# Run Hyper-V virtual machines on a Windows VDS

> Install Hyper-V on a Windows VDS, give guests internet access through a NAT switch, create a Generation 2 VM from an ISO and forward ports to it from outside.

Difficulty: Advanced

Nested virtualization lets a Windows VDS run **Hyper-V**, so you can host test machines, labs or isolated environments inside your server. This guide installs Hyper-V, builds a NAT network for the guests (your VDS has one public address), creates a VM from an ISO and makes a guest service reachable from outside. For a quick check of nested virtualization first, see [VDS and nested virtualization](/guides/vds-nested-virtualization).

## Before you start

- A Windows Server 2022 or 2025 **VDS** or nested dedicated server; VPS plans do not offer nested virtualization.
- Remote Desktop access as administrator.
- An installation ISO for the guest, copied to the server, for example `C:\ISO\ubuntu-24.04-live-server-amd64.iso`.
- Enough free disk space for the guest's virtual disk.

In the examples the NAT network is `192.168.100.0/24` with the gateway `192.168.100.1`, and the guest gets `192.168.100.10`.

## Step 1: Install Hyper-V

Open PowerShell as administrator:

```powershell
Install-WindowsFeature -Name Hyper-V -IncludeManagementTools -Restart
```

The server restarts. Connect again with Remote Desktop.

**Verify:** `Get-WindowsFeature -Name Hyper-V` shows `[X]` (installed), and **Hyper-V Manager** opens.

## Step 2: Create the NAT network

Create an internal switch, give the host its gateway address on it and turn on NAT for the network:

```powershell
New-VMSwitch -SwitchName "NATSwitch" -SwitchType Internal
Get-NetAdapter -Name "vEthernet (NATSwitch)"
New-NetIPAddress -IPAddress 192.168.100.1 -PrefixLength 24 -InterfaceAlias "vEthernet (NATSwitch)"
New-NetNat -Name "VMNAT" -InternalIPInterfaceAddressPrefix 192.168.100.0/24
```

Windows supports **one NAT network per host**; if `New-NetNat` fails because one exists, check it with `Get-NetNat`.

**Verify:** `Get-NetNat` lists `VMNAT` with the prefix `192.168.100.0/24`.

> **Warning**
>
> Do not create an **external** switch on the server's public network adapter. It moves the host's connection onto the switch, and guests would appear on the public network with their own MAC addresses. Use the NAT network.

## Step 3: Create a Generation 2 VM

Create the VM with a new virtual disk, attach the ISO and boot from it:

```powershell
New-VM -Name "ubuntu1" -Generation 2 -MemoryStartupBytes 4GB -NewVHDPath "C:\VMs\ubuntu1.vhdx" -NewVHDSizeBytes 40GB -SwitchName "NATSwitch"
Set-VMProcessor -VMName "ubuntu1" -Count 2
Add-VMDvdDrive -VMName "ubuntu1" -Path "C:\ISO\ubuntu-24.04-live-server-amd64.iso"
Set-VMFirmware -VMName "ubuntu1" -FirstBootDevice (Get-VMDvdDrive -VMName "ubuntu1")
```

For **Linux** guests with Secure Boot, switch the VM to the Microsoft UEFI certificate authority template (Windows guests keep the default):

```powershell
Set-VMFirmware -VMName "ubuntu1" -SecureBootTemplate MicrosoftUEFICertificateAuthority
```

Start the VM and open its console:

```powershell
Start-VM -Name "ubuntu1"
vmconnect.exe localhost "ubuntu1"
```

## Step 4: Configure the guest's network

Install the guest operating system. When the installer asks for the network, set it **manually**, because the NAT network has no DHCP:

| Setting | Value |
|---|---|
| Address | `192.168.100.10/24` |
| Gateway | `192.168.100.1` |
| DNS servers | public resolvers, for example `1.1.1.1` and `9.9.9.9` |

**Verify:** inside the guest, `ping -c 3 1.1.1.1` and `ping -c 3 example.com` get replies.

## Step 5: Reach the guest from outside

Publish a guest port on a port of the host. This example forwards host port `2222` to SSH in the guest:

```powershell
Add-NetNatStaticMapping -NatName "VMNAT" -Protocol TCP -ExternalIPAddress 0.0.0.0 -ExternalPort 2222 -InternalIPAddress 192.168.100.10 -InternalPort 22
New-NetFirewallRule -DisplayName "Guest SSH 2222" -Direction Inbound -Action Allow -Protocol TCP -LocalPort 2222 -Profile Any
```

From your computer, connect with `ssh -p 2222 user@203.0.113.10` (the VDS's public address). List mappings with `Get-NetNatStaticMapping` and remove one with `Remove-NetNatStaticMapping`.

## Troubleshooting

**`Install-WindowsFeature` reports that Hyper-V cannot be installed because the processor lacks virtualization capabilities.** The extensions are not visible to the server; see [nested virtualization problems](/guides/nested-virtualization-problems).

**The VM does not boot from the ISO, or shows "The image's hash and certificate are not allowed".** For Linux guests, set the `MicrosoftUEFICertificateAuthority` template (Step 3). Check the boot order with `Get-VMFirmware -VMName "ubuntu1"`.

**The guest has no internet.** Check the guest's address, gateway and DNS (Step 4), and `Get-NetNat` on the host. Only one NAT network may exist.

**The forwarded port does not answer.** Check the mapping (`Get-NetNatStaticMapping`), the host firewall rule and the guest's own firewall. Test from outside, not from the host itself.

**Guests are slow.** Nested guests have overhead. Give them fixed memory, keep vCPU counts modest and avoid heavy disk work inside them.

## Next steps

- Linux tools inside Windows: [WSL 2 on Windows Server](/guides/wsl2-on-windows-server).
- Something does not start: [nested virtualization problems](/guides/nested-virtualization-problems).

## Frequently asked questions

### Why NAT and not an external switch?

An external switch bridges guests onto the server's network, where each guest needs its own public address. With one address, a NAT network shares it: guests reach the internet, and you publish the ports you need with port mappings.

### Do guests get their IP address automatically?

No. The Windows NAT does not hand out addresses, so give each guest a static IP address in the NAT network, the NAT gateway as its default gateway, and DNS servers.

### Can I give a guest its own public IP address?

Order an additional IPv4 address and ask us in a ticket how it is routed to your server before you set it up, because the setup depends on how the address reaches the server.

### How many VMs can I run?

As many as the VDS's memory, vCPUs and disk allow. Leave memory for the host itself, and remember that nested guests run slower than the host.

---

Source: <https://hyperdc.com/guides/products/hyper-v-on-windows-vds>\
Updated: 2026-10-15