How to Configure DHCP Guard and Router Guard on Windows 11 Hyper-V Adapters Using PowerShell

In virtualized enterprise networks and lab environments running Hyper-V on Windows 11, virtual machines often simulate full network stacks. If a rogue or misconfigured virtual machine accidentally runs a DHCP server daemon (such as dnsmasq, ISC DHCP, or Windows Server DHCP) or starts emitting rogue IPv6 Router Advertisement (RA) messages, it can hijack default gateway routes and assign invalid IP addresses to other VMs and physical computers across the local area network. To safeguard virtual and physical networks against man-in-the-middle attacks and network service hijacking, Hyper-V includes hardware-enforced virtual switch security features: DHCP Guard and Router Guard.

Understanding Hyper-V Virtual Switch Security Guards

Hyper-V enforces network packet filtering at the virtual port layer before frames can traverse the virtual switch:

• DHCP Guard: When enabled on a virtual machine\u2019s network adapter, the Hyper-V virtual switch automatically inspects incoming Ethernet frames originating from that VM. If the VM attempts to broadcast DHCP Offer or DHCP Acknowledge packets (acting as a rogue DHCP server), the virtual switch drops the packets silently while allowing standard DHCP client requests (DHCP Discover/Request) to pass.
• Router Guard: Prevents compromised or misconfigured virtual machines from advertising themselves as default network routers. The virtual switch drops all unauthorized ICMPv6 Router Advertisements (RA) and ICMPv4 Redirect messages emitted by the guarded VM.
• MAC Address Spoofing: Restricts a virtual machine to transmitting packets only from its explicitly assigned MAC address, preventing ARP poisoning and Layer 2 spoofing attacks.

Inspecting Current Virtual Network Adapter Security Settings

Open PowerShell with administrative privileges and query the security parameters of your virtual machines:

Get-VMNetworkAdapter -VMName "DevVM" | Select-Object VMName, Name, DhcpGuard, RouterGuard, MacAddressSpoofing

The command outputs the operational security states:

VMName Name            DhcpGuard RouterGuard MacAddressSpoofing
------ ----            --------- ----------- ------------------
DevVM  Network Adapter Off       Off         Off

Notice that by default, Hyper-V provisions virtual adapters with DhcpGuard and RouterGuard turned Off.

Enabling DHCP Guard on a Virtual Machine

To prevent a virtual machine (such as a developer test instance or untrusted tenant VM) from emitting rogue DHCP server replies:

Set-VMNetworkAdapter -VMName "DevVM" -DhcpGuard On

The virtual switch immediately drops all outbound DHCP server packets originating from DevVM. The VM can still obtain an IP address normally from your physical router or authorized DHCP server, but it cannot broadcast offers to other devices.

Enabling Router Guard Against Rogue IPv6 Gateways

In modern IPv6 networks, devices automatically discover default gateways via stateless address autoconfiguration (SLAAC) by listening for Router Advertisements. If an untrusted VM broadcasts malicious RAs with higher route priorities, it can intercept all IPv6 outbound traffic. To prevent this, enable Router Guard:

Set-VMNetworkAdapter -VMName "DevVM" -RouterGuard On

The Hyper-V virtual port drops any ICMPv6 Type 134 (Router Advertisement) packets emitted by the virtual machine.

Configuring MAC Address Spoofing Protection

To ensure that the virtual machine cannot impersonate other physical or virtual hardware addresses on the switch, confirm that MAC Address Spoofing is disabled:

Set-VMNetworkAdapter -VMName "DevVM" -MacAddressSpoofing Off

Note: MAC Address Spoofing should only be enabled (On) if the virtual machine is actively hosting Nested Hyper-V, Docker containers, or an internal network bridge where multiple MAC addresses legitimately traverse a single virtual port.

Applying Security Policies Across All Virtual Machines Simultaneously

To harden all virtual machines running on your Windows 11 host in a single command pipeline:

Get-VMNetworkAdapter -VMName * | Set-VMNetworkAdapter -DhcpGuard On -RouterGuard On -MacAddressSpoofing Off

To verify that all virtual adapters have adopted the hardened security profile:

Get-VMNetworkAdapter -VMName * | Format-Table VMName, DhcpGuard, RouterGuard, MacAddressSpoofing -AutoSize

Every virtual adapter reports On for DHCP and Router guards, insulating your local physical and virtual networks against accidental misconfiguration and malicious spoofing.