration	Ordinary outbound internet access with reduced direct exposure
Host-only	Normally VMware DHCP on the host-only subnet, or a compatible static address	Not visible on the physical LAN by default	Available to the host and same-VMnet guests	Unavailable by default	Limited to the private segment unless routing is deliberately added	Isolated labs and private host-to-guest communication

Virtual network adapters

A virtual network adapter, also called a virtual NIC, is the network interface presented to the guest operating system. It is similar to a physical Ethernet adapter from the guest's perspective.

VMware Player normally creates an adapter when a VM is created. In the VM's network adapter settings, you can select Bridged, NAT, Host-only, or a specific custom VMnet when supported. The adapter should be connected and configured to connect when the VM starts.

Common emulated adapter types include the AMD PCnet PCI Adapter and the Intel PRO/1000 MT Server Adapter. The guest operating system needs a suitable driver for the selected emulated hardware. A missing or incompatible driver can make the adapter appear absent even when the VMware setting is correct.

A VM historically supported up to 10 virtual network adapters. Multiple adapters are useful when a VM performs a routing or firewall role. For example, one adapter can connect to an upstream NAT or bridged segment, while a second adapter connects to an internal host-only or custom VMnet segment.

Do not confuse the guest-facing virtual NIC with host-side VMware adapters. A guest NIC is hardware presented inside the VM. A host-side VMware adapter is an interface in the host operating system that may provide the host with access to a host-only or NAT network.

Virtual DHCP service

DHCP, the Dynamic Host Configuration Protocol, automatically distributes network settings. A DHCP response can provide an IP address, subnet mask, default gateway, lease duration, and DNS server information.

The VMware virtual DHCP service normally supplies addresses on host-only and NAT VMnet networks. This is why those networks can function without a physical LAN DHCP server. The DHCP service assigns addresses from the configured subnet, while the NAT device separately provides translated outbound connectivity on a NAT network.

Bridged guests normally obtain addresses from the physical LAN's DHCP server. Alternatively, they can use a static address that is valid for that LAN and approved by its administrator.

Static addressing

Static configuration is an alternative when a stable address is needed or DHCP is unavailable. The address, subnet mask or CIDR prefix, default gateway, and DNS servers must match the selected VMnet or physical LAN. Avoid duplicate addresses, and do not use a NAT or host-only address outside that network's configured subnet.

NAT device and port forwarding

Network Address Translation changes address information as traffic crosses between networks. The VMware NAT device forwards guest-originated traffic from the private NAT VMnet to external networks through the host's uplink.

The guest sends traffic using its private source address and the NAT network's default gateway.
The NAT device changes the source information to an available host-side identity and records the flow.
The host sends the translated traffic through its physical or other external connection.
When a reply returns, the NAT device consults its flow state and translates the reply back to the correct guest.

With bridging, the guest can have its own physical-LAN address, so external systems may connect directly if routing and firewall policy permit. With NAT, external systems normally cannot initiate a new connection to the private guest. Port forwarding creates an exception by mapping a host-facing port and protocol to a guest IP address and service port.

Traffic-flow examples

Host-only traffic

A VM attached to VMnet1 sends an Ethernet frame to the host-only virtual switch. If the destination is another VM on VMnet1, the switch delivers the frame to that VM's adapter. If the destination is the host, the frame is delivered to the host-side VMware adapter. No external router is involved in this local path.

NAT outbound traffic

A NAT guest receives a private address from VMware DHCP on VMnet8. For an external destination, the guest sends the packet to its VMnet8 gateway. The VMware NAT device translates the packet, sends it through the host uplink, and tracks the flow so the response returns to the originating guest.

Bridged traffic

A bridged guest sends traffic through its adapter to VMnet0. VMnet0 passes it through the selected physical host adapter to the physical LAN. The guest can use the LAN's addressing and routing rules as though it were another connected device.

Two VMs communicate only when their switching or routing design, VLAN configuration, IP addresses, routes, and firewall rules permit communication. Sharing a host does not by itself place two VMs on the same network.

Practical configurations

NAT internet-capable test VM

Open the VM's network adapter settings.
Select NAT, normally VMnet8.
Confirm that the adapter is connected and set to connect at VM startup.
Use VMware DHCP, or configure a valid static address in the NAT subnet.
Test the guest's address, gateway, DNS resolution, and an external destination in that order.

