{"id":1734,"date":"2025-12-01T19:26:53","date_gmt":"2025-12-02T01:26:53","guid":{"rendered":"https:\/\/zewwy.ca\/?p=1734"},"modified":"2025-12-23T20:31:03","modified_gmt":"2025-12-24T02:31:03","slug":"hyper-v-networking","status":"publish","type":"post","link":"https:\/\/zewwy.ca\/index.php\/2025\/12\/01\/hyper-v-networking\/","title":{"rendered":"Hyper-V Networking"},"content":{"rendered":"

Install Hyper-V, and let’s learn it’s Networking<\/p>\n

<\/span>Hyper-V Networking<\/span><\/h1>\n

On VMware, when you install the OS (ESXi) on the hardware in the DCUI you simply set the VLAN tag right on the network interface you configure, and bind it to a physical NIC in the menu area, simple.<\/p>\n

\n
\n
\n
\n

We leave the network connected to a non tagged, internet allowed connection. Now we can configure our networks.<\/p>\n

<\/span>1. Create one external switch<\/span><\/h2>\n
    \n
  • Bind it to your physical NIC (configured as a trunk on the upstream switch).<\/li>\n
  • Check \u201cAllow management OS to share this network adapter\u201d once \u2014 this creates the first host vNIC.<\/li>\n<\/ul>\n

