Its about 1000% better running it on a VM, behind a firewalled isolated network connection.
Because even when they are on a VM/Physical machine a simple traceroute will show the “hops” taken to get to the internet. Thus showing that it goes through two networks.
Always use a VM + VPN. Its too easy to run EternalBlue etc.
Your normal unprotected LAN: 192.168.50.0 /24
Your VM lan: 10.0.0.0 /24
The hops shown via traceroute:
Tracing route to 10.1.1.1 over a maximum of 30 hops
1 <1 ms <1 ms <1 ms 10.0.0.254 [VM ROUTER]
2 <1 ms <1 ms <1 ms 192.168.1.1 [INTERNET/LAN Router]
3 <1 ms <1 ms <1 ms 8.8.8.8