Windows Firewall On Hyper-V Management OS (Host) Has Nothing To Do With Virtual Machines

Hyper-V veterans should respond with “of course it doesn’t”.  But fairly often I encounter a question online where someone is trying to disable Windows Firewall for a VM … and they start mucking around with Windows Firewall in the Management OS (the host OS). 

Hyper-V, as the name suggests, is a hypervisor.  It’s a type 1 hypervisor, similar to but different to vSphere.  The Host OS networking has nothing to do with VM networking.  The host has it’s own network interface.  The VMs have their own network interfaces.  They might share the same physical NIC team or NIC but their commonalities end there.  The host and it’s VMs have independent virtual NICs, MAC addresses and IP addresses, each operating independently from each other, even if they share the same physical NIC or NIC team.

If you configure the Windows Firewall in the Management OS then you are only affecting the host.  To affect a VM then configure the Windows Firewall in the VM’s guest OS.

The independence follows through to the physical network.  Because the host and VMs are independent, then rules on the physical network firewall apply to the address that you are including in the rule, i.e. a rule affecting the host IP address has nothing to do with the VMs.

BTW, if you are looking to do VM firewalling at the host layer then look for a virtual switch extension, such as the one from 5nine.

Leave a Reply

Your email address will not be published.

This site uses Akismet to reduce spam. Learn how your comment data is processed.