Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Supposing I have an untrusted guest VM (e.g. I'm running a cloud data centre). If I set the network connection up to use NAT, the guest can still access the internet. But what's to stop them accessing the host LAN too? How does the NAT handling in the VM host manage to distinguish between say (on the internet) and my.local.domainserver (on the host LAN), and prevent access to the latter?

share|improve this question
The same way any network can distinguish between the two. Routing rules. – Terry Chia Jun 21 '13 at 3:34
What VM software are you using? – schroeder Jun 25 '13 at 21:49

When you configure the network on VMware player for instance to be in "NAT" mode, it'll simply do a "NAT HIDE", in which your host, after sending traffic to the network card, will have his SOURCE IP changed to the HOST IP (this is also know as PAT, port address translation).

If you don't have any specific rules on the HOST firewall denying traffic between vm network and host network then you will be able to access your host.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.