Windows Server 2025 / How to Choose and Create Hyper-V Virtual Switches

Hyper-V virtual switches determine a VM’s connection scope. External reaches a physical network, Internal connects guests and the host, and Private connects guests on the same host. Choose based on isolation and management needs.

Compare the three switch types

Creating Internal or Private does not automatically supply DHCP or internet access. NAT on an Internal switch is a separate design requiring compatible host networks, VPNs, and address ranges. This exercise creates a Private switch without external routing.

Sharing an External switch with the management OS affects the host’s adapter path. Record existing IP, gateway, VLAN, and management access before changes. Review switch creation and sharing guidance.

Plan scope before moving any VM

Use a new switch named Lab-Private for test VM HVTEST01. Do not move working DC1 or FS1 simply because their existing isolated switch has another name; that can interrupt DNS, DHCP, and administration.

• Check the example 172.24.50.0/24 range against LANs and VPNs.
• Different switches remain separate even when guests use the same subnet numbers.
• Keep test DHCP off unapproved physical networks.
• Choose Internal instead if the host must communicate by IP, planning its virtual NIC too.

Do not invent a gateway without routing. Domain members still need internal DNS rather than public alternate DNS as a workaround.

Create the Private switch

1. Select HV1 in Hyper-V Manager.
2. Open Virtual Switch Manager.
3. Choose Private and Create Virtual Switch.
4. Name it Lab-Private and describe its isolated purpose.
5. Apply, then verify name and type.

The elevated PowerShell alternative stops on an existing name rather than overwriting another switch:

if (Get-VMSwitch -Name 'Lab-Private' -ErrorAction SilentlyContinue) {
    throw 'A switch with this name already exists. Review it first.'
}
New-VMSwitch -Name 'Lab-Private' -SwitchType Private
Get-VMSwitch -Name 'Lab-Private' | Select-Object Name,SwitchType

Verify VM attachment and guest IP separately

After creating HVTEST01, select Lab-Private for its intended network adapter. Attaching a virtual NIC does not configure the guest’s IP.

1. Inspect ipconfig /all inside the guest.
2. Give test guests unique addresses on the same switch, or verify an intentionally provided isolated DHCP lease.
3. Test the other guest’s address and required service port.
4. Compare named access to the same target.

A host that cannot directly reach a Private-switch guest may be behaving correctly. VMConnect console access is independent of that guest IP path. Ping is not proof of every service or authentication path.

Diagnose and remove only the test switch

Set VLANs only as part of the end-to-end network design. Before removing Lab-Private, inventory connected VMs and preserve needed attachments. Remove it only when no longer required, without also deleting unrelated switches or host NICs.