Update 2012-05-16: These instructions have been superseded by a new version of this guide. Follow that document instead.
Update 2010-08-18: These instructions are still valid as of VirtualBox 3.2.8 and Ubuntu 10.04 “Lucid Lynx”. VirtualBox now creates a “vboxnet0″ interface by default, but this is not a bridge.
I use VirtualBox every day. The satellite world is infested with bad Windows-based management tools that fail to run in Wine. So I often run those apps in a Windows virtual machine, safely sandboxed the way Windows belongs.
Note to hardware developers: if your network-based device does not have a standards-compliant HTTP interface, you lose. If it has a Windows-based management tool instead, you lose twice. I will buy your product only if I have no other choice.
I imagine running Windows apps is what 90% of VirtualBox users use it for, but it can do so much more than that. I also run several Linux-based VMs, and use them to test server configs, or even whole networks before rolling out the real thing. If you do this, you probably want to use more than the basic NAT networking that VirtualBox uses by default. For instance, wouldn’t it be nice to install an SSH server in the VM, minimise the VirtualBox GUI, and SSH in from a terminal just like you would a real server?
I assume you are using VirtualBox 2.1.4 from a Linux host running Ubuntu 8.04 “Hardy Heron”. Similar commands can be used on any recent Debian or Ubuntu release. You’ll have to adapt some things to use it on RPM- or source-based Linux distributions. Assume all commands are run as root (directly or with sudo).
Step 1: Create a bridge interface
First, we have to create a bridge interface for the VMs. Install the bridge utilities:
apt-get install bridge-utils
Now make the bridge start on boot. Add the following to /etc/network/interfaces:
|
1 2 3 4 5 6 7 8 9 10 |
# VirtualBox NAT bridge auto vnet0 iface vnet0 inet static address 172.16.0.1 netmask 255.255.255.0 bridge_ports none bridge_maxwait 0 bridge_fd 1 up iptables -t nat -I POSTROUTING -s 172.16.0.0/24 -j MASQUERADE down iptables -t nat -D POSTROUTING -s 172.16.0.0/24 -j MASQUERADE |
Either reboot or start it manually:
ifup vnet0
We now have a bridge interface to which VirtualBox can attach virtual machines. That traffic will be NATed to your host’s IP address when the guest OS accesses the Internet. However, the traffic won’t yet route.
Note: if you are already using a firewall such as iptables, shorewall, or ufw, you should remove the two iptables lines above and add equivalent commands to your firewall configuration. Otherwise NAT will probably not function.
Step 2: Enable IP forwarding
Now you must tell the kernel to route traffic. Find the ‘net.ipv4.ip_forward’ line in /etc/sysctl.conf, and uncomment it:
|
1 2 |
# Uncomment the next line to enable packet forwarding for IPv4 net.ipv4.ip_forward=1 |
And load it:
sysctl -p
Step 3: Setup DHCP and DNS for clients
OK, now you can forward and NAT traffic from client VMs. But you still have to configure static IPs in each guest’s OS. Here is where DNSMasq shines. It provides an all-in-one DHCP/DNS server in a small footprint. Install it:
apt-get install dnsmasq
And edit /etc/dnsmasq.conf to include:
|
1 2 |
interface=vnet0 dhcp-range=172.16.0.2,172.16.0.254,1h |
That’s all you really need, but you may want to explicitly define DNS servers and domains for the guests, or static assignments. Add:
|
1 2 3 4 |
dhcp-option=option:dns-server,172.16.0.1,208.67.222.222,208.67.220.220 dhcp-option=option:domain-name,example.com dhcp-host=08:00:27:00:00:02,vmxp,172.16.0.2 # Windows XP dhcp-host=08:00:27:00:00:03,vmubuntu,172.16.0.3 # Ubuntu |
This defines the host OS and the OpenDNS servers as the DNS servers (instead of passing on whatever your host OS uses), tells all guests they are part of the domain example.com, and defines two static assignments by MAC address.
