Networking Deep Dive

Master port forwarding, DNS, VPN compatibility, and the mirrored networking mode in WSL 2.

WSL 2 Networking Modes

WSL 2 supports two networking modes. The mode you choose affects how your distro communicates with the host, your LAN, and the internet.

NAT Mode (Default)

  • WSL gets its own virtual network adapter with a private IP
  • Host acts as a NAT gateway for outbound traffic
  • Localhost forwarding bridges ports between WSL and Windows
  • Works out of the box for most scenarios

Mirrored Mode (New)

  • WSL shares the Windows host network interfaces
  • Same IP address as the host — no NAT layer
  • Better VPN and corporate network compatibility
  • IPv6 support and multicast work correctly
.wslconfig
# Enable mirrored networking mode
[wsl2]
networkingMode=mirrored
dnsTunneling=true
autoProxy=true

Port Forwarding

In NAT mode, localhost forwarding is enabled by default — services running in WSL on port 3000 are accessible at localhost:3000 from Windows. For access from other machines on your LAN, forward ports explicitly.

Expose a WSL Service to Your LAN

PowerShell (Admin)
# Find your WSL IP address
PS>wsl hostname -I
172.25.160.1
# Forward port 3000 from Windows to WSL
PS>netsh interface portproxy add v4tov4 listenport=3000 listenaddress=0.0.0.0 connectport=3000 connectaddress=172.25.160.1
# Allow traffic through Windows Firewall
PS>New-NetFirewallRule -DisplayName "WSL Port 3000" -Direction Inbound -LocalPort 3000 -Protocol TCP -Action Allow

List and Remove Port Proxies

PowerShell (Admin)
# Show all active port proxies
PS>netsh interface portproxy show all
# Remove a specific forwarding rule
PS>netsh interface portproxy delete v4tov4 listenport=3000 listenaddress=0.0.0.0

Mirrored mode tip: With networkingMode=mirrored, port forwarding is unnecessary — WSL services bind directly to the host network interfaces.

DNS Configuration

By default, WSL auto-generates /etc/resolv.conf on every start. You can customize DNS behaviour in two ways.

Option 1: Custom DNS via wsl.conf

/etc/wsl.conf
# Prevent WSL from overwriting resolv.conf
[network]
generateResolvConf = false
Ubuntu (WSL)
# Remove the auto-generated symlink and create your own
user@wsl:~$ sudo rm /etc/resolv.conf
user@wsl:~$ echo -e "nameserver 1.1.1.1\nnameserver 8.8.8.8" | sudo tee /etc/resolv.conf
user@wsl:~$ sudo chattr +i /etc/resolv.conf

Option 2: DNS Tunneling (Recommended)

DNS tunneling routes DNS queries through the Windows host, which works well with corporate proxies and VPNs.

.wslconfig
[wsl2]
dnsTunneling=true

VPN Compatibility

VPNs can break WSL networking because they modify routing tables and DNS settings on the Windows host. Here are proven strategies to keep connectivity working.

Strategy 1: Use Mirrored Networking

Mirrored mode lets WSL share the VPN tunnel directly. Enable networkingMode=mirrored and dnsTunneling=true in your .wslconfig. This is the recommended approach for corporate VPNs.

Strategy 2: Fix Interface Metrics

If the VPN client raises its interface metric above the WSL virtual switch, traffic gets misrouted. Lower the VPN adapter metric in PowerShell:

PowerShell (Admin)
PS>Get-NetAdapter | Where-Object {$_.InterfaceDescription -like "*VPN*"} | Set-NetIPInterface -InterfaceMetric 6000

Strategy 3: Route DNS Through the VPN

Enable dnsTunneling=trueso all DNS queries go through the Windows resolver, which already uses the VPN's DNS servers. Combine with autoProxy=true to inherit proxy settings automatically.

Mirrored Networking Mode

Mirrored mode was introduced to solve the most common networking pain points in WSL 2. Here is a complete configuration with all related settings.

%USERPROFILE%\.wslconfig
[wsl2]
networkingMode=mirrored
dnsTunneling=true
autoProxy=true
firewall=true
# Exclude specific ports from mirroring if needed
[experimental]
ignoredPorts=8080,9090
hostAddressLoopback=true

Note: Mirrored mode requires Windows 11 22H2 or later. After changing the networking mode, restart WSL with wsl --shutdown for the change to take effect.

Quick Troubleshooting

No internet in WSL

Check DNS: cat /etc/resolv.conf. If the nameserver points to an unreachable IP, enable dnsTunneling=true or switch to mirrored mode.

Port not accessible from Windows

Make sure your service binds to 0.0.0.0 instead of 127.0.0.1. If using NAT mode, verify localhost forwarding is not disabled in .wslconfig.

WSL IP changes on restart

In NAT mode the WSL virtual network gets a dynamic IP. Use mirrored mode for a stable IP, or script the port proxy update with wsl hostname -I at startup.

Next Steps

Security Hardening

Lock down your WSL network with firewall rules and SSH hardening.

Configuration

Tune .wslconfig for memory, networking, and disk performance.

GPU & AI

Expose Jupyter and model endpoints using the networking tips from this guide.

Troubleshooting

More solutions for common WSL issues beyond networking.