How are apps in VM connecting to the internet?

I have Windows Firewall set to BLOCK all incoming and outgoing connections by default.

I have installed VMware and VirtualBox. And Virtual Machines inside each of them.

Both VMware and VirtualBox are blocked under Firewall (as that is the default setting).

But I am able to access my local network as well as internet using apps inside the VMs.

How is this possible?

Because a VM uses a virtual network adapter and uses its own firewall and hosts file. You can use the vm's firewall to block whatever you want. A VM guest is a separate computing environment independent of the OS and controlled by your VM software.

glasskuter said:

Because a VM uses a virtual network adapter and uses its own firewall and hosts file. You can use the vm's firewall to block whatever you want. A VM guest is a separate computing environment independent of the OS and controlled by your VM software.

Click to expand...

But VM software itself is dependent on the host machine, isn't it? And by consequence, is fully controllable by the host machine?



I had to use 'Bridged' connection to make it connect to the internet.

From what you say, does Windows Firewall have no control over the VM?

True, the OS runs the VM software but a VM guest is under independent control of the software, not the OS running it. The virtual machine is partitioned from the rest of the system, meaning that the software inside a VM can't interfere with the host computer's primary operating system. In turn, the primary operating system can't interfere with the VM. The magic happens within the VM software.
The whole purpose of virtualization software is to completely separate one OS from another.
Look at it this way, if you had 2 computers sitting side by side, would you expect the firewall on one to control the other?

glasskuter said:

True, the OS runs the VM software but a VM guest is under independent control of the software, not the OS running it. The virtual machine is partitioned from the rest of the system, meaning that the software inside a VM can't interfere with the host computer's primary operating system. In turn, the primary operating system can't interfere with the VM. The magic happens within the VM software.
The whole purpose of virtualization software is to completely separate one OS from another.
Look at it this way, if you had 2 computers sitting side by side, would you expect the firewall on one to control the other?

Click to expand...

The guest OS is under full control of the VM software, and the VM software is (should be) under full control of the host OS. It is fine that the host OS need not have direct control over what runs inside the guest OS, as that is controlled by the VM software. But there should be indirect control over the same by controlling what the VM software is allowed or not allowed to do. Atleast that is what I have been thinking.

Both VirtualBox and VMware are Type 2 Hypervisors, that run on a Host OS just as any other application/ program. If they were to have direct access to the hardware and act completely independent of the host OS, they would be classified as Type 1 Hypervisors, which they are not. Your example of 2 computers is not applicable for Type 2 Hypervisors.



I installed the VMware Tools yesterday and during installation, I got this:



When I didn't allow, the installation failed. But when I allowed it, the installation completed successfully.

I am not comfortable with this kind of a setup. Do you know what this is?

I want VMware (or VirtualBox) to run (even in background) only when I explicitly launch them. They shouldn't be running independently without permission. How do I configure it that way?

I know 2 computers are not the same. I said that as a hypothetical example of 2 operating systems because that's what a VM is, a separate OS. Actually, my statement should have said, VM software is dependent on the OS, a VM guest is dependent on the VM software and independent of the OS.
VMware abstracts the physical hardware underneath the hypervisor and virtual machines do not care what hardware is underneath them, even if it is changed. That's where VMWare tools comes in. Guess you could say VMWare Tools is the drivers for the guest. Just as functions of the Windows host can't run without drivers, neither can the virtual devices of a Guest OS run correctly without its driver set.

When you see that message above, "Would like to administer your computer', the word Computer means the guest OS.

VMWare software installs services in the host OS. Therefore, you can control the operation of the software from the host. You can also change the virtual services of the guest OS from within the guest. If you just want the guest to have internet access but not be seen by your local network, turn off network discovery within the guest itself. If you want to restrict a piece of software in the guest from accessing the internet, use the guest OS firewall. If you want to block the guest from accessing a particular IP address, block it in the guest's hosts file or firewall.

So, yes, you do have control.

glasskuter said:

Because a VM uses a virtual network adapter and uses its own firewall and hosts file. You can use the vm's firewall to block whatever you want. A VM guest is a separate computing environment independent of the OS and controlled by your VM software.

Click to expand...

I don't understand why the Windows firewall wouldn't block all incoming and outgoing connections. On my laptop when I'm running Linux Mint in VMware Player, Eset Internet Security running on the host OS still blocks webpages that are a possible risk.

Winuser said:

I don't understand why the Windows firewall wouldn't block all incoming and outgoing connections

Click to expand...

The concept of virtualization has always been mostly smoke and mirrors to me because it is so complex. That's why I call VMWare magic.

I found a VMWare article about how network traffic from a VM guest is handled. It states "the NAT device translates the address of the virtual machine to that of the host before forwarding the packet to the external network. When data arrives from the external network for the virtual machine on the private network, the NAT device receives the data, replaces the network address with that of the virtual machine and forwards the data to the virtual machine on the virtual network."

I interpret this to be why the host firewall doesn't block the traffic...because the outgoing traffic from the VM never goes thru the OS firewall but straight to the network. Incoming traffic is translated to go straight to the VM guest, also bypassing the OS firewall.
Whereas outgoing traffic from the host OS hits the firewall first (where it is blocked) before it can ever get to the network.

The entire article is long and a lot is over my head , but maybe you can find your answers by understanding NAT-Network address translator. https://www.vmware.com/support/ws45/doc/network_nat_details_ws.html

Winuser said:

Eset Internet Security running on the host OS still blocks webpages that are a possible risk.

