Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Host: Linux/Debian/Ubuntu/Mint (Helena/karmic koala)
Guest: XP SP2 and SP3
Problem: Relatively new copy of XP migrated to vbox-virus free. To detect viral infection it is desired that internet access is limited. Network access to the host is desired, but access to the internet should be limited to a select few sites.

The added overhead of network access should be small when the guest vbox is running, 0 when it is not.

share|improve this question

VirtualBox isn't capable (at least to my knowledge) of accomplishing network filtering in that regard.

What I would recommend you do is setup a second virtual machine that acts as a firewall/gateway for the XP VMs. I personally like pfSense, m0n0wall, Smoothwall, etc... but really whatever you feel comfortable with is important. They all have the capability to filter outbound traffic.

Setup the firewall appliance with either bridged or nat network access on one adapter, and a second internal network only adapter. Configure the XP VMs to only have a single adapter, attached to that same internal interface.

share|improve this answer

Virtualbox does have three settings:

NAT: Allows for outside network access, but the VM cannot see internal systems.

Bridged: Allows for outside and inside access. This is the equivalent of having the VM act as another system on the network.

Host-only: This will allow the VM to only communicate with the host. Essentially, your VM software acts as a router.

If you would like your VM to only see your host, then host-only is the way to go. If you would like your VM to see the outside (you mentioned a few sites), then you would need to use NAT or Bridged and have a firewall configured to grant/restrict access to that machine. I wouldn't recommend NAT, since you would then need to restrict the host machine. I would enable bridged, and use a firewall (or external router) to selectively restrict traffic on that specific IP.

Note: Since you are examining a system for a virus infection, do not install a firewall on the guest OS. It would not be a good test, as you have no real expectation that the malware will not interfere with it, and a firewall on the guest may interfere with the experiment you wish to conduct.

share|improve this answer

unfortunately virtualbox only supports three (well, for the purpose of this message, anyway) networking possibilties: internal, for all virtual machines, external, so it can access the hosted network/internet or off.

you could go into the windows guest and turn the firewall on, changing it to block all sites that the machine can access except the few you choose. Of course, I wouldnt reccomend running windows firewall by itself but unless you want to pay for proper software (or try open source)

share|improve this answer
what do you have against the windows firewall? – warren Jun 18 '10 at 19:04

You're going to need to install a firewall on the guest OS and configure it to do what you're looking for. Virtualbox doesn't have the fine-grained network restrictions that you're looking for.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.