How to Configure Hyper-V Private Virtual LANs (PVLANs) in Windows 11 Using PowerShell

In multi-tenant cloud hosting, DMZ lab environments, and zero-trust virtual networking, network administrators frequently need to isolate virtual machines that reside on the exact same IP subnet. Traditionally, isolating virtual machines required provisioning separate Layer 3 IP subnets, assigning distinct default gateways, and creating firewall routing rules. In Microsoft Hyper-V on Windows 11 Pro and Enterprise, this isolation is achieved at Layer 2 through Private Virtual LANs (PVLANs). PVLANs partition a single broadcast domain into isolated sub-channels without requiring IP address reallocation or additional router interfaces. Configuring PVLAN modes via PowerShell provides precise control over inter-VM traffic segregation.

Understanding Hyper-V PVLAN Port Modes and Hierarchy

PVLANs structure Ethernet traffic using a dual-tagging hierarchy consisting of a Primary VLAN ID and one or more Secondary VLAN IDs. Hyper-V supports three distinct secondary port modes:

• Isolated Mode: Virtual network adapters configured as Isolated can communicate exclusively with Promiscuous ports (such as the default gateway router or firewall). Isolated ports are completely blocked from communicating with any other virtual machine on the same subnet, preventing lateral malware traversal.
• Community Mode: Virtual network adapters can communicate with Promiscuous ports and with other virtual machines sharing the exact same Community Secondary VLAN ID. However, they remain isolated from other community groups and all isolated ports.
• Promiscuous Mode: Assigned to the default gateway router, internet firewall, or network monitor. Promiscuous ports can communicate bidirectionally with all ports in the PVLAN domain (including Isolated, Community, and adjacent Promiscuous ports).

Auditing Existing Virtual Machine VLAN Configurations

To inspect current VLAN and PVLAN configurations across all virtual machines attached to your Hyper-V Virtual Switch, open an elevated PowerShell prompt:

# Query VLAN operating modes across all virtual network adapters
Get-VMNetworkAdapterVlan -VMName * | Select-Object VMName, OperationMode, AccessVlanId, PrimaryVlanId, SecondaryVlanId

By default, newly created virtual machine network adapters operate in Access mode with VlanId: 0 (untagged native traffic).

Configuring an Isolated PVLAN Port via PowerShell

To isolate a tenant virtual machine or untrusted web server (e.g. Web-Public-01) so it can reach only the network gateway without seeing adjacent VMs:

# Configure the adapter in Isolated mode with Primary VLAN 100 and Secondary VLAN 200
Set-VMNetworkAdapterVlan -VMName "Web-Public-01" `
    -Isolated `
    -PrimaryVlanId 100 `
    -SecondaryVlanId 200

# Verify the updated PVLAN configuration
Get-VMNetworkAdapterVlan -VMName "Web-Public-01"

Even if multiple virtual machines are configured with Secondary VLAN 200 in Isolated mode, Hyper-V drops all frames transmitted directly between them.

Configuring Community PVLAN Ports for Tiered Workloads

For virtual machines that must collaborate within a specific functional tier (such as a database clustering group DB-Cluster-01 and DB-Cluster-02) while remaining isolated from other tenant groups on the same subnet:

# Configure community ports sharing Secondary VLAN 210
Set-VMNetworkAdapterVlan -VMName "DB-Cluster-01" -Community -PrimaryVlanId 100 -SecondaryVlanId 210
Set-VMNetworkAdapterVlan -VMName "DB-Cluster-02" -Community -PrimaryVlanId 100 -SecondaryVlanId 210

DB-Cluster-01 and DB-Cluster-02 can exchange network packets freely, but neither can communicate with Web-Public-01.

Configuring the Gateway or Firewall in Promiscuous Mode

For communication to flow outside the local virtual switch to the physical network or internet, the gateway appliance virtual machine (e.g. Edge-Firewall-VM) must be configured in Promiscuous mode:

# Configure the gateway adapter as Promiscuous, specifying all valid secondary VLANs
Set-VMNetworkAdapterVlan -VMName "Edge-Firewall-VM" `
    -Promiscuous `
    -PrimaryVlanId 100 `
    -SecondaryVlanIdList 200, 210

The -SecondaryVlanIdList parameter defines which secondary VLAN channels the promiscuous port accepts traffic from. When the gateway forwards traffic back down to clients, it tags frames with the appropriate secondary VLAN ID.

Testing and Validating PVLAN Traffic Isolation

To verify that Hyper-V’s virtual switch filtering layer is actively enforcing Layer 2 isolation:

1. Log into Web-Public-01 (Isolated mode) and execute a ping test targeting the gateway IP address. Confirm that ICMP replies return successfully.
2. Attempt to ping the adjacent DB-Cluster-01 IP address on the same subnet. Confirm that packets drop and time out completely.
3. Inspect the virtual switch packet counters via PowerShell to confirm that dropped frames are rejected at the virtual port boundary without generating host CPU interrupts.

Resetting Virtual Network Adapters to Standard Access Mode

To decommission PVLAN routing and restore a virtual network adapter back to standard untagged or standard access VLAN mode:

# Reset adapter back to standard untagged access mode
Set-VMNetworkAdapterVlan -VMName "Web-Public-01" -Access -VlanId 0

# Verify restoration of standard operational mode
Get-VMNetworkAdapterVlan -VMName "Web-Public-01"