vmware nat service что это
VMware Workstation 3.2
NAT provides a simple way for virtual machines to use most client applications over almost any type of network connection available to the host. The only requirement is that the network connection must support TCP/IP.
NAT is useful when you have a limited supply of IP addresses or are connected to the network through a non-Ethernet network adapter. NAT works by translating addresses of virtual machines in a private VMnet network to that of the host machine. When a virtual machine sends a request to access a network resource, it appears to the network resource as if the request came from the host machine.
NAT uses the host’s own network resources to connect to the external network. Thus, any TCP/IP network resource to which the host has access should be available through the NAT connection.
The chief advantage of NAT is that it provides a transparent, easy to configure way for virtual machines to gain access to network resources.
Using NAT in VMware Workstation
Using NAT in VMware Workstation
The NAT device is connected to the VMnet8 virtual switch. Virtual machines connected to the NAT network also use the VMnet8 virtual switch.
The NAT device waits for packets coming from virtual machines on the VMnet8 virtual network. When a packet arrives, the NAT device translates the address of the virtual machine to that of the host before forwarding the packet to the external network. When data arrives from the external network for the virtual machine on the private network, the NAT device receives the data, replaces the network address with that of the virtual machine and forwards the data to the virtual machine on the virtual network. This translation occurs automatically and requires minimal configuration on the guest and the host.
The Host Computer and the NAT Network
The Host Computer and the NAT Network
The host computer has an adapter on the NAT network (identical to the host-only adapter on the host-only network). This adapter allows the host and the virtual machines to communicate with each other for such purposes as file sharing. The NAT never forwards traffic from the host adapter.
DHCP on the NAT Network
DHCP on the NAT Network
DNS on the NAT Network
DNS on the NAT Network
The NAT device acts as a DNS server for the virtual machines on the NAT network. Actually, the NAT device is a DNS proxy and merely forwards DNS requests from the virtual machines to a DNS server that is known by the host. Responses come back to the NAT device, which then forwards them to the virtual machines.
If they get their configuration information from DHCP, the virtual machines on the NAT network automatically uses the NAT device as the DNS server. However, the virtual machines can be statically configured to use another DNS server.
The virtual machines in the private NAT network are not, themselves, accessible via DNS. If you want the virtual machines running on the NAT network to access each other by DNS names, you must set up a private DNS server connected to the NAT network.
External Access from the NAT Network
External Access from the NAT Network
In general, any protocol using TCP or UDP can be used automatically by a virtual machine on the NAT network so long as the virtual machine initiates the network connection. This is true for most client applications such as Web browsing, Telnet, passive-mode FTP and downloading streaming video. Additional protocol support has been built into the NAT device to allow FTP and ICMP echo (ping) to work completely transparently through the NAT.
On the external network to which the host is connected, any virtual machine on the NAT network appears to be the host itself, because its network traffic uses the host’s IP address. It is able to send and receive data using TCP/IP to any machine that is accessible from the host.
Before any such communication can occur, the NAT device must set up a mapping between the virtual machine’s address on the private NAT network and the host’s network address on the external network.
When a virtual machine initiates a network connection with another network resource, this mapping is created automatically. The operation is perfectly transparent to the user of the virtual machine on the NAT network. No additional work needs to be done to let the virtual machine access the external network.
The same cannot be said for network connections that are initiated from the external network to a virtual machine on the NAT network.
When a machine on the external network attempts to initiate a connection with a virtual machine on the NAT network, it cannot reach it because the NAT device does not forward the request. Network connections that are initiated from outside the NAT network are not transparent.
However, it is possible to manually configure port forwarding on the NAT device so network traffic destined for a certain port can still be automatically forwarded to a virtual machine on the NAT network. For details, see Advanced NAT Configuration below.
Advanced NAT Configuration
Advanced NAT Configuration
Use the NAT configuration file on the host to configure the NAT device.
On Windows, this file is vmnetnat.conf. It is located in the host operating system’s system folder (normally C:\WINNT\system32).
On Linux, this file is /etc/vmware/vmnet8/nat/nat.conf.
