🔥 VirtualBox Network Configuration: NAT & Host-Only Setup

NAT

With NAT, VirtualBox lets a guest make outbound connections through the host's network connection. In practice, that means the guest can usually reach websites, package repositories, and other external services without being assigned a LAN address.

The catch is inbound. With "ordinary" NAT, each VM is generally isolated on its own private network. Other VMs won't automatically be on the same NAT segment, and the host can't typically initiate connections directly to the guest. If you need inbound access, you usually use port forwarding (for example, forwarding a host port to the guest's SSH port).

NAT is a good default when the VM only needs outbound access. It's less convenient when you want to SSH into the guest regularly or have multiple VMs talk to each other.

NAT Network

A NAT Network is a shared virtual network that multiple VMs can join. Guests on that network can communicate with each other while still using NAT for outbound access. For a small multi-VM lab, this often saves you from setting up separate NAT interfaces.

If you also want access from the host, you still typically need port forwarding or an additional interface like Host-Only. If you need both VM-to-VM communication and direct host-to-guest access, combining NAT Network with Host-Only can be a reasonable setup.

Bridged Adapter

A Bridged Adapter connects the VM to the same network as the host by using one of the host's physical network interfaces. The guest can receive an address from the LAN DHCP server and may be reachable by other devices on that LAN.

This is handy when you really want the VM to behave like a separate physical machine. It also changes the risk profile: the VM isn't tucked behind NAT anymore. Reachability depends on your LAN and the firewall rules on the host and guest. Use bridged mode on purpose - especially on office, shared, or public networks.

Host-Only, Internal, and Cloud networks

A Host-Only Adapter creates a private network between the host and any attached VMs. By itself, it doesn't provide internet access. VirtualBox can run a DHCP server for this network, or you can assign addresses manually.

An Internal Network is meant for communication between VMs on the same named internal network. The host isn't included by default, and you shouldn't assume there's DHCP. If you use internal networks, configure addressing (and DHCP, if you need it) for your lab.

VirtualBox also offers Cloud Network support for specific cloud networking services, including Oracle Cloud Infrastructure. That's version- and configuration-dependent, and it's not needed for the straightforward host-and-guest setup in this guide.

Why not use Bridged mode for everything?

Bridged mode isn't inherently "unsafe," and sometimes it's the simplest solution. The trade-off is that the guest sits on your physical LAN like any other device. That can expose services to other LAN users, depending on firewall rules and network policy.

For a throwaway test VM on a trusted home network, that's often fine. For a lab server that only needs internet access and host management, NAT plus Host-Only keeps the guest off the physical LAN while still making day-to-day work easy. The goal isn't "never bridge." It's "don't grant LAN reachability you don't need."

Create or check the Host-Only network

In VirtualBox Manager, open the network settings. Depending on your version, Host-Only networks may show up under Tools, Network, or the app's global network preferences.

Create a Host-Only network if you don't already have one. Check the host-side IPv4 address and network mask. For example, VirtualBox may assign the host-side Host-Only adapter 192.168.56.1 with a /24 mask. The guest's Host-Only address must live in the same subnet and must not collide with any other device.

If you want, enable the Host-Only DHCP server so the guest can get an address automatically. DHCP is convenient for short-lived test VMs. For a homelab box you'll SSH into repeatedly, a static Host-Only address is usually simpler. Either way, avoid manually assigning an IP that falls inside the DHCP pool (unless you're intentionally reserving it).

Attach both adapters to the VM

Shut down the VM before changing adapter settings. In the VM's Settings → Network area:

1. Enable Adapter 1 and set Attached to to NAT.
2. Enable Adapter 2 and set Attached to to Host-Only Adapter.
3. Select the Host-Only network you created.
4. If your VirtualBox version shows that option, make sure "cable connected" (or similar) is enabled for both adapters.

Linux will usually notice the adapters as interfaces like enp0s3 and enp0s8 - but interface numbering depends on the guest OS and virtual hardware. Verify the interface names in the guest instead of copying examples blindly.

Configure a static Host-Only address with nmcli

Assume your Host-Only interface is enp0s8, the host-side adapter is 192.168.56.1/24, and you want the guest to use 192.168.56.10. Replace those with your actual subnet and interface name.