Click to expand...

But doesn't ESET have it's own firewall? Third Party firewalls work differently than Windows Defender Firewall, do they not? I believe most third party firewalls are cloud based these days and block traffic after the packets leave your computer but before they get to the destination. Windows firewall blocks traffic at the OS level.

Darn, all this has fried my brain. Somebody else jump in here and explain it in a better way.

glasskuter said:

I know 2 computers are not the same. I said that as a hypothetical example of 2 operating systems because that's what a VM is, a separate OS. Actually, my statement should have said, VM software is dependent on the OS, a VM guest is dependent on the VM software and independent of the OS.
VMware abstracts the physical hardware underneath the hypervisor and virtual machines do not care what hardware is underneath them, even if it is changed. That's where VMWare tools comes in. Guess you could say VMWare Tools is the drivers for the guest. Just as functions of the Windows host can't run without drivers, neither can the virtual devices of a Guest OS run correctly without its driver set.

When you see that message above, "Would like to administer your computer', the word Computer means the guest OS.

VMWare software installs services in the host OS. Therefore, you can control the operation of the software from the host. You can also change the virtual services of the guest OS from within the guest. If you just want the guest to have internet access but not be seen by your local network, turn off network discovery within the guest itself. If you want to restrict a piece of software in the guest from accessing the internet, use the guest OS firewall. If you want to block the guest from accessing a particular IP address, block it in the guest's hosts file or firewall.

So, yes, you do have control.
View attachment 15856

Click to expand...

1st para: Yes, no questions.

2nd para: Yes, I know it is referring to the guest OS. I see that VMware logs me in automatically without my password, even though it says that the guest OS doesn't support this feature under VM settings. While this alone is fine, what else does VMware control? Is it safe to login with a real account in the VM and be safe?

3rd para: How do I ensure that VMware (and the guest OSes) do nothing in the background other than the activities I do explicitly when I launch them? Configuring what apps can do inside the OS is not the question here. It is what the guest OS (and the VM software) itself can do. I thought if I block the VM software itself under Windows Firewall, neither the software nor the guest OS inside it would be able to connect to the internet. But that's not what is happening. The VM is essentially bypassing restrictions imposed by the Host OS.

You know, in all these long posts I never asked what version of VMWare you are using. Where are you storing your VM files? Did you use the default location of C:\Users\Username\Documents\VMWare. If you did, every time you backup your OS you will be backing up your VM as well. Personally I use VMWare Workstation Pro and store my VMs on an external hard drive so I have to remember to back them up separately. I am giving my suggestions based on the version of VMWARE I am running. It may be slightly different in whatever version you are using and some versions may have limitations. I can only tell you how mine works.

I am using my Microsoft account and a pin to access my virtual machine. (Settings-Accounts) If your version does not allow an account password,
you can encrypt your VM if you want to secure it with an encryption password . Here's a good article about encryption. HERE.

I am able to isolate my Windows 10 VM from the internet by going into Network and Sharing (in the VM)and disabling the virtual adapter. It does not affect my host. Some versions of the software have you go into Edit-Virtual Network Settings to disable the adapter. From what I've read, your virtual network adapter needs to be set up as NAT instead of bridged so I don't know if when you established your VM how you set up your virtual network adapter. https://www.vmware.com/support/ws45/doc/network_configure_ws.html
I believe you could isolate the guest by turning off ipv4 and ipv6 as well.
However you do it, you want to do it in such a way that you can easily enable internet when needed to update the VM. VMWare tools updates at times as well so it will need internet to update.

To disable VMWare in host-(Drastic method)You can stop all the VMWare services in the host and then change their startup type to disabled. VMWare will not run if its services are disabled. When you use the VM you will have to change startup type to manual or automatic and start the services every time before VMWare will open.
OR
You can stop the services and change startup type to manual. Then the services will not be running until you open VMWARE. This makes more sense to me.

Any software within the guest can be blocked using the guest's firewall.

All this said, I must say I am having difficulty understanding why you want internet turned off for your VM. If VMWARE is Not running no one can use the internet to get into your VM guest.

I am new just joined. Not sure how to start a new thread, so this is the closest one I found. I am a big fan of vmware workstation, especially for trying out Windows 11. I use the defaults when making a new machine and they work well. Sometimes for no reason, the connection totally goes and I get the round globe rather than the connected symbol. I can just start using a new machine I made, but this has happened enough times to find out why it is doing this and how to fix The message I get is Not connected you aren't connected to any networks and Ethernet- no internet. I have compared the non-working virtual with a working and so far the setting are the same.

@Erin Robinson This article should get you going https://kb.vmware.com/s/article/2019836
To make a post, first choose the category in the forum where you want your post to be and select it.
When you do, you will see "post thread"

Thanks! Appreciate it.

Oh My Gosh! You did it! One of the links on the webpage you recommended suggested that a new connection should be added from the VM settings. So I deleted the original, added the connection and it created it right from scratch. And it works! Thank you so much, good to keep this tip handy. I am so glad.

The safest way to block Internet access is to use the Firewall / rules built in to most roouters these days. A VM uses its own "Virtual Bios" and "Virtual hardware" so unless your VM Internet access is set to go via a proxy on your HOST machine - the Windows firewall being software won't look at anything the VM s passing.

You might be able to do something if you can block the MACID's of the network devices - but its simpler to set up the hardware router to block things -- also on the VM see what happens when you activate a firewall on it.

For your VM's : On Linux distros it's often ufw and on windows you can control it as standard.

heers
jimbo