For an example of a NAT configuration file, see Sample Windows vmnetnat.conf File. The configuration file variables are described below.
ip
The IP address that the NAT device should use. It can optionally be followed by a slash and the number of bits in the subnet.
netmask
The subnet mask to use for the NAT. DHCP addresses will be allocated from this range of addresses.
configport
A port that can be used to access status information about the NAT.
activeFTP
Flag to indicate if active FTP is to be allowed. Active FTP allows incoming connections to be opened by the remote FTP server. Turning this off means that only passive mode FTP works. Set to 0 to turn it off.
timeout
Number of minutes to keep the UDP mapping for the NAT.
This section is for Windows hosts only. Linux does not use this section.
policy
Policy to use for DNS forwarding. Accepted values include order, rotate, and burst.
timeout
Time in seconds before retrying a DNS request.
retries
Number of retries before the NAT device gives up on a DNS request.
autodetect
Flag to indicate if the NAT should automatically detect the DNS serves available to the host.
nameserver1
IP address of a DNS server to use.
nameserver2
IP address of a DNS server to use.
nameserver3
IP address of a DNS server to use.
If autodetect is on and some name servers are specified, the DNS servers specified in nameserver1, nameserver2 and nameserver3 are added before the list of detected DNS servers.
The [netbios] Section
The [netbios] Section
This section applies to Windows hosts only. Linux does not use this section.
nbnsTimeout = 2
Timeout for NBNS queries.
nbnsRetries = 3
Number of retries for each NBNS query.
nbdsTimeout = 3
Timeout for NBDS queries.
The [incomingtcp] Section
The [incomingtcp] Section
This section is used to configure TCP port forwarding for NAT. In this section, you can assign a port number to an IP address and port number on a virtual machine.
The following line shows the format used in this section.
This creates a mapping from port 8887 on the host to the IP address 192.168.27.128 and port 21. When this is set and an external machine connects to the host at port 8887, the network packets are automatically forwarded to port 21 (the standard port for FTP) on the virtual machine with IP address 192.168.27.128.
The [incomingudp] Section
The [incomingudp] Section
This section is used to configure UDP port forwarding for NAT. In this section, you can assign a port number to an IP address and port number on a virtual machine.
The following line shows the format used in this section. It illustrates a way to forward X server traffic from the host port 6000 to the virtual machine’s port 6001.
This creates a mapping from port 6000 on the host to the IP address 192.168.27.128 and port 6001. When this is set and an external machine connects to the host at port 6000, the network packets are automatically forwarded to port 6001 on the virtual machine with IP address 192.168.27.128.
Considerations for Using NAT
Considerations for Using NAT
Because NAT requires that every packet sent and received from virtual machines is in the NAT network, there is an unavoidable performance penalty. Our experiments show that the penalty is minor for dial-up and DSL connections and performance is adequate for most VMware Workstation uses.
A standard NAT configuration provides basic-level firewall protection because the NAT device can initiate connections from the private NAT network, but devices on the external network cannot normally initiate connections to the private NAT network.
Using NAT with NetLogon (Windows Hosts and Virtual Machines Only)
Using NAT with NetLogon (Windows Hosts and Virtual Machines Only)
When using NAT networking in a virtual machine with a Windows guest operating system running on a Windows host, you can utilize NetLogon to log on to a Windows domain from the virtual machine. This allows you to access file shares known by the WINS server in the domain.
To use NetLogon, you need to know how WINS servers and Windows domain controllers work. This section only explains how to set up the virtual machine to use NetLogon. The setup process is similar to the way you would set up a physical computer on one LAN that is using a domain controller on another LAN.
In order to log on to a Windows domain outside the virtual NAT network, the virtual machine needs access to a WINS server for that domain. There are two ways the virtual machine can connect to the WINS server. You can connect to the WINS server provided by the DHCP server used on the NAT network, provided that the WINS server is already set up on the host. If you want to connect from the virtual machine to a WINS server not set up on the host, you can manually enter the IP address of the WINS server.
Using NAT to Connect to an Existing WINS Server Already Set Up on the Host
Using NAT to Connect to an Existing WINS Server Already Set Up on the Host
Manually Entering the IP Address of a WINS Server
Manually Entering the IP Address of a WINS Server
Use this method to connect to a WINS server in the same workgroup or domain that is not already set up on the host.
