One dropdown in VMware settings decides whether your Kali VM is hidden behind your PC, sitting openly on your office LAN with its own address, or locked in a room with only your other lab machines. For a security testing system, that choice is not a detail - it is the safety model. Here is what each mode really does.
Beginners pick bridged because a tutorial once said so, then wonder why the office IT team is asking questions - or worse, they never find out. This page explains the three VMware network modes honestly, with the lab-first recommendation Kali's own guidance follows. Kali Linux is a professional security testing system. Use it only on computers and networks you own, or where you have clear written permission to test. That one rule is what separates a security professional from a criminal.
In NAT mode, VMware runs a small private network behind your host PC. Kali gets a private address, reaches the internet through the host's connection, and - this is the important half - devices on your real network cannot initiate connections to the VM. It does not take an address from your office DHCP server, and it does not appear in anyone's network scan as a separate machine.
For installing, updating, downloading tools and general learning, NAT is all you need. Kali's own prebuilt VMware images ship configured this way, deliberately.
Bridged mode connects the VM straight through your physical network card. Kali asks your real router for an address and becomes a full citizen of the LAN - visible, reachable, and able to reach everything else.
There are legitimate lab reasons for this: testing from a genuinely separate network position, against machines you own, on a network that is yours. On a home network you control, that can be reasonable. On an office or institute network, putting a security testing platform on the wire without the network owner's written agreement is a serious act - scans and probes from it look exactly like an attack, because functionally that is what testing traffic is. Get permission first, in writing, or do not bridge.
Host-only networking creates a private segment containing just your host and the VMs you place on it. No internet, no LAN, no exceptions. This is the correct home for deliberately vulnerable practice machines - the training targets that exist to be attacked.
The pattern professionals use: Kali and its practice targets together on a host-only network. Kali can reach the targets, the targets can reach nothing real, and nothing real can reach them. If you add a second adapter to Kali - one NAT for updates, one host-only for the lab - you get convenience and isolation at once; just never let the vulnerable side bridge onward.
If you cannot explain why the VM needs to be bridged, it does not need to be bridged.
You can change the network mode while the VM is powered off, and Kali will simply pick up a new address at next boot - the installation does not care. Two practical notes: switch modes with the VM shut down, not suspended, for predictable results; and after switching, confirm the new address inside Kali with ip a before wondering why a lab target is unreachable. Nine address problems out of ten are the old IP address being used out of habit.
Every screen of the Kali Linux VMware installation, shown live step by step.
Watch Full VideoNAT gives the VM internet access for updates and downloads without exposing it to the local network or consuming a LAN address. For a security testing system, that low profile is the safest general-purpose default.
No. In NAT mode the VM sits behind the host and has no address on the real LAN. Other devices cannot connect to it directly; its traffic appears to come from your host PC.
Put them and Kali on a host-only network. They can reach each other, but neither the real LAN nor the internet can reach them, and they cannot reach anything real - which is exactly what vulnerable machines require.