{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260908-190-allocate-one-coherent-address-plan-for-a-hyper-v-nat-host/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260908-190-allocate-one-coherent-address-plan-for-a-hyper-v-nat-host/", "slug": "dse-20260908-190-allocate-one-coherent-address-plan-for-a-hyper-v-nat-host", "url": "https://update.dsesecurity.com/updates/dse-20260908-190-allocate-one-coherent-address-plan-for-a-hyper-v-nat-host/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260908-190-allocate-one-coherent-address-plan-for-a-hyper-v-nat-host.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260908-190-allocate-one-coherent-address-plan-for-a-hyper-v-nat-host/" }, "title": "Allocate one coherent address plan for a Hyper-V NAT host", "summary": "How should VM and container address ranges be planned for a shared Windows NAT instance?", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "continuity-recovery", "label": "Continuity & recovery", "alt": "Paired infrastructure paths converging on a stable recovered service.", "card_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "business-continuity", "name": "Business Continuity", "url": "https://update.dsesecurity.com/topic/business-continuity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-08T18:14:01+00:00", "modified_at": "2026-09-08T18:26:32+00:00", "reviewed_on": "2026-09-08", "reading_minutes": 1, "word_count": 217, "potentially_affected": "Administrators configuring WinNAT connectivity for Hyper-V VMs and containers.", "dse_recommendation": "Reserve a host-level address plan that shows the overall internal prefix and the ranges assigned by each service.", "primary_source": { "name": "Set up a NAT network", "url": "https://learn.microsoft.com/en-us/windows-server/virtualization/hyper-v/setup-nat-network", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Microsoft documents a limit of one NAT network per host in this Hyper-V setup. A VM connects to the NAT network through the internal virtual switch created by the procedure. When VMs and containers share one NAT, the internal prefix must cover their assigned ranges, and the configuration must avoid reusing addresses. Microsoft Learn.

\n

Applicability

\n

List the VMs, containers, and applications already managing addresses on the host. Inspect existing NAT and switch configuration before adding another network. Review the documented WinNAT limits alongside the intended topology rather than choosing an isolated range for each tool.

\n

DSE recommendation

\n

Reserve a host-level address plan that shows the overall internal prefix and the ranges assigned by each service. Name the owner of every allocation and the procedure for adding another VM or container. Preserve current switch and NAT settings before the pilot. Require an address-collision check before an application is allowed to introduce its own range.

\n

Verification

\n

Verify that each test endpoint uses the intended switch and a unique address inside the approved range. Exercise the required outbound connection from both a VM and a container when both are in scope. Record the effective NAT configuration and any unexpected address assignment before accepting the shared-host design.

\n

Official references

\n

Microsoft Learn: Set up a NAT network. Source reviewed September 8, 2026.

