How to Configure Windows Sandbox Port Forwarding and Networking via XML in Windows 11

Windows Sandbox provides a disposable, secure hypervisor-based sandbox environment on Windows 11. By default, Windows Sandbox assigns a dynamic internal virtual network adapter that allows outbound internet connectivity through a virtual NAT switch. However, when developers test web servers, API endpoints, or database containers inside the sandbox, connecting to those services from the host Windows machine or secondary network devices requires configuring explicit networking policies and port forwarding rules.

Understanding Windows Sandbox Networking Modes

The Windows Sandbox XML configuration schema (.wsb) provides granular controls over network adapter behaviour:

• <Networking>Default</Networking>: Enables the virtual NAT adapter, granting full outbound internet and local network access.
• <Networking>Disable</Networking>: Completely severs all virtual network interfaces, running the sandbox in total air-gapped isolation—ideal for executing untrusted malware samples or detonating suspicious binaries safely.
• Host-to-Sandbox Communication: The sandbox receives an internal IP address on the vEthernet (Default Switch) or vEthernet (WSB) subnet. Forwarding incoming host traffic to sandbox services requires coordinating Windows netsh portproxy rules with sandbox startup automation.

Configuring Air-Gapped Network Isolation via XML

For high-security isolation workflows where all inbound and outbound network connectivity must be prohibited:

  Disable
  Disable
  
    
      C:IsolatedSamples
      C:UsersWDAGUtilityAccountDesktopSamples
      true
    
  

Double-clicking this .wsb file boots a sandboxed instance with network cards completely uninitialized.

Enabling Host-to-Sandbox Port Forwarding via Automated Scripts

To access web services running inside the sandbox (e.g., a local web server listening on port 8080) from your host browser:

1. Create a shared folder on your host system:

   New-Item -Path "C:\SandboxNet" -ItemType Directory -Force | Out-Null

2. Create an automated startup script inside the shared directory that discovers the sandbox IP and registers a portproxy rule on the host:

   $serverBootstrap = @'
   # Launch a test Python HTTP server on port 8080 inside Sandbox
   Start-Process python -ArgumentList "-m http.server 8080" -WindowStyle Hidden
   
   # Output assigned sandbox IP to shared folder
   $sandboxIP = (Get-NetIPAddress -AddressFamily IPv4 -InterfaceAlias "vEthernet*").IPAddress | Where-Object { $_ -ne "127.0.0.1" } | Select-Object -First 1
   $sandboxIP | Out-File -FilePath "C:UsersWDAGUtilityAccountDesktopSharedsandbox_ip.txt" -Encoding ascii
   '@
   $serverBootstrap | Out-File -FilePath "C:\SandboxNet\start_server.ps1" -Encoding utf8

3. Author the .wsb configuration file mapping the folder and triggering the logon command:

   $wsbContent = @"
   
     Default
     
       
         C:SandboxNet
         C:UsersWDAGUtilityAccountDesktopShared
         false
       
     
     
       powershell.exe -ExecutionPolicy Bypass -File C:UsersWDAGUtilityAccountDesktopSharedstart_server.ps1
     
   
   "@
   $wsbContent | Out-File -FilePath "$env:USERPROFILE\Desktop\WebSandbox.wsb" -Encoding utf8

Connecting from the Host Windows 11 Machine

Once the sandbox launches and writes its internal IP to the shared folder, bind the host port using PowerShell:

# Read the sandbox internal IP
$sandboxIP = (Get-Content "C:\SandboxNet\sandbox_ip.txt").Trim()

# Configure portproxy on the Windows 11 host
netsh interface portproxy add v4tov4 listenport=8080 listenaddress=127.0.0.1 connectport=8080 connectaddress=$sandboxIP

Write-Output "Forwarded localhost:8080 -> $sandboxIP:8080"

Open your host browser and navigate to http://localhost:8080 to interact directly with the sandboxed web service.

Cleaning Up Port Forwarding Bindings

When the sandbox session terminates, remove the portproxy route on your host system:

netsh interface portproxy delete v4tov4 listenport=8080 listenaddress=127.0.0.1

This automated configuration delivers flexible networking control, allowing developers to alternate between total network isolation and structured host-to-guest debugging.