What is a private vSwitch?
A private virtual switch is one of the three virtual switch types in Microsoft Hyper-V. VMs connected to it can talk to each other, and that's all: the host computer can't reach them through it, and they can't reach the physical network or the internet. The traffic never leaves the host, and VMs on other hosts can't join it.
External vs. internal vs. private
| Switch type | VM to VM | VM to host | VM to LAN and internet |
|---|---|---|---|
| External | Yes | Yes, when the host shares the adapter | Yes, through the physical NIC it is bound to |
| Internal | Yes | Yes | No |
| Private | Yes | No | No |
Other hypervisors have the same idea under different names: VirtualBox calls it an internal network, and VMware Workstation offers LAN segments. Either way the rule is VM-to-VM only.
When to use a private switch
- Isolated test labs: run a test domain controller, DNS server and clients that can't clash with the production network.
- Malware analysis: let a sample talk only to other lab VMs. Also turn off shared folders and clipboard sharing, which bypass the network.
- Back-end traffic: keep traffic between, for example, an application VM and a database VM off every other network, with the application VM using a second adapter for outside access.
Setting one up
In Hyper-V Manager, open Virtual Switch Manager, choose Private and name the switch. In PowerShell, the equivalent is New-VMSwitch -Name "IsolatedLab" -SwitchType Private. Then connect each VM's network adapter to the switch.
A private switch has no DHCP server unless one of the VMs runs one, so give the VMs static IP addresses. Otherwise Windows VMs fall back to APIPA addresses (169.254.x.x), which still work between them but are easy to mistake for a fault.
For the CompTIA A+ exam
Core 1 (220-1201) objective 4.1 lists network requirements for virtual machines. The switch names come from Hyper-V rather than the objectives, but the logic is testable: if a VM must be reachable from other devices on the LAN, use an external switch; if it only needs to reach the host, use internal; if VMs must be cut off from everything except each other, use private.