Repeat steps 5 and 6 for each WINS server you want to connect to from this virtual machine.
Now that the virtual machine has an IP address for a WINS server, you use NetLogon in the virtual machine to log on to a domain and access shares in that domain.
For example, if the WINS server covers a domain with a domain controller it is possible to access that domain controller from the virtual machine and add the virtual machine to the domain. You need to know the Administrator’s user ID and password of the domain controller.
Note: You can access shares of virtual machines that are only on the same NAT network or are bridged on the same domain.
Sample Windows vmnetnat.conf File
Sample Windows vmnetnat.conf File
# Windows NAT configuration file
# NAT gateway address
# enable configuration; disabled by default for security reasons
# VMnet device if not specified on command line
# Allow PORT/EPRT FTP commands (they need incoming TCP stream. )
# Allows the source to have any OUI. Turn this one if you change the OUI
# in the MAC address of your virtual machines.
# Timeout in seconds, 0 = no timeout, default = 60; real value might
# be up to 100% longer
# This section applies only to Windows.
# Policy to use for DNS forwarding. Accepted values include order,
# order: send one DNS request at a time in order of the name servers
# rotate: send one DNS request at a time, rotate through the DNS servers
# burst: send to three servers and wait for the first one to respond
# Timeout in seconds before retrying DNS request.
# Retries before giving up on DNS request
# Automatically detect the DNS servers (not supported in Windows NT)
# List of DNS servers to use. Up to three may be specified
# This section applies only to Windows.
# Timeout for NBNS queries.
# Number of retries for each NBNS query.
# Timeout for NBDS queries.
# FTP (both active and passive FTP is always enabled)
# ftp localhost 8887
# WEB (make sure that if you are using named webhosting, names point to
# your host, not to guest. And if you are forwarding port other
# than 80 make sure that your server copes with mismatched port
База знаний
Сетевая настройка VMware инфраструктуры (NAT, DHCP, Firewall, Static Routing, VPN)
Сетевая настройка VMware инфраструктуры (NAT, DHCP, Firewall, Static Routing, VPN).
После того, как Вы создали виртуальную(-ые) машины, можно приступать к сетевой настройке.
На данный момент существует 3 варианта подключения виртуальных машин между собой:
внешняя сеть с публичными IP адресами;
локальная сеть с доступом в интернет через NAT;
изолированная локальная сеть без доступа в Интернет.
Также при активации услуги Вам предоставляется виртуальный маршрутизатор «Edge Gateway», через который осуществляется маршрутизация и предоставление сервисов для внешних сетей и локальных сетей с доступом в интернет через NAT.
Внешние сети в нашей инфраструктуре добавляются сотрудниками службы поддержки, поэтому Вам не о чем беспокоиться. Для внешних сетей возможна только самостоятельная настройка сервисов, таких как NAT или Firewall.
Изолированные локальные сети и локальные сети с доступом в интернет через NAT создаются с помощью интерфейса управления сетями. Перейдем в левом меню к пункту Networks и кликнем New для создания новой сети.
Настройка сервисов сети (DHCP, NAT, Firewall, Static Routing)
Для настройки сервисов сети (DHCP, NAT, Firewall, Static Routing) перейдем в левом меню к пункту Edges и кликнем CONFIGURE SERVICES.
Если ссылка CONFIGURE SERVICES неактивна, то необходимо сначала выполнить конвертацию EdgeGateway в Advanced режим нажав CONVERT TO ADVANCED.
Через несколько секунд ссылка CONFIGURE SERVICES станет доступна
В примере создано два правила разрешающие соединения с любого адреса на HTTPS (TCP/443) порт адреса 176.53.180.18 и соединения с адреса 176.53.180.17 на SSH (TCP/22) порт адреса 176.53.180.18.
Все остальные соединения блокируются политикой по умолчанию Deny.
После внесения изменений нужно кликнуть на «Save changes».
DHCP.
На Edge Gateway можно настроить как source (подмена адреса источника), так и destination (подмена адреса получателя) NAT. Для этого в меню Edge gateway service нужно перейти на вкладку NAT.
