Virtual Machine, Host, and Guest: Setting Up the Firewall Lab

Before writing a single firewall rule, you need a lab that actually works. This opening module lays the groundwork: one physical machine runs four virtual machines in parallel, isolated from each other except through the virtual network cables you choose to connect.

A physical machine, called the host, runs a program called a hypervisor. This software simulates several complete computers inside the host: these are the guest machines. This course's lab uses four: an OPNsense firewall, a client machine, an exposed web server, and a machine that plays the attacker.

Each guest machine is installed from an OVA file: a ready-made image that already contains the operating system and its starting network configuration. Importing it takes a few clicks, no manual install required. Once a machine has started, its window captures your mouse and keyboard: a key combination called the host key (Right Ctrl by default) gives control back to your machine. That detail saves you from the first-launch panic, when the cursor seems stuck inside the window.

Shutting Down Cleanly, or Not

A virtual machine stops in two very different ways. A clean shutdown, requested from inside the system like an ordinary computer, closes services one by one. A forced power-off, triggered from the hypervisor, cuts the virtual power all at once: the equivalent of pulling the plug. The second case simulates a real failure and is used on purpose in some exercises, but it also exposes you to the most common risk of a poorly managed lab: losing a configuration you were still writing.

This is where the snapshot comes in: a complete photograph of a virtual machine's state, disk and memory included, taken at a given moment. Restoring a snapshot brings the machine back to exactly that state in a few seconds, without redoing a whole install. This course's lab takes two, at specific moments: one named initial-state right after every machine's first boot, before any change, and a second named exercise-done, once a configuration has been validated.

Getting into the habit of naming each snapshot after the exact moment it represents avoids a common mix-up: restoring the wrong starting point and losing work you thought was saved. An unnamed snapshot, or one named "backup", no longer tells you anything about its contents six exercises later.

What to remember

• The physical host runs a hypervisor, which simulates isolated guest machines: that is the foundation of any firewall lab.
• An OVA file imports an already-installed guest machine; the host key gives back control of the mouse and keyboard.
• A clean shutdown closes services one by one; a forced power-off simulates a failure and can lose an unsaved configuration.
• A snapshot photographs a machine's complete state and restores in seconds: always name it after the moment it represents.

Common trap: the most frequent question shows a guest machine that looks frozen after a failed test, and asks for the right reaction. The right move is almost never to reinstall: it's to restore the snapshot taken right before the test, provided it was actually taken and correctly named.

*Checked on September 27, 2026 against the VirtualBox User Manual, chapter 1 (default host key).*