I've got the following situation.

I've got one physical machine which is connected to the Internet.

It runs one virtual machine which can be made to utilize the host Internet connection.

I wish to disable the Internet Connection on the host machine but only forward it to the virtual machine.

Is there any trick or a smart configuration or a registry entry or something to "break" the Internet access on the host machine to all applications, processes and services but only let it be used from the virtual machine?

Basically I wish to have a safe working environment on the physical machine and have an isolated virtual space for browsing.

The virtualization technology is Hyper-V.


My host machine effectively has two physical network adapters:

  • Intel WLAN Adapter
  • Gigabit Ethernet Adapter

I'm currently using WLAN connection to the router. Ethernet is unused.


The correct way to do this is have two network adapters on your server. Hyper-V allows the guest OS's to have exclusive use on a network adapter that is on the host, so the host will not be able to use that adapter at all.

enter image description here

Just un-check the box for Allow management operating system to share this network adapter

If you are willing to live with no network access at all you can just un-check that box for the only adapter on your system. For the times you do need it, just check that box temporarily then un-check it when you are done.

| improve this answer | |
  • Would this work with a Wireless adapter? – some-guy Apr 16 '12 at 15:28
  • As per this TechNet page Hyper-V does not support wireless networks. An external virtual network provides access to a physical network through a wired physical network adapter. – Scott Chamberlain Apr 16 '12 at 15:31
  • And why do you say I need two network adapters? What for? Something escapes me here... – some-guy Apr 16 '12 at 15:35
  • Ok, this is not a big deal to switch the router to the cable if this will solve the problem. – some-guy Apr 16 '12 at 15:36
  • If you un-check the box the host OS will not be able to use the network adapter the VM is bound to AT ALL. You will not be able to connect to any network resource (printers, other computers, ect), not just the internet. If you want the host OS to talk to anything on the LAN you will need to either use a second network adapter (which could be wireless), or re-check the box during the times you need to use the network on your LAN. – Scott Chamberlain Apr 16 '12 at 15:38

What host OS do you use? That seems pretty important in this case. I assume Windows as host. The guest OS is not relevant I think. If that works, it works. Your question concerns the firewall, as it is about outgoing traffic.

There are two types of (software) firewalls. The first type blocks by port number. Http-traffic is port 80 and https is port 443, although sometimes 8080 and 8443 are used as well. Ftp is port 21, ssh is 22, etc. This is not useful for you. If you block port 80 on the host, the guest is blocked as well.

The second type of firewall blocks by application. So if you use firefox on the host and open a web page, the firewall notices this request, and asks you what to do. You can block this, and you can probably set it to block all apps, except for one: the VM application. So if you use Virtualbox, and open a webpage in firefox in the guest, which runs in Virtualbox, I think (but am not 100% sure) that the host firewall will see this as a request by Virtualbox, not by firefox. Then you allow this traffic.

Free firewalls like Comodo can do this. OSX has a built in firewall that can do this. Probably the built in Windows firewall can do this. I suppose there will be a firewall that can do the same in Ubuntu. So I think it can be done in any host OS.

| improve this answer | |

The easiest would be to do that via IP address filtering or proxy-access.

  • Allow access via proxy only and configure it inside the VM, but not on the host.
  • let the vm get her own (static) ipaddress and open Internetaccess for that ipaddress on your networkfirewall, but not your physical machine.

You can even do that by configuring a proxy on your physical machine. I had a Java-based one, which allowed to differentiate between routing and local access. So that would help with yours too. Can't recall the name anymore, though.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.