Для настройки destination NAT нажмите DNAT RULE. В открывшемся окне значение Applied on укажите inet_user1.
В поле Original IP/Range введите внешний адрес Вашего EdgeGateway.
Выберите нужный протокол.
В Original port укажите порт на внешнем адресе, на который будут устанавливаться соединения.
В поле Translated IP/Range укажите адрес виртуальной машины в локальной сети, доступ к которой Вы хотите предоставить через NAT.
В Translated port укажите порт, на котором виртуальная машина будет принимать соединения.
FlorianLR’s Blog
Comments about life
Categories
Archives
Blogroll
Subscribe
fixing VMWare NAT problems on Windows 7
Posted by langbogen on July 9, 2009
The current version of VMWare (Workstation 6.5.1, 6.5.2, Server 2.0.1, Player) doesn’t support NAT on Windows 7 (RC1). Typically you can ping servers and do nslookups but not use your Internet Browser or ssh/telnet etc.
But you can use the Internet Connection Sharing (ICS).
A more complex solution by removing all virtual adapters can be found in this VMWare Forum thread but this made some troubles on my PC so I simplified these instructions.
First Step: change virtual IP
It is not necessary to restart the NAT service.
Second Step: enable ICS
Third Step: check VMs
If you have configured a fixed IP inside your VM you must change the IP4 Gateway and DNS1 to 192.168.137.1
Note 1: Port forwarding has to be configured using the ICS Settings button, not the VMWare NAT-Dialog.
Note 2: Windows 7 Beta seems to use 192.168.37.1 as IP für ICS.
Note 3: no Windows Firewall changes are necessary
[Update Sep 2011] Take also a look at this comment on how to use the vmnat.exe fromVMWare Player to fix the Problem.
Share this:
Like this:
Related
This entry was posted on July 9, 2009 at 11:13 am and is filed under Development. You can follow any responses to this entry through the RSS 2.0 feed. Both comments and pings are currently closed.
81 Responses to “fixing VMWare NAT problems on Windows 7”
tom jack said
but i cant find the VMnet8 at properties of LAN-Connection
how to fix it?
James said
Open the Network and Sharing center, then click on ‘Change Adapter Settings’. Right click on your Local Area Connection, and select ‘Properties’. Click on the ‘Sharing’ tab at the top of the Local Area Connections Properties windows that opened and check the box for ‘Allow other network users…’. In the drop down menu below labelled ‘Home networking connection select ‘VMware Network Adapter VMnet8’.
If you have problems with the VMware Network Adapters triggering the public profile for networking then use the powershell script given here http://www.nivot.org/2008/09/05/VMWareVMNETAdaptersTriggeringPublicProfileForWindowsFirewall.aspx to turn off endpoint detection for the VMware virtual networking adapters. You will need to run the script with elevated permissions and have to reconfigure (temporarily) your powershell execution policy (SetExecution-Policy unrestricted) for it to work.
langbogen said
Do you want to know which adapter is which? Open the Network and Sharing center, then click on ‘Change Adapter Settings’. By default they are often named ‘LAN Connection 2’ and ‘LAN Connection 3’. Right click on the connection and select ‘Properties’. In the ‘Connect using:’ Field you can see if it’s VMNet 8 or another one.
Personally I recommend to rename them (right click + ‘Rename’) to ‘VMnet1’ and ‘VMnet8’.
Jacky said
Thank you, simple and works like a charm!
rjm said
Thank you for this elegant solution.
Sorin said
Thanks! Worked great! I wish I found your blog a few hours earlier though 🙂
Dave O. said
Thanks for the tip. I wasnt even aware of this until a friend of mine forwarded it to me.
Just to confirm, this is still an issue in Win7 RTM. I am running it currently and have had to implement the above workaround to make NAT work.
To change the subnet, I tweaked a reg setting to the IP of the VMnet8 NIC. This allowed me to keep my desired subnet. (I use Wkst for testing PXE booting and other things where IPs and DHCP scopes and other things need to be consistent between re-installs…for most people the actual subnet is a moot point and 192.68.137.0 will work fine for them.)