Step 4: Set up the virtual machine
- Start the VirtualBox interface, and edit your virtual machine’s settings.
- Choose “Network”.
- Enable a network adaptor.
- Under “Attached to:”, select “Host Interface”.
- If you assigned a static DHCP assignment above, be sure to set the same MAC address.
- Under “Host Interfaces”, select the bridge you created in step 1, vnet0.
Example:

Your virtual machines will now automatically receive an IP address in the 172.16.0.0/24 network, will resolve DNS, will NAT to your host’s external IP address, and can directly address each other.
Tags: networking, virtualbox
-
Hi,
Congratulations, very nice and useful documentation :-)
Zsolt
-
I’m using Gufw for my firewall. How do I add add equivalent commands to my firewall configuration? Thanks in advance for any tips.
-
I’ll give it a shot. By the way, your instructions worked perfectly when I disabled Gufw :)
-
I ahve a question, how would this setup work with two or more virtual machines on the same physical interface ?
-
Crafty (ab)use of bridge-utils. I haven’t played with it since bridging DWL-900APs back in 2002.
The networking options GUI is different in VBox 3.0, which was just released yesterday. I was quite surprised to go to the manuals download to find 2.2.4 documentation wasn’t available and shiny new 3.0 had replaced it. Time to upgrade again!
-
thanks very much, worked first time of course!
-
Does anyone know how to do Step 1 using Fedora 11?
-
Hi
I am beginner and need some help in making inter networking between host and virtual machine.On my machine these software are installed
1. ubuntu 9.04 (Host)
2. virtual Box 3.0.8
3. ubuntu 9.04 (virtual machine)
i have assigned the IP to host eth0 using file /etc/networking/interfaces. while on virtual machine eth0 ip assigned by VirtualBox. i am replacing this IP with same class which assigned host.
The problem is that, when i was send a ping command from host to virtual machine or virtual machine to host , then response is unreached host.any tutorial or web link that helpful for me.thanks for advanced.
-
Hi,
Thanks for this tutorial.
Can you explain us how to put “vnet0″ in “Adapter1″->”Host Interfaces”?
I am not sure, but do we need to do, something like this?
http://spinczyk.net/blog/2008/03/05/setting-up-a-bridged-network-for-virtualbox-on-ubuntu-linux/
-
Is it possible with this method to essentially replace the host with the guest (as far as the outside world is concerned)?
In essence, I want to forward ALL traffic coming from my VM to the Internet like normal NAT but also all traffic coming from the Internet to my host, to the VM – minus port 22 so I can still ssh into the host.
-
Thanks tyler – that is going to be very helpful once I resolve my major problem.
Don’t ask me why but following this configuration, once I boot up the VM and it accesses the network interface, my server becomes unreachable (this is a remote server I’m working with). Perhaps it’s because this setup was developed with Virtualbox 2.x, I’m using Virtualbox 3.0.8.
Have you figured out how to make this work using the Host-Only selection from VBox? It’s supposed to work out of the box but it doesn’t for me – the DHCP server never gives my guest an IP and even if I statically assign one, I can’t ping back and forth.
-
Hi again,
I really have no idea what the problem was with my setup – a clean install of everything made it work out of the box.
FYI – Host-only does offer the VirtualBox DHCP as an option. I’ve chosen to disable it because I only run one VM and I want to guarantee a static IP either way.Thanks for your help above – I’m about to try making the VM work as a DMZ Host like you said.
-
Wow, this is neat – with your help and a little Googling, I’ve made this work. Here’s the iptables script for whoever wants it.
This will work with the default VBox config – the host-only networking is on 192.168.56.x.
