Learning Hub / Building Your Lab / Lab Networking & Isolation

Lab Networking & Isolation

Guide 1.2 Difficulty: Beginner ~15 minutes

Networking is the single most important safety decision in your lab. Get it right and your vulnerable targets can talk to your attacker — but never to your home Wi-Fi, your other devices, or the internet. This guide explains the options and sets up a safe, isolated network.

Never bridge a deliberately vulnerable machine onto your real network. Targets like Metasploitable are designed to be hacked; exposing them to your home network or the internet puts every device you own at risk.

VirtualBox networking modes

VirtualBox gives each VM one or more virtual network adapters, and each adapter can run in a different mode. The four you'll meet most:

ModeVM → InternetVM ↔ VMHost ↔ VMUse it for
NAT✅ Yes❌ No❌ NoDownloading updates/tools onto a single VM.
NAT Network✅ Yes✅ Yes❌ NoVMs that need both internet and to see each other.
Host-only❌ No✅ Yes✅ YesThe isolated lab network — our default.
Bridged✅ Yes✅ Yes✅ Yes⚠️ Exposes the VM on your real LAN. Avoid for targets.
Internal❌ No✅ Yes❌ NoFully sealed VM-to-VM only (not even the host).

Our recommended design

We'll give your lab a host-only network as its primary, isolated network. This lets the attacker and targets communicate and lets your host reach them (handy for copying files or viewing web apps), while keeping everything off the internet.

For the rare moments a VM genuinely needs internet access (for example, updating Kali), you can temporarily add a second NAT adapter, update, then remove it again.

Lab network design diagram: a host-only network 192.168.56.0/24 connecting the host, the Kali attacker, DVWA, and Metasploitable, with no route to the internet
Figure 1. The isolated host-only network all lab machines will share.

Step 1 — Create the host-only network

  1. Open the Network Manager

    In VirtualBox, go to File → Tools → Network Manager (older versions: File → Host Network Manager).

  2. Create a Host-only network

    Select the Host-only Networks tab and click Create. VirtualBox adds an adapter, typically on the 192.168.56.0/24 range.

    VirtualBox Network Manager showing a newly created host-only network on the 192.168.56.0/24 range
    Figure 2. A host-only network created in the Network Manager.

  3. Decide on DHCP

    You can enable the built-in DHCP server so VMs get an IP automatically, or disable it and set static IPs inside each VM. For a beginner lab, leaving DHCP enabled is simplest.

Step 2 — Attach a VM to the network

When you create each VM later, open its Settings → Network and set Adapter 1 to Host-only Adapter, choosing the network you just created.

VirtualBox VM network settings with Adapter 1 attached to Host-only Adapter
Figure 3. Attaching a VM's adapter to the host-only network.

Step 3 — Verify isolation

Once you have a VM running on this network, confirm two things from inside it:

on a lab VM
$ ip a            # you should have a 192.168.56.x address
$ ping -c2 192.168.56.1   # the host should reply
$ ping -c2 8.8.8.8        # this should FAIL — no internet = isolated

Checkpoint: lab VMs can reach each other and the host on 192.168.56.x, but cannot reach the internet. That's exactly what we want.

Temporary internet access (when needed)

To update Kali or download a tool, add a second adapter set to NAT, boot the VM, do the update, then shut down and disable that adapter again. Keep targets like Metasploitable permanently offline.

← Previous1.1 Install VirtualBox