Custom networks

A custom network is a named private segment any number of VMs can join. VMs on it see each other directly; the mode decides whether anything routes outside.

Manage them in the Networks section of the sidebar or with mvz networks. VMs made from cloud images join one by default, the Default MacVisor Network.

Defining a network

A network is a definition when you create it and becomes live when the first VM on it starts; the detail view shows which. Attach a VM in VM Settings -> Network or with mvz set <vm> --network <network>; a running VM picks the change up at its next start.

mvz networks                                   # list
mvz networks create lab                        # shared, automatic subnet
mvz networks create isolated --host-only       # host-only, automatic subnet
mvz set dev --network lab
mvz networks rm lab                            # refused while a VM uses it

Addressing

Leave addressing empty and vmnet picks a /24 under 192.168.0.0/16. On macOS 27 what you can pin is limited by vmnet, not MacVisor:

• IPv4 subnet and mask: host-only only, a /24 under 192.168.0.0/16. MacVisor warns before you save anything else. Guests on a fixed subnet need static addresses.
• IPv6 prefix and length: a specific ULA prefix instead of a random one.
• MTU: 1500 by default.

macOS hands shared networks their subnets in the order the networks are made (192.168.64.0/24, then .65, and so on) and can't be told which one to use. MacVisor keeps each network's subnet the same:

• A network stays reserved while MacVisor runs, whether or not its VMs are running, so stopping its VMs doesn't free its subnet for the next network.
• When MacVisor starts (at login), it makes the networks your VMs use in a set order, the Default MacVisor Network first and then the rest in the order you made them, so each gets the same subnet every time.

Two things can still move a network to another subnet: changing its settings (it's made afresh), and another app on the Mac (Docker Desktop, UTM, Internet Sharing) taking that subnet first. Then the VMs on it get new addresses. mvz networks marks the network's subnet with * and says what it was, the Networks list shows "changed from ...", and the service log says so too. The firewall is keyed to the subnet and follows it; reservations and anything you wrote down by hand do not. Reach VMs by name (<vm>.mvz, see Names), which follows them to their new address.

Services

Each network runs its own gateway services, individually switchable:

Services by mode

Host Only has no uplink, so switching a network to it turns DNS proxy, NAT44, and NAT66 off. In shared mode you can pin the uplink to one host interface, which is useful on a Mac with both Wi-Fi and Ethernet, or to go out through a VLAN interface.

While a network's firewall is on, NAT66 and router advertisement are off and their switches are greyed out, because the firewall filters IPv4 only and guests could otherwise go around it over IPv6. Your settings come back when the firewall is turned off. A shared network with NAT44 off is the exception: IPv6 NAT is its only way out, so its IPv6 stays on, unfiltered. VMs already running keep IPv6 until every VM on the network has stopped.

DHCP reservations

A reservation binds a MAC address to an address in the subnet, so a guest keeps its IP across reboots and reinstalls with no guest-side configuration. The MAC picker lists the NICs of VMs already on the network.

mvz ip dev --wait                          # see which subnet vmnet gave the network
mvz networks reserve lab dev 192.168.105.50

Two conditions, both vmnet's:

• The guest must send its MAC in the DHCP request. Cloud-image VMs do. A hand-installed Ubuntu sends a DUID until you set dhcp-identifier: mac.
• Reservations exist only where macOS serves DHCP: shared networks, and host-only networks on an automatic subnet. They hold while the network keeps its subnet, which it does unless its settings change or another app takes that subnet first; see Addressing. If it moves, the Networks editor shows the reservations left outside the new subnet with a Move to button, and mvz networks points to mvz networks move-reservations <network>; both move them into the new subnet with their host numbers kept (.50 stays .50), skipping any whose new address is taken.

Reservations are what make port forwards and firewall rules that name an address dependable. To simply reach a VM from the Mac, use its name instead: <vm>.mvz always resolves to its current address.

Network port forwarding

Network-level forwards are vmnet NAT rules: a host TCP or UDP port maps to an address and port inside the segment.

host :8443  ->  192.168.105.10:443

Seeing what is attached

The network detail view lists every VM NIC configured for the network:

• Green: seen on the network's bridge via ARP.
• Orange: the VM is running but nothing from that NIC has been seen, or its attachment failed. Check the VM's runner log.
• Stopped: configured, not running.

The Networks section also browses host interfaces (physical uplinks, vmnet bridges, VLAN interfaces) with their addresses, child interfaces, and attached VM ports.

VLAN interfaces

Apple's Virtualization framework has no VLAN tagging, so MacVisor creates 802.1Q VLAN interfaces on the host. New VLAN Interface... takes a name, a tag from 1 to 4094, and a parent interface. VLAN changes go through the network helper, which makes them for an administrator account without asking again and deletes only VLAN interfaces MacVisor created. A standard account, a Mac without the helper, or deleting a VLAN interface the helper didn't create (one made in System Settings, without the helper, or by an earlier MacVisor) asks for an administrator password each time. The result is a bridged host interface for VM NICs, and an uplink choice for shared networks.

Firewalling a network

Each custom network can carry an inbound/outbound policy enforced by the host packet filter, set in the app or with mvz networks firewall, and applied by the background service whether or not the app is open. Rules are checked in order and the first match wins; the CLI keeps them in the order you type them and adds new ones after the existing rules unless --clear. See Network firewall.

Deleting a network

Delete removes the definition; it and mvz networks rm are refused while a VM uses the network. That includes a suspended VM whose saved session was made on it, even if you have since moved the VM to another network, because the session resumes on the network it was saved with. Resume that VM and shut it down, or start it from disk, first. VMs still pointing at a deleted network land on the Default MacVisor Network the next time they are cloned or imported, so re-point their NICs first.