I’ve allowed ssh (22), VNC (5901) and VRDP (3000 – my setting) to go directly to the host. Adjust accordingly.#!/bin/bash
HOST_IFACE=eth0
GUEST_IP=192.168.56.200
GUEST_IFACE=vboxnet0# clear all tables
iptables -P INPUT ACCEPT
iptables -F INPUT
iptables -P OUTPUT ACCEPT
iptables -F OUTPUT
iptables -P FORWARD DROP
iptables -F FORWARD
iptables -t nat -F# Keep following ports to host
iptables -t nat -A PREROUTING -i $HOST_IFACE -p tcp -m multiport –dports 22,5901,3000 -j ACCEPT# The rest, route to the guest
iptables -t nat -A PREROUTING -i $HOST_IFACE -j DNAT –to-destination $GUEST_IP# Forward all packets from already established connections
iptables -A FORWARD -m state –state ESTABLISHED,RELATED -j ACCEPT# Allow forwarding new connections from host to guest
iptables -A FORWARD -i $HOST_IFACE -o $GUEST_IFACE -d $GUEST_IP -m state –state NEW -j ACCEPT
# Allow forwarding new connections from guest to host
iptables -A FORWARD -i $GUEST_IFACE -o $HOST_IFACE -s $GUEST_IP -m state –state NEW -j ACCEPT# setup masquerading
iptables -t nat -A POSTROUTING -o $HOST_IFACE -j MASQUERADE-
Does this really work for the Host-only adapter of vbox 3(.0.8)?
-
-
Hi,
I’m trying to use a part of your guide and combine it with my solution – wanting to point my guest hosts directly to my ISPs DNS (while keeping the default gateway on my guests the suggested 172.68.0.1). So I make the masquerading rule in iptables, set my virtual guest to go to 172.0.0.1 as gateway and set DNS address to the real DNS-address from my ISP, assuming that my physical host will routing the traffic. It seems to be working as long as I have all on my host IP-tables set to ACCEPT and clean, except for the -t nat masquerading rule that you have added. As soon as I apply my ordinary rules on IP-tables the traffic stops. I use rather simple rules – here’s the listing.Chain INPUT (policy DROP)
target prot opt source destination
ACCEPT all — 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
ACCEPT all — 127.0.0.1 0.0.0.0/0
ACCEPT tcp — 0.0.0.0/0 0.0.0.0/0 tcp dpt:22 state NEWChain FORWARD (policy DROP)
target prot opt source destination
ACCEPT all — 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHEDChain OUTPUT (policy ACCEPT)
target prot opt source destinationand of course the NAT-rule
Chain PREROUTING (policy ACCEPT)
target prot opt source destinationChain POSTROUTING (policy ACCEPT)
target prot opt source destination
MASQUERADE all — 172.16.0.0/24 0.0.0.0/0Chain OUTPUT (policy ACCEPT)
target prot opt source destinationWhat am I missing, I was hoping that stateful rules in IPTABLES would make the incoming traffic work properly, but apparently not?
Thanks in advance!
-
Sorry for the typos oabove. All the places where I’ve written 172.68.0.1 and 172.0.0.1, was of course reffering to 172.16.0.1, the ipaddress of the vnet0 interface.
-
I’m trying to redirect ports using DNAT ie 81 to port 80. The incoming packet is rewritten and sent to the right place, it seems the output packet is not getting rewritten properly ?
I have the following
iptables -t nat -A PREROUTING -i eth0 -p tcp -m tcp –dport 10022 -j DNAT –to-destination 172.16.0.113:22
iptables -A FORWARD -m state –state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -i eth0 -o vnet0 -m state –state NEW -j ACCEPT
iptables -A FORWARD -o eth0 -i vnet0 -m state –state NEW -j ACCEPT
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADEhelp anyone ?
Dave
-
Pingback from Portables Netzwerk auf dem Notebook « Bit 65 on 2010-02-01 at 22:57 UTC
-
Well, I answered my own question. Using VirtuaBox 3.14, it’s a simply a matter of choosing a Bridged Adapter from the Settings/Network/Adapter dialog.
I found this helpful reading: http://www.virtualbox.org/manual/ch06.html#network_bridged
Thanks,
Archer -
Hi everybody, thank you for this How-to.
Sorry for my English.
