How to Configure Hyper-V Virtual Switch Port Access Control Lists (ACLs) in Windows 11 Using PowerShell

In virtualised enterprise and laboratory environments on Windows 11, securing virtual machines (VMs) against unauthorized lateral network movement typically requires configuring guest-level firewalls. However, relying solely on in-guest firewalls leaves infrastructure vulnerable if guest operating systems are compromised, misconfigured, or running legacy kernels without active filtering. Hyper-V’s Virtual Switch operates as a programmable layer-2 network switch capable of enforcing hardware-enforced port Access Control Lists (ACLs) directly at the hypervisor layer. By leveraging PowerShell cmdlets such as Add-VMNetworkAdapterAcl, system administrators can enforce granular inbound and outbound traffic filtering, IP metering, and isolated subnet policies without consuming guest VM resources.

Understanding Hyper-V Port ACL Architecture

Hyper-V port ACLs are bound directly to a virtual machine’s virtual network adapter (VMNetworkAdapter). Because packet evaluation occurs at the virtual switch ingress and egress ports before frames reach guest operating system buffers, network policies remain completely tamper-proof from inside the VM.

Port ACL rules support three operational actions:

• Allow: Permits matching packets to pass through the virtual switch port.
• Deny: Drops matching packets immediately at the switch boundary.
• Meter: Permits traffic while measuring packet counts and byte volumes for capacity auditing, bandwidth billing, or network forensics.

Rules can match based on traffic direction (Inbound or Outbound), remote and local IPv4/IPv6 addresses, subnet CIDR blocks, or MAC hardware addresses.

Auditing Existing Virtual Network Adapters and ACL Rules

Before implementing ACL rules, identify the target virtual machine and query its associated network adapters using elevated PowerShell.

List all virtual machines and their active network adapters:

Get-VMNetworkAdapter -All | Select-Object VMName, Name, IPAddresses, SwitchName, MacAddress

To inspect currently applied ACLs on a specific VM’s network interface:

Get-VMNetworkAdapterAcl -VMName "DevBox01" | Format-Table -AutoSize

If no rules have been configured, the query returns empty, indicating that the default virtual switch forwarding policy applies.

Configuring Default Deny and Whitelist Rules

To establish a zero-trust network posture for a sensitive virtual machine, configure a default deny rule for inbound traffic, followed by explicit allow rules for required management protocols.

To deny all inbound traffic from any remote IP address:

Add-VMNetworkAdapterAcl -VMName "DevBox01" `
    -Action Deny `
    -Direction Inbound `
    -RemoteIPAddress "ANY"

Next, allow inbound connections exclusively from a trusted administrative subnet (e.g. 192.168.10.0/24):

Add-VMNetworkAdapterAcl -VMName "DevBox01" `
    -Action Allow `
    -Direction Inbound `
    -RemoteIPAddress "192.168.10.0/24"

Hyper-V evaluates specific network address rules prior to wildcard (ANY) rules, ensuring that trusted subnet traffic passes while all other inbound attempts are dropped.

Restricting Lateral Subnet Traffic and Outbound Destinations

In multi-tenant or malware analysis lab scenarios, you may want to prevent a guest VM from scanning or communicating with neighbouring VMs on the local subnet while permitting external internet egress.

To block outbound communication to the local corporate subnet (e.g. 10.0.0.0/8) while leaving general internet access operational:

Add-VMNetworkAdapterAcl -VMName "DevBox01" `
    -Action Deny `
    -Direction Outbound `
    -RemoteIPAddress "10.0.0.0/8"

To block communication to a specific hostile or unmanaged MAC address at layer 2:

Add-VMNetworkAdapterAcl -VMName "DevBox01" `
    -Action Deny `
    -Direction Inbound `
    -RemoteMacAddress "00-15-5D-AA-BB-CC"

Configuring Network Metering for Bandwidth and Traffic Auditing

Hyper-V port ACLs can also function as passive telemetry meters without altering packet flow. This is particularly useful for measuring egress traffic consumed by specific services or testing bandwidth utilization.

To create a network meter monitoring outbound traffic directed to a cloud repository (e.g. 203.0.113.0/24):

Add-VMNetworkAdapterAcl -VMName "DevBox01" `
    -Action Meter `
    -Direction Outbound `
    -RemoteIPAddress "203.0.113.0/24"

To retrieve real-time statistical metrics recorded by the meter rule:

Get-VMNetworkAdapterAcl -VMName "DevBox01" |
    Where-Object { $_.Action -eq "Meter" } |
    Select-Object Direction, RemoteIPAddress, InboundPackets, OutboundPackets, InboundBytes, OutboundBytes

Modifying and Removing Hyper-V Port ACL Rules

When decommissioning isolation policies or altering firewall rules, remove individual ACL definitions using Remove-VMNetworkAdapterAcl.

To remove a specific rule matching an IP subnet:

Remove-VMNetworkAdapterAcl -VMName "DevBox01" `
    -Action Allow `
    -Direction Inbound `
    -RemoteIPAddress "192.168.10.0/24"

To purge all port ACLs configured on a virtual machine and restore standard switch behaviour:

Get-VMNetworkAdapterAcl -VMName "DevBox01" | Remove-VMNetworkAdapterAcl -VMName "DevBox01"

Enforcing port access control lists directly within the Windows 11 Hyper-V Virtual Switch delivers robust, hypervisor-level security boundaries that protect local virtual workloads from lateral exploitation and network spoofing.