Find the NetworkManager connection profile tied to that interface:

nmcli connection show

Then set the static address and remove the default route from this connection:

sudo nmcli connection modify "Wired connection 2" \
ipv4.method manual \
ipv4.addresses 192.168.56.10/24 \
ipv4.gateway "" \
ipv4.never-default yes

Use your real connection profile name instead of "Wired connection 2". Setting ipv4.never-default yes makes it clear this interface is for the Host-Only subnet only - it won't become the guest's internet path.

Apply the change:

sudo nmcli connection down "Wired connection 2"
sudo nmcli connection up "Wired connection 2"

If there's no NetworkManager profile for the Host-Only interface, create one. The connection name and interface name below are examples - adjust them:

sudo nmcli connection add type ethernet \
con-name host-only \
ifname enp0s8 \
ipv4.method manual \
ipv4.addresses 192.168.56.10/24 \
ipv4.never-default yes

You usually don't need to set a gateway or DNS on the Host-Only connection. Let the NAT connection handle the default route and DNS via DHCP. Try not to edit the NAT profile while you're setting up Host-Only unless you have a specific routing requirement.

Configure with nmtui or DHCP

If you prefer a menu-based tool, run:

sudo nmtui

Pick Edit a connection, select the Host-Only profile, and set the IPv4 address and prefix. Leave the gateway blank for the usual two-adapter setup. Save and activate the profile. nmtui is also useful if you need to create the connection interactively.

Alternatively, enable the Host-Only DHCP server in VirtualBox and let the guest use automatic IPv4. That cuts down on manual work, but the guest address can change unless you set a reservation or otherwise make addressing predictable. If you rely on SSH automation or dev tools, double-check the assigned IP after each change.

Verify routes and SSH access

Check the guest's addresses and route table:

ip addr
ip route

You should see a Host-Only address on the second interface, plus a default route pointing out through the NAT interface. Test outbound connectivity from the guest, then test reachability from the host by pinging the guest's Host-Only address. A failed ping doesn't always mean "the network is broken" - ICMP may simply be blocked by the guest firewall. SSH is usually the more meaningful test if that's how you'll manage the VM.

Make sure an SSH server is installed and running. On systemd-based systems:

sudo systemctl status sshd

Some distros use ssh instead of sshd. Allow the SSH service through the guest firewall, then connect from the host:

ssh your-user@192.168.56.10

The host's VirtualBox Host-Only adapter and the guest's Host-Only address should be on the same subnet. Once SSH works, tools like Visual Studio Code Remote SSH or your preferred terminal emulator can use that private IP. If you want more detail on the adapter behavior, see the VirtualBox User Manual.

Common problems

• No Host-Only interface in the guest: Confirm Adapter 2 is enabled and attached to the correct Host-Only network. Reboot or rescan networking if the guest OS doesn't pick it up cleanly.
• Host and guest can't reach each other: Make sure both IPs are on the same subnet and that the guest IP isn't duplicated. Host or guest firewalls can also block traffic.
• SSH times out: Confirm the SSH service is running, port 22 is allowed by the guest firewall, and you're connecting to the Host-Only IP (not an old NAT address).
• Internet stops after adding the second adapter: Check ip route. The NAT interface should normally own the default route. Remove any unintended default gateway from the Host-Only connection.
• Address changes after a restart: Your Host-Only interface is using DHCP. Use a static address outside the DHCP pool, or configure a reservation if VirtualBox supports it in your setup.
• Host-only subnet conflicts with another network: Pick a private subnet that doesn't overlap with your LAN, VPN, or other virtual networks. Overlapping routes can send traffic somewhere you didn't expect.

Keep exposure proportional to the task

NAT plus Host-Only reduces direct exposure to your physical LAN, but it's not a replacement for firewalling or hardening your guest. Keep the guest updated, use SSH keys where it makes sense, and only enable the services you actually need.

Also, don't treat Host-Only as an automatic "secure boundary." A Host-Only network can connect multiple guests (and the host). It's still just a private network - secure it like one.

Use Bridged mode when the VM genuinely needs to behave like a peer on the LAN. For example, if you're testing LAN discovery or access from another physical device. Before you do that, check your network's policies and the guest's firewall. On corporate networks, even a "just for testing" bridged VM can violate policy.

For a small Kubernetes or server lab, NAT plus Host-Only is a solid baseline: outbound access is straightforward, and host management uses a predictable private address. If cluster nodes need to talk to each other, decide whether you also need a shared NAT Network (or another dedicated lab network) rather than relying on a default setup that only fits one node.