guidox / Software
Create an **Internal** switch, give the host vNIC an address, then add **New-NetNat** for the subnet. Set a static IP inside the guest and it survives reboots.
The default switch is NAT but its subnet changes. A named internal switch plus a NAT object is the stable version of the same idea.
Get-WindowsOptionalFeature -Online -FeatureName Microsoft-Hyper-V-All | Select-Object FeatureName,State
Get-VMSwitch | Select-Object Name,SwitchType,NetAdapterInterfaceDescription
Get-NetNat | Select-Object Name,InternalIPInterfaceAddressPrefixAn **Internal** switch connects the host and the guests only. The host gets a virtual adapter that becomes the gateway for the guest subnet.
New-VMSwitch -Name 'NAT-LAB' -SwitchType Internal
Get-VMSwitch -Name 'NAT-LAB' | Select-Object Name,SwitchType,NetAdapterInterfaceDescription
Get-NetAdapter | Where-Object Name -like '*NAT-LAB*' | Select-Object Name,InterfaceIndex,StatusThe host needs an address inside the guest subnet and a prefix length. This address becomes the default gateway for the VMs.
$idx = (Get-NetAdapter | Where-Object Name -like '*NAT-LAB*').InterfaceIndex
New-NetIPAddress -IPAddress 192.168.100.1 -PrefixLength 24 -InterfaceIndex $idx
Get-NetIPAddress -InterfaceIndex $idx | Select-Object IPAddress,PrefixLength,AddressFamily**New-NetNat** translates the guest subnet to the host's uplink. Without it, the VMs can reach the host but not the internet.
New-NetNat -Name 'NAT-LAB' -InternalIPInterfaceAddressPrefix '192.168.100.0/24'
Get-NetNat | Select-Object Name,InternalIPInterfaceAddressPrefix,Active
Get-NetNatSession -NatName 'NAT-LAB' -ErrorAction SilentlyContinue | Measure-ObjectThe guest uses the host as gateway and a public DNS server. Setting it inside the guest keeps the address across host reboots.
Connect-VMNetworkAdapter -VMName 'LabVM' -SwitchName 'NAT-LAB'
Get-VMNetworkAdapter -VMName 'LabVM' | Select-Object VMName,SwitchName,IPAddresses
# inside the guest:
# netsh interface ip set address name="Ethernet" static 192.168.100.10 255.255.255.0 192.168.100.1
# netsh interface ip set dns name="Ethernet" static 1.1.1.1The guest should ping the host, reach the internet and resolve names. A ping that works while DNS fails points at the guest's DNS setting.
Get-VMNetworkAdapter -VMName 'LabVM' | Select-Object IPAddresses
# inside the guest:
# ping 192.168.100.1
# ping 1.1.1.1
# nslookup example.com
Get-NetNatSession -NatName 'NAT-LAB' | Select-Object -First 5 InternalSourceAddress,ExternalSourceAddressThe adapter is not connected to the new switch, or the guest is set to a different subnet. Check Get-VMNetworkAdapter and the guest's IP.
The NAT object is missing or has the wrong prefix. It must match the host adapter's subnet exactly.
Only one NAT object can exist per host in most configurations. Remove the old one with Remove-NetNat first.
The physical adapter was bound to the switch by mistake. Use an Internal switch, not External, for this setup.
For a lab yes: the subnet is fixed and the addresses survive reboots. The default switch is simpler for quick tests.
Yes, they share the switch and the subnet. That is also why an infected guest can reach the others.
Only with a DNS or hosts entry. NAT does not provide name resolution.
Remove the NAT with Remove-NetNat -Name 'NAT-LAB', delete the switch with Remove-VMSwitch -Name 'NAT-LAB', and remove the host address with Remove-NetIPAddress -IPAddress 192.168.100.1.
Free · no account needed · tracks your progress