Networking Your Lab

The last lesson, choosing-virtualization, left a hypervisor running two guest machines: an attacker box, and something built to be attacked. Two machines on the same host do nothing to each other until they can exchange packets. This lesson is about that wiring, and about one connection in particular that must never get made.

A deliberately vulnerable machine is, by design, a box anyone can break into in minutes. That is the whole point of it. The only question worth caring about is who "anyone" is allowed to be. Leave that machine connected to the home network and the answer becomes: whoever breaks in gets the home network too. Every phone, laptop, and smart plug in the house is suddenly sitting one hop away from a box that was built to fall over. So the wiring is not a detail. It is the thing that keeps a practice lab from becoming an incident in the living room.

The adapter and the switch it plugs into

Every guest the hypervisor runs gets a virtual network adapter: a piece of emulated hardware that behaves, from inside the guest, exactly like a real network card. The guest operating system sees a network interface, asks for an address, sends and receives packets, and never learns the card is software. Guest and host were the two words the previous lesson pinned down. The guest is the virtual machine. The host is the physical computer running the hypervisor.

That virtual adapter has to plug into something. The something is a virtual switch: software inside the hypervisor that moves packets between adapters the same way a physical switch moves them between ports. A switch, from networking foundations, forwards data between machines on one local network and makes its decisions on MAC addresses. The hypervisor's virtual switch does the identical job for the guests attached to it. The guests do not know the switch is fake any more than they know the card is.

Here is the whole idea in one sentence. The networking mode of a virtual machine is a single choice: which virtual switch its adapter plugs into, and whether that switch has a path out to the physical network. Everything else, every difference between the four modes below, follows from that one decision. Get the mental model right and the modes stop being a menu to memorize.

The four modes, by what each one can reach

Four modes cover almost every hypervisor. The names differ slightly between VirtualBox, VMware, and the rest, but the four behaviors are the same, and the only question that matters for each is: what can a guest on this mode reach, and what can reach it.

Bridged joins the virtual switch to the host's physical adapter. The guest appears on the real local network as its own host, with its own address handed out by the real router, exactly as if a second laptop had been plugged into the wall. It reaches the internet and every device in the house, and every device in the house reaches it. For a trusted utility VM that is convenient. For a target it is the single setting that turns a lab into a liability. Bridged is the one connection from the opening that must never be made to a vulnerable box.

NAT puts the guest behind the hypervisor on a small private network, and the hypervisor acts as its router. NAT is Network Address Translation, and it is worth understanding by what it actually does to a packet. When the guest sends a packet toward the internet, the hypervisor rewrites the source address from the guest's private address to the host's own address, forwards it, and remembers the swap. When the reply comes back to the host, the hypervisor looks up the swap and rewrites the destination back to the guest. This is precisely what the home router, the default gateway from networking foundations, does for every device in a house. The consequence is a one-way door. The guest can reach out, which is how an attacker box runs apt update and downloads tools, but nothing on the local network can reach in unless a port is deliberately forwarded. And by default, two plain-NAT guests cannot even see each other; each sits alone behind its own translation.

Host-only cuts the cord. The virtual switch has no connection to the host's physical adapter at all. It is a private segment, a self-contained little network, shared by the host and whichever guests are attached to it. Those guests see each other and see the host. None of them can reach the internet, because there is no route to it. This is the backbone of a lab: a place where machines can talk freely and go nowhere.

Internal is host-only with the host removed. The virtual switch connects the guests to each other and to nothing else, not even the physical machine running the hypervisor. It is the most sealed of the four. A target on an internal network is reachable only by other guests on that same internal network, and by absolutely nothing on the physical side.

Why the isolated segment matters

A deliberately vulnerable target is going to get fully compromised. That is not a risk to avoid, it is the assignment. And the moment a target is owned, it stops being a passive box and becomes a launch point. Whoever controls it can now send packets to everything that box can reach.

That move, using one compromised machine to attack machines it can talk to but the attacker could not reach directly, is called pivoting. It is not a lab curiosity. It is a real, named stage of real intrusions: break one exposed machine, then ride it deeper into the network behind it. A vulnerable VM sitting on a bridged adapter, or on a NAT adapter with a route back to the house, is a pre-built pivot pointed straight at the home network. Break the target on purpose during practice, and the same route that let the practice happen now reaches the real devices.

The isolated segment removes the route entirely. A target on host-only or internal has no path off its segment, before compromise or after it. There is nothing to pivot to, because the virtual switch it is plugged into does not connect anywhere else. Full compromise of that box gets an attacker exactly one box.

Which raises the practical problem. The attacker machine needs two things that seem to pull against each other: it must reach the internet to pull down tools, and it must reach the targets to attack them. One adapter cannot safely do both, because an adapter that reaches the internet is an adapter the targets could ride to the internet. The standard answer is to give the attacker box two adapters at once, each doing one job.

Prove it before breaking anything

Wiring the adapters is half the job. The other half is confirming the wiring does what it should, because a lab that only looks isolated is worse than no lab: it invites exactly the behavior it fails to contain. Two checks settle it. The target can reach the attacker. The target cannot reach the internet.

Run these from inside the target VM. The addresses below come from one specific VirtualBox setup, where the default host-only network is 192.168.56.0/24; the attacker box is at 192.168.56.101 and the target at 192.168.56.102. Any real lab will show its own numbers.

$ip a

One interface, enp0s3, on the host-only subnet, with a MAC that starts 08:00:27, the prefix VirtualBox assigns to the adapters it emulates. There is no second interface with an internet route, which is the point. Now the two checks.

$ping -c2 192.168.56.101

$ping -c2 8.8.8.8

The first result, replies from the attacker box, confirms the two VMs share a segment. The second result is the one that matters, and the one most people skip. Network is unreachable is not a failure to celebrate quietly and move past. It is the proof. A host-only-only target has no default gateway, so the kernel finds no route toward 8.8.8.8 and refuses to even send the packet. That refusal is the isolation working. If those pings had come back with replies instead, the target has a way off the lab, and that gets fixed before anything else happens to the box. A target that can call home is a target that can be used to reach further than intended.

From the attacker side, one sweep confirms the shape of the segment: the target is up where it should be, and nothing from the real home network appears on it.

$nmap -sn 192.168.56.0/24

Three hosts, no strangers. 192.168.56.1 is the host's foot on the segment, .101 is the attacker box itself, .102 is the target. If a phone or a smart TV from the real house had shown up in that list, the attacker adapter would be touching the home network, and the dual-adapter recipe would be broken. The whole segment answered in three hits, which is what a clean, sealed lab looks like.

The segment is sealed and proven sealed. What it does not have yet is anything worth attacking; a lab with one blank target teaches nothing. The next lesson, stocking-it-with-targets, covers where legitimate vulnerable machines come from, places like VulnHub and the deliberately vulnerable applications built for practice, how to verify what gets downloaded is what it claims to be, and how to line targets up from gentle to brutal so the difficulty climbs instead of spiking.