How to Configure Windows Sandbox Custom Static IP and Default Gateway via XML in Windows 11

When simulating network routing scenarios, evaluating IP-whitelisted enterprise firewalls, or testing client-server software that expects predictable interface addressing, dynamic DHCP assignment can introduce instability. By default, Windows Sandbox receives a transient, randomized IPv4 address from the internal Hyper-V Virtual Switch NAT range (typically in the 172.x.x.x or 192.168.x.x subnet). Using Windows Sandbox configuration (.wsb) XML profiles paired with PowerShell network cmdlets, systems administrators can assign static IP addresses, define explicit default gateways, and inject static route metrics upon container launch.

Understanding Windows Sandbox NAT Network Architecture

Windows Sandbox attaches to the host via an internal Hyper-V NAT adapter:

• vEthernet (Default Switch): The virtual adapter within the sandbox container communicating directly with the host’s virtual NAT gateway.
• Static IP Prerequisites: The static IP assigned within the sandbox must reside within the identical subnet mask and gateway address allocated by the host Hyper-V NAT service to preserve external connectivity.
• New-NetIPAddress: The core PowerShell cmdlet used to overwrite DHCP configuration and bind a deterministic IP address to the virtual adapter.

Authoring the Windows Sandbox WSB Profile

Save the following configuration as Static_Network_Sandbox.wsb on your Windows 11 host machine:

<Configuration>
  <VGpu>Enable</VGpu>
  <Networking>Default</Networking>
  <MemoryInMB>6144</MemoryInMB>
  <MappedFolders>
    <MappedFolder>
      <HostFolder>C:SandboxNetworkConfig</HostFolder>
      <SandboxFolder>C:NetConfig</SandboxFolder>
      <ReadOnly>true</ReadOnly>
    </MappedFolder>
  </MappedFolders>
  <LogonCommand>
    <Command>powershell.exe -ExecutionPolicy Bypass -NoExit -File C:NetConfigSet-StaticIP.ps1 -StaticIP "172.28.16.50" -PrefixLength 20 -Gateway "172.28.16.1" -DnsServer "1.1.1.1"</Command>
  </LogonCommand>
</Configuration>

Authoring the PowerShell Static IP Configuration Script

In directory C:SandboxNetworkConfig on your host, create Set-StaticIP.ps1:

param (
    [string]$StaticIP = "172.28.16.50",
    [int]$PrefixLength = 20,
    [string]$Gateway = "172.28.16.1",
    [string]$DnsServer = "1.1.1.1"
)

Write-Host "Configuring Windows Sandbox Static IP Configuration..." -ForegroundColor Cyan

# Locate the active Hyper-V virtual network adapter
$Adapter = Get-NetAdapter | Where-Object { $_.Status -eq "Up" } | Select-Object -First 1

if ($Adapter) {
    Write-Host "Configuring network interface: $($Adapter.Name)" -ForegroundColor Green
    
    # Remove existing dynamic IP addresses
    Get-NetIPAddress -InterfaceAlias $Adapter.Name -AddressFamily IPv4 | Remove-NetIPAddress -Confirm:$false -ErrorAction SilentlyContinue
    
    # Assign Static IPv4 Address and Default Gateway
    New-NetIPAddress -InterfaceAlias $Adapter.Name -IPAddress $StaticIP -PrefixLength $PrefixLength -DefaultGateway $Gateway | Out-Null
    
    # Set DNS Client Server
    Set-DnsClientServerAddress -InterfaceAlias $Adapter.Name -ServerAddresses $DnsServer
    
    Write-Host "Static IP $StaticIP successfully assigned with gateway $Gateway." -ForegroundColor Green
} else {
    Write-Error "No active network interface discovered in Windows Sandbox."
}

# Display configuration summary
Write-Host "Displaying active TCP/IP configuration:" -ForegroundColor Yellow
ipconfig.exe /all | Select-String "IPv4 Address", "Subnet Mask", "Default Gateway", "DNS Servers" | Write-Host

# Test connectivity with ping
Write-Host "Verifying gateway reachability:" -ForegroundColor Cyan
ping.exe -n 2 $Gateway | Write-Host

Testing and Validating Network Isolation

1. Double-click Static_Network_Sandbox.wsb on your Windows 11 host.
2. Windows Sandbox spins up in seconds.
3. The PowerShell window opens automatically upon logon, clears dynamic DHCP leases, binds 172.28.16.50, sets the default gateway, and displays confirmation pings.
4. Execute test network connections or diagnostic utilities to confirm static IP bindings.
5. Closing Windows Sandbox destroys the guest operating system, releasing the virtual address without impacting the host machine.