Product docsVirtualization & VDS
Run Hyper-V virtual machines on a Windows VDS
Install Hyper-V on a Windows VDS, give guests internet access through a NAT switch, create a Generation 2 VM from an ISO and forward ports to it from outside.
- Advanced
- 40 min read
- Updated
On this page
Nested virtualization lets a Windows VDS run Hyper-V, so you can host test machines, labs or isolated environments inside your server. This guide installs Hyper-V, builds a NAT network for the guests (your VDS has one public address), creates a VM from an ISO and makes a guest service reachable from outside. For a quick check of nested virtualization first, see VDS and nested virtualization.
Before you start
- A Windows Server 2022 or 2025 VDS or nested dedicated server; VPS plans do not offer nested virtualization.
- Remote Desktop access as administrator.
- An installation ISO for the guest, copied to the server, for example
C:\ISO\ubuntu-24.04-live-server-amd64.iso. - Enough free disk space for the guest's virtual disk.
In the examples the NAT network is 192.168.100.0/24 with the gateway 192.168.100.1, and the guest gets 192.168.100.10.
Step 1: Install Hyper-V
Open PowerShell as administrator:
Install-WindowsFeature -Name Hyper-V -IncludeManagementTools -RestartThe server restarts. Connect again with Remote Desktop.
Verify: Get-WindowsFeature -Name Hyper-V shows [X] (installed), and Hyper-V Manager opens.
Step 2: Create the NAT network
Create an internal switch, give the host its gateway address on it and turn on NAT for the network:
New-VMSwitch -SwitchName "NATSwitch" -SwitchType Internal
Get-NetAdapter -Name "vEthernet (NATSwitch)"
New-NetIPAddress -IPAddress 192.168.100.1 -PrefixLength 24 -InterfaceAlias "vEthernet (NATSwitch)"
New-NetNat -Name "VMNAT" -InternalIPInterfaceAddressPrefix 192.168.100.0/24Windows supports one NAT network per host; if New-NetNat fails because one exists, check it with Get-NetNat.
Verify: Get-NetNat lists VMNAT with the prefix 192.168.100.0/24.
Step 3: Create a Generation 2 VM
Create the VM with a new virtual disk, attach the ISO and boot from it:
New-VM -Name "ubuntu1" -Generation 2 -MemoryStartupBytes 4GB -NewVHDPath "C:\VMs\ubuntu1.vhdx" -NewVHDSizeBytes 40GB -SwitchName "NATSwitch"
Set-VMProcessor -VMName "ubuntu1" -Count 2
Add-VMDvdDrive -VMName "ubuntu1" -Path "C:\ISO\ubuntu-24.04-live-server-amd64.iso"
Set-VMFirmware -VMName "ubuntu1" -FirstBootDevice (Get-VMDvdDrive -VMName "ubuntu1")For Linux guests with Secure Boot, switch the VM to the Microsoft UEFI certificate authority template (Windows guests keep the default):
Set-VMFirmware -VMName "ubuntu1" -SecureBootTemplate MicrosoftUEFICertificateAuthorityStart the VM and open its console:
Start-VM -Name "ubuntu1"
vmconnect.exe localhost "ubuntu1"Step 4: Configure the guest's network
Install the guest operating system. When the installer asks for the network, set it manually, because the NAT network has no DHCP:
| Setting | Value |
|---|---|
| Address | 192.168.100.10/24 |
| Gateway | 192.168.100.1 |
| DNS servers | public resolvers, for example 1.1.1.1 and 9.9.9.9 |
Verify: inside the guest, ping -c 3 1.1.1.1 and ping -c 3 example.com get replies.
Step 5: Reach the guest from outside
Publish a guest port on a port of the host. This example forwards host port 2222 to SSH in the guest:
Add-NetNatStaticMapping -NatName "VMNAT" -Protocol TCP -ExternalIPAddress 0.0.0.0 -ExternalPort 2222 -InternalIPAddress 192.168.100.10 -InternalPort 22
New-NetFirewallRule -DisplayName "Guest SSH 2222" -Direction Inbound -Action Allow -Protocol TCP -LocalPort 2222 -Profile AnyFrom your computer, connect with ssh -p 2222 user@203.0.113.10 (the VDS's public address). List mappings with Get-NetNatStaticMapping and remove one with Remove-NetNatStaticMapping.
Troubleshooting
Install-WindowsFeature reports that Hyper-V cannot be installed because the processor lacks virtualization capabilities. The extensions are not visible to the server; see nested virtualization problems.
The VM does not boot from the ISO, or shows "The image's hash and certificate are not allowed". For Linux guests, set the MicrosoftUEFICertificateAuthority template (Step 3). Check the boot order with Get-VMFirmware -VMName "ubuntu1".
The guest has no internet. Check the guest's address, gateway and DNS (Step 4), and Get-NetNat on the host. Only one NAT network may exist.
The forwarded port does not answer. Check the mapping (Get-NetNatStaticMapping), the host firewall rule and the guest's own firewall. Test from outside, not from the host itself.
Guests are slow. Nested guests have overhead. Give them fixed memory, keep vCPU counts modest and avoid heavy disk work inside them.
Next steps
- Linux tools inside Windows: WSL 2 on Windows Server.
- Something does not start: nested virtualization problems.
Frequently asked questions
Why NAT and not an external switch?
An external switch bridges guests onto the server's network, where each guest needs its own public address. With one address, a NAT network shares it: guests reach the internet, and you publish the ports you need with port mappings.
Do guests get their IP address automatically?
No. The Windows NAT does not hand out addresses, so give each guest a static IP address in the NAT network, the NAT gateway as its default gateway, and DNS servers.
Can I give a guest its own public IP address?
Order an additional IPv4 address and ask us in a ticket how it is routed to your server before you set it up, because the setup depends on how the address reaches the server.
How many VMs can I run?
As many as the VDS's memory, vCPUs and disk allow. Leave memory for the host itself, and remember that nested guests run slower than the host.