My problem is as follows:
I’m on Ubuntu 9.10 with VirtualBox 3.1.4, trying to get a virtualized Windows XP visible from the rest of my network.
I followed your guide step-by-step. The only difference is I selected “bridged” instead of “host-only”. Is this correct? (my VM interface is bridged to “vnet0″)
However, the only thing I obtain is XP being able to reach the network, not vice versa.
I obtain the exact same result if I select “bridged connection” and I link it to my “eth1″ wireless interface.
Guest ping host, host can’t ping guest.
What I’m missing? Is there something in Ubuntu 9.10 that block traffic somewhere?
Thank you very much in advance! -
Hi Tyler, thank you for your reply.
I checked the firewall on the guest system: the service is not even installed.
What should I do now? =) Thank you for your patience. -
Hello Tyler
Firstly, I want to thank you for this wonderful tutorial. I have moved to Ubuntu back in 2009 but normally I need to do a bunch of things with windows. I have an XP Guest for Gotomeeting and now I had too install a MS SQL Server and point a Java VM Application server to an SQL Db running into this XP Guest. Yesterday I had important help from an IT colleague (I am actually a business user, no IT background) and we managed to connect making a bridge to the wifi modem. No I fulfilled the job using your tutorial.
The only thing I cannot do is navigate the Internet from this XP guest. However I can successfully ping between host and guest and as I mentioned I can successfully connect the MS SQL database running into the guest VM. But I will keep trying.
Once again, thank you.
-
Finally! My migration from VMware to Virtualbox is complete. This was the only thing lacking in VB that VMware could do with it’s NAT’d interface (provide internal communications along with internet connectivity). Great article…thanks!
-
Hi geniuses (I don’t get a clue),
Might be this question was asked before, or might be differently. But what i want to do is relatively (me – you) simple. Work with my host as a jboss server and vbox’ as clients. I did the config above, and it work’s fine for the Internet connection and file sharing (smb). The problem rises when I enter (navigator) the url to get a resource on the server (like: 172.16.0.1:8080/app/xxx.html) from a guest box (172.16.0.4).
Is the config above works for this purpose ? if now how could I do that ?
Thanks in advance
-
Can you explain me what interfaces bridges the new vnet0 interface?
However, I know what a bridge is, I’m confused :S
-
Thank you very much ;-)
-
this solution has been rock solid for a good while. However, after upgrading to Ubuntu 11.10 x64, using the vnet0 bridge adapter will no longer allow my client VMs to see the internet. Anyone else seeing this?
-
Internet access in Virtualbox Host-only networking
http://jackal777.wordpress.com/2012/02/13/internet-access-in-virtualbox-host-only-networking/
-
Fantastic! Excellent write up which solved several pains in my……
Thanks!
-
I’m tried the tutorial on Ubuntu Oneiric 11.10 and Virtualbox 4.1 and it did not work for me.
The guest machine does not get an IP address:
Mar 17 12:04:17 wuhan dhclient: DHCPDISCOVER on eth2 to 255.255.255.255 port 67 interval 11
Mar 17 12:04:28 wuhan dhclient: No DHCPOFFERS received.It looks like no traffic is going back to the guest:
Mar 17 12:03:11 wellington dnsmasq-dhcp[1933]: DHCPDISCOVER(vnet0) 08:00:27:c2:98:8b
Mar 17 12:03:11 wellington dnsmasq-dhcp[1933]: DHCPOFFER(vnet0) 172.16.0.241 08:00:27:c2:98:8b
Mar 17 12:03:27 wellington dnsmasq-dhcp[1933]: DHCPDISCOVER(vnet0) 08:00:27:c2:98:8b
Mar 17 12:03:27 wellington dnsmasq-dhcp[1933]: DHCPOFFER(vnet0) 172.16.0.241 08:00:27:c2:98:8bAlso if i assign a static ip, i’m not able to ping from host to the guest.
68 comments
Comments feed for this article
Trackback link: http://www.tolaris.com/2009/03/05/using-host-networking-and-nat-with-virtualbox/trackback/