", "content_text": "Source facts\nMicrosoft documents a limit of one NAT network per host in this Hyper-V setup. A VM connects to the NAT network through the internal virtual switch created by the procedure. When VMs and containers share one NAT, the internal prefix must cover their assigned ranges, and the configuration must avoid reusing addresses. Microsoft Learn.\nApplicability\nList the VMs, containers, and applications already managing addresses on the host. Inspect existing NAT and switch configuration before adding another network. Review the documented WinNAT limits alongside the intended topology rather than choosing an isolated range for each tool.\nDSE recommendation\nReserve a host-level address plan that shows the overall internal prefix and the ranges assigned by each service. Name the owner of every allocation and the procedure for adding another VM or container. Preserve current switch and NAT settings before the pilot. Require an address-collision check before an application is allowed to introduce its own range.\nVerification\nVerify that each test endpoint uses the intended switch and a unique address inside the approved range. Exercise the required outbound connection from both a VM and a container when both are in scope. Record the effective NAT configuration and any unexpected address assignment before accepting the shared-host design.\nOfficial references\nMicrosoft Learn: Set up a NAT network. Source reviewed September 8, 2026.", "content_markdown": "## Source facts\n\nMicrosoft documents a limit of one NAT network per host in this Hyper-V setup. A VM connects to the NAT network through the internal virtual switch created by the procedure. When VMs and containers share one NAT, the internal prefix must cover their assigned ranges, and the configuration must avoid reusing addresses. [Microsoft Learn](https://learn.microsoft.com/en-us/windows-server/virtualization/hyper-v/setup-nat-network).\n\n## Applicability\n\nList the VMs, containers, and applications already managing addresses on the host. Inspect existing NAT and switch configuration before adding another network. Review the documented WinNAT limits alongside the intended topology rather than choosing an isolated range for each tool.\n\n## DSE recommendation\n\nReserve a host-level address plan that shows the overall internal prefix and the ranges assigned by each service. Name the owner of every allocation and the procedure for adding another VM or container. Preserve current switch and NAT settings before the pilot. Require an address-collision check before an application is allowed to introduce its own range.\n\n## Verification\n\nVerify that each test endpoint uses the intended switch and a unique address inside the approved range. Exercise the required outbound connection from both a VM and a container when both are in scope. Record the effective NAT configuration and any unexpected address assignment before accepting the shared-host design.\n\n## Official references\n\n[Microsoft Learn: Set up a NAT network](https://learn.microsoft.com/en-us/windows-server/virtualization/hyper-v/setup-nat-network). Source reviewed September 8, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260908-190-allocate-one-coherent-address-plan-for-a-hyper-v-nat-host/", "url": "https://update.dsesecurity.com/updates/dse-20260908-190-allocate-one-coherent-address-plan-for-a-hyper-v-nat-host/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-08" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260908-190-allocate-one-coherent-address-plan-for-a-hyper-v-nat-host/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Allocate one coherent address plan for a Hyper-V NAT host", "item": "https://update.dsesecurity.com/updates/dse-20260908-190-allocate-one-coherent-address-plan-for-a-hyper-v-nat-host/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260908-190-allocate-one-coherent-address-plan-for-a-hyper-v-nat-host/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260908-190-allocate-one-coherent-address-plan-for-a-hyper-v-nat-host/", "url": "https://update.dsesecurity.com/updates/dse-20260908-190-allocate-one-coherent-address-plan-for-a-hyper-v-nat-host/", "headline": "Allocate one coherent address plan for a Hyper-V NAT host", "description": "How should VM and container address ranges be planned for a shared Windows NAT instance?", "abstract": "How should VM and container address ranges be planned for a shared Windows NAT instance?", "articleBody": "Source facts\nMicrosoft documents a limit of one NAT network per host in this Hyper-V setup. A VM connects to the NAT network through the internal virtual switch created by the procedure. When VMs and containers share one NAT, the internal prefix must cover their assigned ranges, and the configuration must avoid reusing addresses. Microsoft Learn.\nApplicability\nList the VMs, containers, and applications already managing addresses on the host. Inspect existing NAT and switch configuration before adding another network. Review the documented WinNAT limits alongside the intended topology rather than choosing an isolated range for each tool.\nDSE recommendation\nReserve a host-level address plan that shows the overall internal prefix and the ranges assigned by each service. Name the owner of every allocation and the procedure for adding another VM or container. Preserve current switch and NAT settings before the pilot. Require an address-collision check before an application is allowed to introduce its own range.\nVerification\nVerify that each test endpoint uses the intended switch and a unique address inside the approved range. Exercise the required outbound connection from both a VM and a container when both are in scope. Record the effective NAT configuration and any unexpected address assignment before accepting the shared-host design.\nOfficial references\nMicrosoft Learn: Set up a NAT network. Source reviewed September 8, 2026.", "datePublished": "2026-09-08T18:14:01+00:00", "dateModified": "2026-09-08T18:26:32+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260908-190-allocate-one-coherent-address-plan-for-a-hyper-v-nat-host/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260908-190-allocate-one-coherent-address-plan-for-a-hyper-v-nat-host/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Allocate one coherent address plan for a Hyper-V NAT host" }, "articleSection": [ "Business Continuity", "IT" ], "keywords": [ "Business Continuity", "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Business Continuity", "url": "https://update.dsesecurity.com/topic/business-continuity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 217, "timeRequired": "PT1M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Set up a NAT network", "url": "https://learn.microsoft.com/en-us/windows-server/virtualization/hyper-v/setup-nat-network" } } ] } }