Host-Only Networking and Port Forwarding Support in macOS Virtualization Framework

Question

Created May ’25

Replies 4

Boosts 0

Participants 2

I’ve developed a virtual machine manager application using the macOS Virtualization framework. The application currently supports both NAT and bridged networking configurations.

I’m now looking to implement host-only networking, where the guest VM can communicate with the host but not with external networks. Is this networking mode supported by the Virtualization framework, and if so, what is the recommended approach to set it up?

Additionally, I would like to implement port forwarding from the host to the guest (e.g., redirecting traffic from a specific port on the host to a port on the guest). Is there a way to configure port forwarding using the built-in APIs of the Virtualization framework, or would this require a custom networking solution?

Any guidance or best practices for implementing these features within the constraints of the framework would be greatly appreciated.

Answered by Engineer in 838860022

For both host-only and port forwarding, teams typically implement the networking themselves using the VZFileHandleNetworkDeviceAttachment.

This requires a user-space network stack. There are a few open source projects that can be used there.

Given that the whole stack becomes under the control of the app, the exact policy for how VMs are connected and ports handled is fully customizable through the implementation.

For best performance, it's recommended to use the VZFileHandleNetworkDeviceAttachment.maximumTransmissionUnit to set a large MTU for such mode. That reduces the emulation overhead for each packet. Another valuable parameter is the buffer size of the sockets passed through the NSFileHandle.

Boost

Answer 1

Engineer OP

Apple

May ’25

Recommended

For both host-only and port forwarding, teams typically implement the networking themselves using the VZFileHandleNetworkDeviceAttachment.

This requires a user-space network stack. There are a few open source projects that can be used there.

Given that the whole stack becomes under the control of the app, the exact policy for how VMs are connected and ports handled is fully customizable through the implementation.

For best performance, it's recommended to use the VZFileHandleNetworkDeviceAttachment.maximumTransmissionUnit to set a large MTU for such mode. That reduces the emulation overhead for each packet. Another valuable parameter is the buffer size of the sockets passed through the NSFileHandle.

0

Answer 2

rbmanian75 OP

May ’25

Thank you for the reply. it seems to be that this is a bit complex task for a novice. can you please guid me on where to look for some samples on how to achive this using VZFileHandleNetworkDeviceAttachment

0

Answer 3

Engineer OP

Apple

May ’25

Hmm, yes, if you aren't already familiar with userspace networking, this is definitely a large task to start.

You may want to create feature requests for each one of the features you mentioned while explaining what you are trying to achieve. This will help the teams track demand for such features.

If you are just trying to get a channel between host and guest, would VZVirtioSocketDevice be a solution? It is efficient and private for each VM.

0

Answer 4

rbmanian75 OP

May ’25

Thanks for the heads up. i will create a feature request. This is not just to get a channel between host and guest. This is for creating isolated host only network with guest and also a port forward from host to guest. i am trying to add these features to my virtual machine manager application. I dont have expertise in creating user space networking.

0