I have a Linux guest VM running under a Windows host. If I set the networking mode to NAT, the guest can get internet access (which I want), but can also access the hosts LAN (which I dont).

For various reasons, I cannot set up a separate network just to provide internet access to the guest.

Can I use Windows Firewall, or some routing software to allow me to give internet access to the guest, but block all other access?

EDIT - I got the solution from the virtualbox forums: Use NAT with windows firewall to block the guest.

My mistake was trying to set up the rule on the host where (program = all, local IP = guest IP range). Rule actually should be (local IP = all, program=virtualbox.exe), since the NAT already happen before it hits the firewall


Solution - add a firewall rule to the host: block (local IP = all, program=virtualbox.exe, remote IP = {range you want to block})

| improve this answer | |
  • what if I have multiple vm and I want to limit connectivity to only one? – flagg19 Nov 16 at 13:44

You say Linux so I'm assuming you have IPtables installed. You can only allow inbound/outbound traffic on port 80 (HTTP), port 443 (HTTPS) and outbound DNS. Use at your own risk as I have not tested these rules. Also, make sure you are the physical machine when you do it. If you are remotely connecting you may disconnect yourself and not be able to get back to the machine.

#delete all rules
iptables -F

#change default policy to drop everything
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT DROP

#add rules for port 80 and 443 to only allow this traffic
iptables -A OUTPUT -o eth0 -p tcp --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth0 -p tcp --sport 443 -m state --state ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth0 -p tcp --sport 80 -m state --state ESTABLISHED -j ACCEPT

#allow outbound DNS
iptables -A OUTPUT -p udp -o eth0 --dport 53 -j ACCEPT
iptables -A INPUT -p udp -i eth0 --sport 53 -j ACCEPT

#allow loopback
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

List Rules:

iptables -L
| improve this answer | |
  • The guest is running Linux, the host is running windows, but I assume this routing is for the host? – Francis Appa Jun 21 '13 at 13:40
  • No, this is for the guest. In all honesty it would be a bad policy to put this type of routing on a host level simply because if you ever put other virtual machines on it, they will be limited to internet only. It would cause a world of hurt if you put a domain controller or something like that on there. – Travis Jun 21 '13 at 15:16

Its tricky to give advice because you haven't specified what virtualisation platform you are using. If you are using Virtualbox, you can set the network type to Host only adapter, which will allow internet access, and access to the host you are running Virtualbox on, but not the rest of the network.

| improve this answer | |
  • If I go with host-only adapter, can I still block access to the host itself? – Francis Appa Jun 21 '13 at 13:43
  • Actually I tried this, but my guest doesnt get internet access - only access to the host. Did you do something special (like setting up routing rules) to enable this? – Francis Appa Jun 21 '13 at 14:19

I had bridge my connection. This still didn't work, but checking the cable connected box (circled in the image below) fixed my network connection. I don't fully understand why.

enter image description here

| improve this answer | |
  • 1
    The "Cable Connected" box controls whether the virtual CAT5/5e/6 network cable (or equivalent ability to communicate, in the case of wireless) is plugged or unplugged. (Sometimes, it's useful to virtualize a system which has a network adapter installed but nothing to talk to.) – ssokolow Jul 24 '16 at 21:19

I am facing the same issue (a few years later). I have found a very simple iptables rule:

sudo iptables -I OUTPUT -d -j DROP

(Assuming local network is 192.168.1.x). It must bu set in the guest machine.

But unfortunately, it also limits all the connections. So, not very useful, I guess

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.