Isolating VMware virtual machines from the network

Question

I have:

VMware Workstation 7 running on a Windows 7 box (with a single NIC), with multiple virtual machines running a range of OSs. The host box is connected to a WRT54G router running Tomato firmware. The router is acting as a wireless bridge to another WRT54G that's wired to my broadband modem. I can access the VMs externally via VNC using VMware's Remote Display. Over time I've had these running:

a. Using NAT networking (single IP) with port forwarding on the router and a custom port in VMware for each VM.

b. Using bridged networking with static IPs assigned to each VM via MAC address, and port forwarding on the router to each IP running with standard ports.

Either way, the host box, and other physical machines on the network are accessible from the VMs. Is there a way to isolate the VMs from the rest of the network, but still maintain internet access and remote VNC to the VMs?

Answer 1

No, for the VMs to be accessible via VNC they would need to be on the normal network. You could probably setup some funky firewall rules on the VMs so that nothing on the LAN could talk to them, but I'm not sure what the point would be.

Answer 2

I asked a similar question to this a week or two ago. In the end there were a couple of options.

1. Use an ACL to restrict network access. I don't imagine this is an option since you're using a home router.

2. Use routing rules at the gateway to block or reject traffic to destinations you don't want the user to have acesss to, stop the user from changing your gateway and routing table, disable ARP broadcasts and set a static ARP for the VM. Prevent VM users from changing any of these things. It's a bit hacked together and I wouldn't be 100% confident the VM was 100% isolated, but it can work to stop casual users from accessing your boxes (esp. non Windows administrator accounts). Have a look at this for more details.

If your VM is linux based step two is possible as well, although the steps are different. Which OS are you talking about specifically?