Hyper-V external vSwitch and physical LAN: when does VM traffic become reachable beyond the host?

Network Reachability Summary

If your goal is to prevent VMs from being reachable by other devices on your LAN, do not use an External vSwitch. An External vSwitch places the VM directly on your physical network segment, making it a peer to your host and other physical devices. The Default Switch is the correct choice for outbound-only access, as it uses Network Address Translation (NAT) to hide the VM behind the host's IP address.

External vSwitch: Direct LAN Exposure

An external virtual switch operates as a Layer 2 bridge. When a VM is attached to it, the VM's virtual NIC behaves as if it were physically plugged into your network switch.

• Reachability: Determined entirely by the guest OS firewall and your upstream network (router/switch). Hyper-V does not provide a default firewall for external switches.
• Visibility: The VM will request its own IP address from your LAN's DHCP server. Any device on your LAN that can route to that IP can attempt to connect to the VM.
• Host Impact: To avoid losing host connectivity, you must ensure Allow management operating system to share this network adapter is checked during switch creation. This creates a virtual bridge that allows both the host and the VMs to share the physical NIC.

Default Switch: NAT-Based Isolation

The Default Switch provides a private internal network with NAT. The host acts as the gateway for the VMs.

• Reachability: It blocks unsolicited inbound connections from the physical LAN by default. Because the VM has a private internal IP (e.g., 172.x.x.x), external LAN peers cannot "see" or route to the VM directly.
• Outbound Access: VMs can reach the internet via the host's connection, but the return traffic is handled by the NAT engine, which only allows responses to requests initiated by the VM.

Comparison for Service Exposure

For occasionally exposing a specific service, a NAT-based approach (Default Switch) combined with a host-level firewall rule or a reverse proxy is significantly safer than an external bridge. This allows you to maintain a "deny-all" posture for the VM while selectively punching a hole for a single port on the host IP.

Verification Steps

To verify your current isolation level, perform these tests:

1. External Test: Assign a VM to an External switch. From a separate physical laptop on the same LAN, attempt to ping the VM's IP. If the guest firewall is off, the ping will succeed.
2. Default Test: Assign a VM to the Default Switch. Attempt to ping the VM's internal IP from a physical LAN peer. The request should time out or fail, as the internal IP is not routable on the physical wire.

Diagnostic Detail Needed: Are you using a static IP assignment on your physical LAN, or is everything handled via DHCP? If you use static IPs, an External vSwitch requires manual IP coordination to avoid collisions on your network.