Vagrant provides a VM in that is run by the provisioner of your choice, for instance, VirtualBox or VMWare. The network configuration of your VM determines whether you can connect to the network outside. Typically, in your example you would use one of two configurations: In a bridged network configuration, the VM has full access to the outside network and can see any machine out there. It also means that your VM is visible as its very own network device from the outside. While this is very convenient, it may be a security issue. And corporate networks may ban you from adding non-approved network devices. In a NAT configuration, traffic is routed through the host machine. In short, this means the VM can see the outside network but the outside network cannot see the VM. You can however expose some of the VM's services using port forwarding. If you want to "bake" your data sets into your Vagrant boxes, this can all be scripted. In order to always get the recent version of the data set, you might want to create a Vagrant box, based on a plain sandbox, that just goes out to the production system and fetches its data as it is spun up the first time. Because the Vagrant box acts as a client using standard APIs, generally speaking I believe you would not have to change your production systems. To give you a precise answers I would need to know your case in more detail, though. ... View more