I'm setting up a Debian machine running a Windows 7 guest in a qemu/kvm virtualization stack. Since the Windows machine is running out-dated software, I decided to put it into a VM without Internet access. However, I need to get files in and out of the VM.

I heard that it's possible to set up a host-only network and change the firewall rules in order to prohibit all accesses but to the host machine. The host however needs full Internet access.

I have no experience with firewall configuration under Linux. How can I achieve the goal described above?


This should do it:

$ qemu-system-x86_64 -net nic -net user,restrict=on,smb=/path/to/shared/folder ...

From the manpage:

-netdev user,id=id[,option][,option][,...]
-net user[,option][,option][,...]
    Use the user mode network stack which requires no administrator
    privilege to run. Valid options are:
        If this option is enabled, the guest will be isolated, i.e. it
        will not be able to contact the host and no guest IP packets
        will be routed over the host to the outside. This option does
        not affect any explicitly set forwarding rules.
        When using the user mode network stack, activate a built-in SMB
        server so that Windows OSes can access to the host files in dir
        transparently. The IP address of the SMB server can be set to
        addr. By default the 4th IP in the guest network is used, i.e.
        In the guest Windows OS, the line:
        must be added in the file C:\WINDOWS\LMHOSTS (for windows
        9x/Me) or C:\WINNT\SYSTEM32\DRIVERS\ETC\LMHOSTS (Windows
        Then dir can be accessed in \\smbserver\qemu.
        Note that a SAMBA server must be installed on the host OS.
        QEMU was tested successfully with smbd versions from Red Hat 9,
        Fedora Core 3 and OpenSUSE 11.x.

For this to work, samba must be installed on the host system; it doesn't need to be configured or running, just the smbd binary is needed, which will be run with an ad-hoc configuration and no privileges.


In windows 7, you can connect to the shared folder from Computer -> Add Network Location -> Choose a custom network location -> \\\qemu.

If windows insists on opening the "Connect to the Internet" wizard, then just close it; the "Add Network Location" wizard is still running, and you can reopen its window by clicking on the taskbar icon.

  • Is possible to do it in graphical virt-manager? – lucky62 Mar 22 '19 at 8:29
  • @lucky62 I haven't tried it, but probably yes if virt-manager lets you add custom arguments to the qemu command line. But I don't see the point of it -- this is about running an isolated windows instance, not one connected to any virtual network. – mosvy Mar 22 '19 at 11:01

Turns out, I can use virt-manager to create an isolated network, then start up samba (smb server) and configure it to listen to virbr1 (the isolated network). Appearently the isolated network prohibits communication to the outside world but allows to reach the host, which is exactly what I was looking for.

EDIT for more explanation:

  • I want to do the same exact thing. Can you please post more details about how to do this? – becko Sep 6 '18 at 16:31
  • I elaborated in an edit, hope that helps – Kalsan Sep 15 '18 at 7:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.