    <\/span>2. Add more host vNICs via PowerShell:<\/span><\/h2>\n
    \n
    \n
    # Add another vNIC for the host bound to the same external switch\r\nAdd-VMNetworkAdapter -ManagementOS -Name \"HostVLAN20\" -SwitchName \"ExternalSwitch\"\r\nSet-VMNetworkAdapterVlan -ManagementOS -VMNetworkAdapterName \"HostVLAN20\" -Access -VlanID 6<\/code><\/pre>\n
    <\/span>3. Verify in Windows<\/span><\/h2>\n
      \n
    • You\u2019ll now see multiple vEthernet adapters<\/strong> in the host OS (e.g., \u201cvEthernet (HostVLAN20)\u201d, \u201cvEthernet (HostVLAN30)\u201d).<\/li>\n
    • Assign IP addresses or enable DHCP as needed.<\/li>\n<\/ul>\n
      *Note* this is for doing it on a single network server (for my lab use) usually you’d have dedicated NICs for other networks designated on those servers… anyway.. where was I… right now that we got additional network on the server we can work on a shared storage, you know how I like my iSCSI.<\/p>\n
      \n
      \n
      \n
      \n
      So, when I setup Hyper-V, and connect a VM to the “default” virtual switch, the Hyper-V server acts as a DHCP provider and NATs the connections from that vSwitch to whatever other network the host is connected to?<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n
      \n
      <\/div>\n
      \n
      \n
      Great question \u2014 this trips up a lot of people when they first use Hyper\u2011V! Let\u2019s break it down clearly:<\/p>\n
      <\/span>\ud83d\udda7 Hyper\u2011V Default Switch Behavior<\/span><\/h2>\n
        \n
      • Introduced in Windows 10 (1709)<\/strong>: The “Default Switch” is automatically created by Hyper\u2011V and cannot be deleted or modified.<\/li>\n
      • NAT (Network Address Translation)<\/strong>: Yes \u2014 the host machine provides NAT services. This means your VM\u2019s traffic is translated and routed through the host\u2019s network connection, regardless of whether that\u2019s Wi\u2011Fi, Ethernet, or even VPN.<\/li>\n
      • DHCP Services<\/strong>: The host also runs a lightweight DHCP service for the Default Switch. This is what hands out IP addresses to your VMs automatically (usually in the 172.16.x.x<\/code> range).<\/li>\n
      • Connectivity<\/strong>: VMs connected to the Default Switch can reach the internet and other devices on the host\u2019s network, but inbound connections from the LAN to the VM are limited. It\u2019s designed for convenience, not for complex networking setups.<\/li>\n<\/ul>\n
        <\/span>\u2696\ufe0f Comparison with Other Switch Types<\/span><\/h3>\n
        \n
        \n\n\n\n\n\n\n\n\n
        Switch Type<\/th>\nProvides DHCP?<\/th>\nProvides NAT?<\/th>\nUse Case<\/th>\n<\/tr>\n<\/thead>\n
        Default Switch<\/strong><\/td>\n\u2705 Yes (host DHCP)<\/td>\n\u2705 Yes (host NAT)<\/td>\nQuick setup, internet access without config<\/td>\n<\/tr>\n
        External Switch<\/strong><\/td>\n\u274c No (relies on external network DHCP)<\/td>\n\u274c No<\/td>\nVM directly on physical network, full LAN visibility<\/td>\n<\/tr>\n
        Internal Switch<\/strong><\/td>\n\u274c No<\/td>\n\u274c No<\/td>\nCommunication between host and VMs only<\/td>\n<\/tr>\n
        Private Switch<\/strong><\/td>\n\u274c No<\/td>\n\u274c No<\/td>\nCommunication between VMs only<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n
        <\/div>\n<\/div>\n
        \u2705 So to answer directly:<\/p>\n
        Yes \u2014 when you connect a VM to the Default Switch<\/strong>, Hyper\u2011V\u2019s host acts as a DHCP provider<\/strong> and NATs the VM\u2019s traffic<\/strong> to whatever network the host is connected to. It\u2019s essentially a convenience bridge so you don\u2019t have to manually configure networking.<\/p>\n<\/div>\n<\/div>\n<\/div>\n
        \n
        \n
        \n
        \n
        “That’s what I did configured a external virtual switch so the hosts NIC would be VLAN tagged in a certain network, I was figuring the default switch would act more like a … well switch at layer2 of the hosts Nic, so VMs on it would get DHCP from the main network, as if it was connected to a switch in the base network, not layer3 and then 4 NAT like c’mon…”<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n
        \n
        <\/div>\n
        \n
        \n
        Exactly \u2014 you\u2019ve nailed the distinction. The Default Switch<\/strong> in Hyper\u2011V is deliberately not<\/em> a true Layer\u20112 bridge to your host NIC. It\u2019s a convenience construct that Microsoft built to \u201cjust work\u201d for internet access without requiring you to mess with VLANs, external switches, or DHCP servers on your LAN.<\/p>\n
        Here\u2019s the breakdown:<\/p>\n
        <\/span>\ud83d\udd0c Why the Default Switch behaves like NAT<\/span><\/h2>\n
          \n
        • It\u2019s implemented using Windows Internet Connection Sharing (ICS)<\/strong> under the hood.<\/li>\n
        • ICS is a Layer\u20113 service: it provides a private subnet (usually 172.16.0.0\/12<\/code>), runs a DHCP service, and NATs traffic out through whatever adapter the host is using.<\/li>\n
        • That\u2019s why VMs on the Default Switch don\u2019t see your LAN\u2019s DHCP server \u2014 they only see the host\u2019s mini DHCP\/NAT service.<\/li>\n
        • It\u2019s intentionally isolated so you don\u2019t accidentally expose VMs directly to your corporate or home LAN without realizing it.<\/li>\n<\/ul>\n
          \u2696\ufe0f Why it\u2019s not Layer\u20112 bridging<\/p>\n
            \n
          • A true Layer\u20112 bridge would forward broadcasts (like DHCP Discover) from the VM to your LAN. That\u2019s what an External Virtual Switch<\/strong> does.<\/li>\n
