VirtualBox offers five network modes with technical names that explain nothing. Judged by one simple question - who can reach whom - they become easy to choose. This page translates each mode into plain words and tells you which one your VM actually needs.
Every VM gets a virtual network card, and the mode you choose for it decides the VM's whole relationship with the world: can it reach the internet, can your office network see it, can your other VMs talk to it, can anything reach it at all? Pick by the job. A learning VM needs one mode, a test server needs another, and a sealed malware lab needs a third. Here they are, honestly.
NAT puts the VM behind your host like a house behind a router. The VM can browse the internet, download updates and reach your network's services - but nothing on the network can start a connection into the VM. Its address (typically in the 10.0.2.x range) is private to VirtualBox.
For a learning or testing Windows VM, this is exactly right, and it is why NAT is the default: the guest works online while staying invisible to the rest of the network. Leave it here unless you have a specific reason to move.
NAT Network is NAT with a shared room: several VMs attached to the same named NAT network can talk to each other and reach the internet, while still hidden from your real LAN. It is the natural choice for a small practice lab - a virtual server and a virtual client that must meet, without either appearing on the office network. You create the network once under VirtualBox preferences, then attach each VM to it.
Bridged Adapter connects the VM straight onto your physical network through the host's network card. The VM asks your real router for its own IP address, and from that moment it is a full citizen: other PCs can ping it, connect to it, and use services it runs. This is the mode for testing a server that real machines must reach, or for a VM that needs to see network printers and shared folders as a peer.
The honest cautions: on an office network, a bridged VM is a real device - it takes an IP, it appears in scans, and it should follow the same rules as any PC there. And on some Wi-Fi networks bridging behaves imperfectly because of how wireless handles multiple devices behind one connection; a wired host connection is the reliable route.
Host-only networking creates a private link between the host and its VMs: they can reach each other and sibling VMs on the same host-only network, but there is no internet and no LAN. It suits host-to-guest work like file and service testing with zero outside exposure.
Internal Network goes one step further - VMs on the same internal network can talk only to each other; even the host cannot join. This is the isolation mode for the riskiest work. If you ever test suspicious software, this (or no network adapter at all) is the honest setting: the VM can do its worst to an audience of nobody.
The one time NAT feels limiting is when you want to reach a service inside the VM - say a test website - from the host. Instead of switching modes, use NAT's built-in Port Forwarding (in the adapter's Advanced settings): map a host port, for example 8080, to the guest's port 80, and the service answers on the host's address at that port. You get the single doorway you need while the VM stays hidden behind NAT for everything else - usually the smarter choice than going bridged for one test.
The complete tutorial shows the VM created and running - see the network it starts with and how the finished setup looks.
Watch Full VideoBecause NAT - the default mode - hides the VM behind the host. The VM can reach out to the network and internet, but nothing can start a connection into it. If other computers genuinely need to reach the VM, switch its adapter to Bridged so it gets its own IP address on your network.
Internal Network, or removing the network adapter entirely. Internal networking lets VMs talk only to each other - no internet, no LAN, not even the host. Combined with shared folders and clipboard switched off, it keeps a risky guest sealed away from everything you care about.
On NAT that is expected behaviour - inbound connections are blocked. Either add a port forwarding rule in the adapter's Advanced settings (host port 8080 to guest port 80, for example), or switch the VM to Bridged mode if it should be a full member of your network.