Here is the key:
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters
ScopeAddress REG_SZ 192.168.88.254
It is 192.168.137.0 by default. I changed it to 192.168.88.254 to match my needs. I dont think the host octet of the IP address matters…windows just figures in the /24 of the IP address.
Also, some other things I found and added to my “to do” list for Wkst on Win7:
* Create a firewall rule to allow all traffic from your VMnet8 Subnet to access the VMnet8 interface. I run FTP and TFTP (for PXE) off of that interface, so the NAT’ed VMs actually do interact directly with my Win7 host.
* I actually remove the VMnet1 interface (host only), as I have never used it. That may help with trying to figure all this out. It’s one less interface and one less route in the routing table to have to deal with. 🙂 (Edit –> Virtual Network Editor… –> Host Virtual Adapters Tab. Click on VMnet1 and click Remove button)
* I disable VMware NAT completely from within VMware Wkst (Edit –> Virtual Network Editor… –> NAT tab; set pull down menu to “Disable”). It still leaves my VMnet8 interface intact, but it disables the NAT service. (the VMware NAT service doesnt work anyways…why have it running?) But this also removes the default gateway from the VMware DHCP service. You can add that back in by modifying c:\programdata\vmware\vmnetdhcp.conf. Just add the following line in the block that specifies DNS servers, domain name, etc:
option routers 192.168.88.201;
Thanks for the tip. This was a huge issue for me when I finally realized it existed.
Hope my additional tips help!
Knowledgebase » Blog Archive » Microsoft Windows 7 and the things I noticed said
[…] Using VMWare 6.5.2 and NAT does not work out of the box, using the steps on https://florianlr.wordpress.com/2009/07/09/5/ solved the problem. Share and […]
Sncboom2k said
I have the same issue, but I’m not able to install a driver for the VMNET host adapters…. Very frustrating. My windows 7 x64 is the RTM version and when I install or repair my VMWare 6.5.2 – it does not install the drivers for the net adapters and both 1 & 8 show up as “Unknown device” in my Device Manager. (My host PC is the Win 7 x64).
Can anyone shed some light on this for me so I can use the great fix listed above?
Thanks in advance for any help.
Nikkor said
Thank you VERY MUCH for posting this. I spent a day trying to figure out the broken networking w/ Windows 7 x64 Host & VMWare 6.5.2. This worked very well. One note to help others, the IP address Dave O mentioned setting in the registry is the IP address of the VMs it is not the IP address of the network you are connecting to.
Carlos said
Worked great with Win7 RTM… after a reboot. Thanks!
Josh said
Great simple solution – Thanks. Confirmed that a reboot is needed!
Swzmaster said
thanks for this tip, working for me
Shashank Rana said
thanks a ton. worked like a charm.
tinba said
followed your instructions, but didn’t work for me.
Win7 32-bit host. Win2003 guest. ICS on, VMnet8 changed. Have no idea what I’m doing wrong.
langbogen said
Hi tinba, did you try to give your guest a fixed IP? In some (seldom) cases this was necessary to fix the problem.
Magrat Garlick said
I’m running Win RC1 64bit, vmWare Server 2 and a virtual WinXP. I’ve been going round and round in circles these last two night trying to get both folder sharing and internet together. Bridge gave me Internet, NAT gave me sharing. Now, thanks to you, I have both.
Mike said
Worked like a charm on vmware server 2
However you must reboot after making the changes.
Thanks,
Mike
Ricky said
Darn, I also followed the instructions,
got win7 x64 running as host and a red-hat as vmclient
ICS is running on local area connection (IP=192.168.1.67) with vmnet8(NAT) 192.168.137.1
Got ICS forwarding with telnet, ftpserver on
192.168.137.1 is also the gateway, vmclient ip = fixed 192.168.137.4
I can telnet from the client to the internet everywhere,
I can telnet from the host to the client without any problems…
but if I try to telnet from a machine (192.168.1.71) to the vmclient it wont respond. 😦
Any help would be very much appreciated!
langbogen said
Port forwarding has to be configured using the ICS Settings button. You must configure, which external Port should be mapped to which internal IP+Port.
So for Telnet configure a forwarding from external Port 23 to internal address 192.168.137.4 Port 23.