Server visible on the physical LAN

Select Bridged, normally VMnet0.
Choose the appropriate physical host adapter if several uplinks are available.
Use the physical LAN's DHCP service or an approved static LAN configuration.
Apply guest service and firewall settings deliberately, because the VM may be reachable by other LAN systems.

Isolated host-and-guest training network

Attach the participating VMs to Host-only, normally VMnet1.
Use VMware DHCP or compatible static addresses.
Test host-to-guest and guest-to-guest communication on the same VMnet.
Expect no external connectivity unless routing is intentionally added.

Two-interface router or firewall lab

Add two virtual adapters to the router or firewall VM.
Attach the upstream adapter to NAT or bridged networking.
Attach the internal adapter to host-only or a custom VMnet.
Configure routing, firewall rules, and IP forwarding intentionally in the guest.
Attach internal client VMs to the internal VMnet and test each policy path.

Publishing a service from a NAT guest

Run a test service such as SSH or a web server in the NAT guest.
Give the guest a stable NAT-subnet address through a reservation or static configuration.
Create a NAT port-forwarding rule from a host port to the guest IP and service port.
Allow the service through the guest firewall and, when necessary, the host firewall.
Test locally from the host before testing from an authorized remote client.

Useful guest commands

Use these commands to identify the active adapter, address, prefix or mask, route, gateway, and DNS configuration. Run the commands inside the guest operating system.

Windows guest
ipconfig /all
ping <gateway-address>
nslookup <hostname>

Linux guest
ip addr
ip route
ping -c 4 <gateway-address>
resolvectl status

Some Linux distributions do not use systemd-resolved, so DNS inspection may require the distribution's own network-management command or configuration files.

Choosing a network mode

Choose bridged when the guest must operate as a peer on the physical LAN or receive direct LAN reachability.
Choose NAT for typical outbound internet access while reducing the guest's direct exposure to the external network.
Choose host-only for isolated practice networks, host-to-guest administration, and private multi-VM exercises.
Choose a custom VMnet when a lab needs separate network segments, controlled routing, or repeatable testing boundaries.

In every mode, check both the guest and host firewalls. A successful DHCP lease does not prove that application traffic is allowed, and a successful ping does not prove that a service port is reachable.

Troubleshooting workflow

Private guest has an address but cannot reach expected destinations

Confirm the selected mode and VMnet attachment.
Inspect the guest address, prefix, route, gateway, and DNS settings.
Test the gateway first, then an external IP address, and then DNS name resolution.
For NAT, verify the NAT service. For host-only, confirm that external routing was not incorrectly expected.
Check VMware networking services, host firewall rules, VPN software, proxy settings, and endpoint security controls.

Bridged guest cannot obtain a physical-LAN address

Verify that the guest uses bridged mode and the intended physical adapter.
Confirm that the host itself has connectivity through that adapter.
Check physical DHCP availability.
Consider wireless, VPN, NAC, MAC filtering, VLAN policy, and corporate virtualization restrictions.
Use a static LAN configuration only when it is valid and permitted.

Host-only guest cannot access the internet

This is normally expected. Confirm whether the VM should use NAT instead. If external access is required while retaining a private segment, add and configure an intentional router path, such as a separate router VM.

External client cannot reach a NAT service

Confirm that the service works inside the guest and listens on the expected interface and port.
Verify the guest's current NAT IP address.
Check the port-forwarding protocol, host port, target IP, and target port.
Allow the service through guest and host firewalls.
Test from the host first, then from an authorized remote client.

Two VMs cannot communicate

Compare their VMnet attachments.
Compare their addresses, prefixes, and routing tables.
Confirm that a router exists when the VMs are on different subnets.
Check guest firewall rules and test the actual service port, not only ICMP.
For a multi-NIC VM, inspect route metrics and interface selection.

Key points

VMware Player virtual networking runs on the host but presents familiar network roles to the guest.
A guest adapter must attach to a VMnet virtual switch or segment.
Bridged mode places the guest on the physical LAN, NAT provides private outbound connectivity, and host-only provides a private host-and-guest segment.
VMware virtual DHCP normally serves host-only and NAT networks, while bridged guests normally use physical-LAN DHCP.
NAT does not normally permit unsolicited inbound connections without port forwarding.
Multiple adapters and custom VMnets allow router, firewall, and multi-segment laboratory designs.
Connectivity always depends on correct IP configuration, routing, switching, VLAN policy, and firewall rules.