Lab Networking

Your lab contains deliberately broken machines. If they can reach the internet or your home network, they become a danger.

Isolated networking keeps attack traffic and malware contained between your VMs only.

NAT (Network Address Translation) gives a VM internet access through the host, but the VM is hidden behind the host IP.

• Good for updating Kali or downloading tools.
• Bad for connecting VMs to each other - they cannot see one another by default.

A NAT Network (distinct from plain NAT) lets multiple VMs share one NATed network and talk to each other, while still reaching the internet through the host.

Useful when your lab VMs need both internet and inter-VM communication.

Bridged mode puts the VM directly on your physical LAN with its own IP, as if it were a separate physical computer.

Avoid this for vulnerable VMs - it exposes them to your whole home network and beyond.

Host-only creates a private network between the host and its VMs, with no internet access.

This is the safest option for attacking vulnerable VMs: Kali and the targets can see each other, but malware cannot escape.

Internal networking connects VMs only to each other - not even the host can join. It is the most isolated option.

Use it for fully sealed scenarios such as detonating real malware samples.

A practical setup gives each VM two adapters:

• Adapter 1: NAT for internet (updates, tool downloads).
• Adapter 2: host-only for the isolated attack network.

You attack over the host-only side and update over the NAT side.

VirtualBox host-only adapters typically use the 192.168.56.0/24 range. Check the interface on Kali to confirm the assigned address.

Once on the isolated network, find the other VMs with a ping sweep. This lists live hosts without scanning ports yet.

DHCP can hand out different addresses each boot, breaking your notes. Assigning static IPs on the host-only network keeps target addresses predictable across sessions.

Configure these in the guest OS network settings or the hypervisor DHCP server.

Before attacking, confirm the vulnerable VM truly cannot reach the internet. From the target, a ping to a public address should fail when only host-only is attached.

Choose the safest mode for a deliberately vulnerable target.

You learned to network a hacking lab safely:

• NAT for internet, host-only for isolated attacks, internal for total isolation.
• Avoid bridged for vulnerable VMs.
• A dual-adapter layout (NAT + host-only) is the practical sweet spot.
• Verify isolation by confirming the victim cannot ping the internet.