On my machine this runs without problems.
Ricky said
I actually tried that both with vmware server 2 and workstation 7.
The major problem was that the firewall integrated in windows 7 didn’t let anything through.
After setting the rules correct it works like a charm!
But thanks very much for the reply!
Mike H. said
It worked perfectly! Thanks!
Paulo Dani said
Worked with Windows 7 professional as host, ubuntu 9.10 server as guest. Port forwarding via ICS also worked.
shanon said
I was looking everywhere for a fix. Honestly, I was almost going to revert back to an older OS.
Dara Harb said
This does not seem to work if the host’s network (first two octets) is different from the VMNet’s (for example a /16 for the host network and 192.168.x.x for the vmnet).
I’d really like an eta from VMware on when they plan to fix this.
Ramon said
Thank you, langbogen. Worked fine for me.
Bernardo said
Thanks for the tip.
For some strange reason, while this fixes internet access, it seems to screw up pinging in return in my case. Took me a while to realize that internet was actually working while ping was not.
Bernardo said
To follow up my last comment, started running into “drop out” problems with your version, in addition to the not working pings.
Disabling the VMware NAT service from the Services panel in Windows 7 (not through VMware) seems to have fixed both issues. I’d guess that perhaps the NAT from Windows’ ICS was conflicting with the VMware’s own NAT or something.
hacene15 said
I m running Win7 as host with vmware 7.0.1, I Have Installed Windows server 2008 server entreprise as virtual machine, But when I try to setup static IP adress for the server there is no connectivity between the Workstation and server W2k8 (Win7 and w2k8) I thought it is NAT problem, I spent an entire day find out the problem. I find some clues but its only on vmware 6.5 not same interface with Vmware 7.0.1. Please help.
Thank you.
I just repost this, I have corrected some error 😉
langbogen said
Hi, I am using VMWare Player 3 which has no NAT Problems with Win7 anymore. It has been released side-by-side with WMare Workstation 7.x so I think NAT Problem won’t effect Workstation 7.
Did you check the static settings for IP, Gateway and DNS? The IP should be on the same network (e.g. VMNet8 is 192.168.137.x, then use e.g. 192.168.137.128 as IP and 192.168.137.2 as Gateway and DNS. The “137”-Subnet is a random Number and depends on your installation, if you did’nt make changes “.2” is the default Gateway/DNS). If this does not resove the Problem I recommend to post a message to the vmware.com Forum.
Brian said
Thanks! It worked for me!
Scott said
Thanks; enabling ICS does work for me in Windows 7.
However, ICS is not compatible with many or all Cisco VPNs. e.g. my VPN AnyConnect client cannot establish a VPN if ICS is enabled on the public interface.
If your VM needs to contact a server on the other side of the VPN… sorry.
DY said
Well, it’s June 2010 and I can say a fresh download of VMware server 2 has the same issue and this fixed it. Wow, as if I have enough problems with ESX licensing for our organization now this? VMware: if you’re listening, this isn’t how you release products.
BTR Naidu said
After following the instruction, my VMnet8 shows bellow configuration –
Ethernet adapter VMnet8:
And the guest running XP shows below
Ethernet adapter Local Area Connection:
Problem is with DNS. My guest does not resolve any domain (google.com / yahoo.com). If I try to brows with IP, it works fine. Any ideas how to resolve this?
BTR Naidu said
BTW: I have a working solution by adding DNS manually on the guest (xp) adaptor. But this has to be done every time I connect to a new network which is bit painful. I am looking for some automatic solution.
langbogen said
Have you tried to turn off DHCP in your guest network adapter settings and configure IP/Subnet/Gateway and DNS manually? Windows should remember these settings always.
Me said
ICS is disabled by my administrator. So I cannot enable it. Any help? Any workaround to fix this no internet access issue under win7? Thanks.
langbogen said
you will have to ask your Admin to unlock this feature or use VMWare Workstation 7+
ComputerTips said
Awesome | Awesome | Awesome…….
Really too much happy because you have solved this problem in minutes and I had been wondering on search engines for last one week to find out the solution but of no use.
Wew…Finally I found this thread…Thanks YOU “Langbogen” (Oscar for you)