How to keep virtual machine off the Internet?

[mpack]

If your router has a "guest network" feature, set up the guest network without LAN access, and connect your wireless TV device to that network. This is what I do with my Roku streaming device, and it works well.

That sounds like an excellent idea, thanks!

p.s. I didn't actually say to use a static IP address, I said the router has to recognize the IP address in order to blacklist it, e.g. because the router assigned it to the VM using DHCP. Of course the feature would be useless if the IP assignment changes a lot. Even better would be to blacklist at a MAC level, but for some reason I'm having difficulty finding a router that does that.

[cdg]

...Even better would be to blacklist at a MAC level, but for some reason I'm having difficulty finding a router that does that.

The TP-LINK AC1750 Archer C7 router has that capability, and is reasonably priced. If I remember correctly, the TP-LINK N600 also has the capability.

[fth0]

p.s. I didn't actually say to use a static IP address, I said the router has to recognize the IP address in order to blacklist it, e.g. because the router assigned it to the VM using DHCP. Of course the feature would be useless if the IP assignment changes a lot. Even better would be to blacklist at a MAC level, but for some reason I'm having difficulty finding a router that does that.

Instead of blacklisting the MAC address: If the DHCP server in the router allows static DHCP entries, you can configure it to assign a fixed IPv4 address to the device depending on it's MAC address, and then you can blacklist the IPv4 address.

[mpack]

If the DHCP server in the router allows static DHCP entries

IME you can always do this. Even if the Router doesn't have an obvious reserved address scheme (e.g. my Router is missing that feature), you can still manually allocate an address that it inside the valid subnet range but outside the range used for DHCP.

[fth0]

Reading your reply, I noticed that my statement can be interpreted in different ways (I'm no native English speaker), so I'll try and clarify it:

I meant to configure the static DHCP entries inside the router, not on the PC or VM. And I think there are (cheap) routers out there that have a DHCP server, but no configuration table for fixed/static MAC/IP address pairs.

[cdg]

Use of uppercase is yelling on the internet. The meaning of things changes.

So that means we can't write IBM, MS, NATO, NAFTA, SALT, etc., or is it just when upper-case is properly used for emphasis is it forbidden? (Just want to get the rules straight. Also, who makes up these rules?)

[socratis]

Of course you can use acronyms!
Of course the use of capital letters in NOT always yelling...

UNLESS OF COURSE YOU CAPITALIZE THE WHOLE SENTENCE, WHICH SHOWS THAT YOU'RE PISSED OFF AT SOMETHING!!!

[cdg]

...UNLESS OF COURSE YOU CAPITALIZE THE WHOLE SENTENCE, WHICH SHOWS THAT YOU'RE PISSED OFF AT SOMETHING!!!

But if you don't use any upper-case letters, people might confuse you with e. e. cummings.

There are no upper-case letters in Hebrew, Arabic, Japanese, Chinese, and a few others. So how do they shout on the Internet?

[Sundial Services]

Firewall or parental controls within the Windows guest might be an effective way to manage things, also.

[MontyMan]

I recently created an XP VM which I'll want to keep off the 'net most of the time, just to reduce the risk of infection and unnecessary Internet accesses from the mostly-deprecated system. The VM will mostly be used for image editing with PhotoDeluxe, and some old games. I was going to accomplish the block simply by going into the VM settings and disabling the virtual network connection, but I don't want to do it that way if it will mean Guest Additions can no longer share folders with the host system.

Occasionally I'll need to recall a browser-memorized password, and for that I will temporarily connect the network. When it was on the metal, this was my main home system from 2005 to 2015 so there is a lot of browsing history.

[mpack]

Firewall or parental controls within the Windows guest might be an effective way to manage things, also.

I assume the goal is to prevent malware or a person using the VM from accessing the internet. Obviously, if it's just switched off inside the guest then it can easily be switched on again, from inside the guest.

[socratis]

I was going to accomplish the block simply by going into the VM settings and disabling the virtual network connection, but I don't want to do it that way if it will mean Guest Additions can no longer share folders with the host system.

You can have not a single networking card (forget about the kind, attached and cable conditions) and still have Shared Folder functionality, believe it or not it's not network dependent. It simply shows up on that part of the Explorer.