My network is somewhat simple: all PCs in my LAN (Ubuntu desktop, Win7 desktop, XP netbook) connected to a dlink home router, which is connected to ISP's cable modem. LAN has IP subnet, gateway (the dlink router) is, the PCs are, via DHCP. The PCs share folders among themselves (basic right-click -> share, this is samba, right?). So far, so good.

Now the Ubuntu desktop has VirtualBox. I was planning on installing sandboxed VMs to test malware (and monitor the way they "call home"). So I installed an Ubuntu VM, network set to NAT mode (the default mode, subnet I guess).

So I open up Nautilus in the VM, go to "network", and to my surprise... the VM is able to see all the shared folder in the host's LAN!!!

How? Isn't "Shared Folders" something that works on the LAN only? How come a VM that lives in another subnet can access, say, a shared folder in the Win7 machine? They are not in the same LAN! (that would be Virtualbox's "Bridged" mode, correct?). And no, I do not mean VirtualBox's "Share Folder" feature (that maps a host drive as a network share to the guest), I'm not using it.

So, I clearly lack some fundamental knowledge of how shared folders and NAT works.I assumed NAT would isolate the VM from my LAN while still being able to browse the internet. I am very surprised it was able to see my LAN's workgroups even being in a different subnet.

So, question is: How is that possible? How this relation between VirtualBox, Shared Folders and NAT works? And how to setup the VM so it can't see the guest's LAN but is still able to browse the internet?

  • It should not happen. Only in case of bridge network it is possible. How many adapters are enabled? Check other any other adapter is configured as bridged.. – Web-E Mar 30 '13 at 11:25
  • @Web-E: Nope... single adapter, default settings. Attached to 'NAT', TCP forwarding is blank. The folder sharing on my LAN is pretty permissive, but I never thought it would be visible from a non-bridged VM. – MestreLion Mar 30 '13 at 11:40
  • VirtualBox "Shared Folders" are a filesystem-driver thing between the host and the guest; they are not shared on the network. I'm pretty sure they have nothing to do with this issue. – ignis Apr 30 '13 at 15:52
  • @ignis: yes, I'm aware of that. My problem is not VB's 'Share Folders' , but my LAN 's shared folders (as used by Windows, Ubuntu, etc, via samba). The fact that a supposedly isolated VM can access those is my main concern. – MestreLion Apr 30 '13 at 21:24

Chapter 6. Virtual networking:

To an application on the host, or to another computer on the same network as the host, it looks like the data was sent by the VirtualBox application on the host, using an IP address belonging to the host. VirtualBox listens for replies to the packages sent, and repacks and resends them to the guest machine on its private network.

Networking in VirtualBox (Oracle Blogs):

Each vm thinks they are on their own isolated network. When they send their traffic via the gateway ( VirtualBox rewrites the packets to make them appear as though they originated from the Host, rather than the Guest (running inside the Host).

Like on a physical host, NAT impedes remote connections, but allows outgoing connections. I don't think there's a networking mode that can distinguish your LAN from the rest of Internet.

  • So the only way to test malware is to block all networking in a VM? There is no way to "shield" my LAN from it while still allowing the VM to access (public) internet? – MestreLion Apr 30 '13 at 21:26
  • It can be done with a firewall, maybe, but I don't know how to do it. Be aware that some malware detects that it is in a virtual machine, and behaves differently; other (rare) malware can escape an "isolated" virtual machine. – ignis May 1 '13 at 5:59
  • I don't think this is the case, but I'll be aware of that, thanks! – MestreLion May 1 '13 at 6:26
  • And, since I can't really isolate the VM, I guess I'll try another approach: to (somehow) configure the host to intercept all connections from guest and pretend it is the internet. Stay tuned for my next question ;) – MestreLion May 1 '13 at 6:28

Just a shot in the dark, you did say the ubuntu guest is The 24 would put them on the same subnet no?

  • is an IP from 10.10.10.x in the same lan as one with 10.0.2.x if they both have mask? – MestreLion Apr 29 '13 at 5:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.