Firewalling VirtualBox: restrict host inbound connections to guests only

Question

I have Windows7 + Cygwin and VirtualBox. I would open a listening port on the host accepting only inbound connections from the VMs.

Note: In many case the server services running on the host can be restricted to some IPs, and so those of the VMs (subnet), but some boxes sitting in the same network as the host might spoof their IP, making these restrictions not effective.

Answer 1

This may take some more resources, but not much.

You can try getting a software firewall, like pfsense, and create an internal "vm network" that will be firewalled by a powerful software-based firewall.

Answer 2

You could set up a host-only network within Virtualbox. This is a virtual LAN which includes the host and any guests which are attached to it. You would then add a network adapter to each of your guests and attach the adapter to the host-only network. The guests and the host would be able to communicate through the private network.

Once you've done this, processes running on the host could bind specifically to the IP address for the host-only network interface. Only processes running on the host or one of the VMs would be able to contact the host's host-only network address.

The basic process is as follows:

1. Start Virtualbox manager and go to File->Preferences->Network->Host-only networks.
2. Click the "+" icon at right to create a new one.
3. Click the screwdriver icon to access properties for the new network.
4. Enable a DHCP server if desired (if you don't do this, you'll have to assign static IPs to each guest).