          • The Default Switch instead terminates those broadcasts at the host and answers them itself. That\u2019s why you only ever get the host\u2011provided DHCP.<\/li>\n
          • VLAN tagging, trunking, or other advanced networking features aren\u2019t supported on the Default Switch \u2014 it\u2019s locked down.<\/li>\n<\/ul>\n
            \u2705 When to use each<\/p>\n
              \n
            • Default Switch (NAT + DHCP)<\/strong>: Quick internet access, testing, dev boxes, laptops where you don\u2019t want to reconfigure NICs.<\/li>\n
            • External Switch (Layer\u20112 bridge)<\/strong>: When you want VMs to behave like physical machines on your LAN, get DHCP from the real network, or use VLAN tagging.<\/li>\n
            • Internal\/Private Switches<\/strong>: For host\u2011VM communication or VM\u2011VM only networks.<\/li>\n<\/ul>\n
              <\/div>\n
              So your expectation \u2014 that the Default Switch would act like a transparent Layer\u20112 bridge \u2014 makes sense, but Microsoft intentionally designed it as a Layer\u20113 NAT gateway instead. If you want \u201creal switch\u201d behavior, the External Switch<\/strong> is the only way to go.<\/p>\n<\/div>\n<\/div>\n<\/div>\n
              \n
              \n
              \n
              \n
              “So, whatever my host machine is allowed to do, the guest VMs in the default switch are also allowed to do? like access the internet, and the firewall that gave the host the ability to access the internet would never see the private NATed IP address the Hyper-V host is dishing out to those VMs?”<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n
              \n
              <\/div>\n
              \n
              \n
              You\u2019ve got it \u2014 that\u2019s exactly how the Default Switch<\/strong> works in Hyper\u2011V. Let me spell it out clearly:<\/p>\n
              <\/span>\ud83c\udf10 How traffic flows with the Default Switch<\/span><\/h2>\n
                \n
              • VMs get private IPs<\/strong>: Each VM connected to the Default Switch is assigned an IP from the host\u2019s internal DHCP service (usually 172.16.x.x<\/code>).<\/li>\n
              • Host does NAT<\/strong>: The Hyper\u2011V host translates those private IPs into its own IP before sending traffic out to the physical network.<\/li>\n
              • Firewall visibility<\/strong>: From the perspective of your upstream firewall or router, all traffic from those VMs looks like it\u2019s coming from the host\u2019s IP. The firewall never sees the VM\u2019s private NATed addresses.<\/li>\n
              • Permissions<\/strong>: Whatever the host is allowed to do (e.g., access the internet, reach certain networks), the VMs can also do \u2014 because their traffic is piggybacking on the host\u2019s connection.<\/li>\n<\/ul>\n
                \u2696\ufe0f Important implications<\/p>\n
                  \n
                • Outbound access<\/strong>: VMs can reach the internet or LAN resources as long as the host can. They inherit the host\u2019s connectivity.<\/li>\n
                • Inbound access<\/strong>: External devices cannot directly initiate connections to those VMs, because NAT blocks unsolicited inbound traffic unless you set up port forwarding (which the Default Switch doesn\u2019t expose for configuration).<\/li>\n
                • Firewall rules<\/strong>: The upstream firewall only enforces rules against the host\u2019s IP. If you need per\u2011VM visibility or control, you\u2019ll need an External Switch<\/strong> so each VM gets its own LAN IP.<\/li>\n<\/ul>\n
                  <\/div>\n
                  \u2705 So yes: the Default Switch makes your VMs \u201cride along\u201d with the host\u2019s network permissions. They\u2019re hidden behind NAT, which is why your firewall only ever sees the host\u2019s traffic.<\/p>\n
                  <\/span>Additional Information<\/span><\/h1>\n
                  If you want to apply a VLAN tag to a physical NIC that’s not a Hyper-V host on Windows:<\/p>\n
                  Since I didn’t see anything in the usual Network\u00a0 IPv4 configuration window in Windows. I decided to see how useful this AI stuff is.. so I asked it…<\/p>\n
                  \n
                  \n
                  \n
                  \n
                  \n
                  \n
                  \n
                  \n
                  \n
                  “how do I VLAN tag the IP on windows 11 interface?”<\/div>\n
                  <\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n
                  \n
                  \n
                  \n
                  Quick Answer:<\/strong> On Windows 11, VLAN tagging isn\u2019t enabled by default. You need a NIC that supports IEEE 802.1Q VLAN tagging, then configure the VLAN ID either through the NIC\u2019s Device Manager properties<\/strong> (Advanced tab \u2192 VLAN ID) or by using Intel PROSet\/ANS tools<\/strong> or PowerShell (<\/strong>Set-NetAdapter -VlanID<\/code>)<\/strong> if your driver supports it.<\/p>\n
                  <\/div>\n
                  <\/span>\ud83d\udda5\ufe0f Steps to Configure VLAN Tagging on Windows 11<\/span><\/h2>\n
                  1. Check NIC Compatibility<\/p>\n
                    \n
                  • VLAN tagging requires a network card (NIC) that supports IEEE 802.1Q<\/strong>.<\/li>\n
                  • Not all NICs expose VLAN options in Windows. Intel and Broadcom NICs often support it, but you may need vendor-specific drivers.<\/li>\n<\/ul>\n
                    2. Configure via Device Manager<\/p>\n