32

I've been tinkering around with WSL-2 for a while now and don't exactly understand how traffic is routed between the host and WSL-2 dist.

In some sources it seems like all ports used by WSL-2 automatically become available to the host machine. Such as in this tutorial by Microsoft. Similarly I managed to host a Jupyter instance which is available directly on my host machine through localhost:8888.

However, when trying other services, such as ssh (also tried on a non-standard port) the port does not automatically become available through localhost and I have to use the IP address assigned to my WSL distro (the one from wsl hostname -I)

To make the services available through localhost I found this portforwarding script, which worked. But I would like to understand why it was needed.

Why is port forwarding needed for some services, but not all?

4 Answers 4

22

My confusion came from firewall issues with WSL-2.

What I have found is:

  • Services listening on ports in WSL-2 are accesible from the host machine as localhost:<port>
  • WSL-2 ports are not accessible from outside of the host machine
  • WSL-2 ports can be made available through netstat interface portproxy or other portforward tools using the ip address of the WSL instance.

The firewall did not allow acces to the WSL ports by just listing the ports. I had to specifcally select the iphlpsv service (IP Helper service) in my firewall rules to allow traffic through to the WSL instance.

1
  • 1
    Can you elaborate on how you managed to host a Jupyter instance? I'm trying to ssh through wsl.exe to an EC2 instance and I think this elaboration will help.
    – j7skov
    Nov 17, 2021 at 14:17
21

When you run WSL-2, a machine like a vitural machin run on your window device. Windows will create a local network, same your LAN, and connect WLS-2 to this network.

  • On your WSL2, you can run ip a | grep eth0, result look like:

5: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000 inet 172.27.5.124/20 brd 172.27.15.255 scope global eth0

  • And on terminal (or PowerShell) on your windows, run ipconfig, find in the result, look like:
Ethernet adapter vEthernet (WSL):

   Connection-specific DNS Suffix  . :
   Link-local IPv6 Address . . . . . : fe80::1532:a8ea:6b34:8df2%73
   IPv4 Address. . . . . . . . . . . : 172.27.0.1
   Subnet Mask . . . . . . . . . . . : 255.255.240.0
   Default Gateway . . . . . . . . . :

WSL-2 and Windows device on a same network, and WSL-2 not connect to your LAN.

My solution (use port forwarding on Windows)

Open terminal with Admin on Windows, and run script:

netsh interface portproxy set v4tov4 listenport=8888 listenaddress=0.0.0.0 connectport=8888 connectaddress=$(wsl hostname -I)
1
  • Welcome to Stack Overflow. Thanks for your contribution, but for the most part this doesn't add anything that the OP didn't already cover in the question and answer. In particular, your "my solution" to use netsh interface portproxy is mentioned in the existing answer. Also note that the original question didn't ask about LAN access, only localhost access. It was only the OP's self-answer that mentioned LAN access. Aug 21, 2021 at 13:35
5

Following these steps helped me connect to my ports locally on Windows:

  1. use the script in here and change the ports to the ones that you need to forward. Save this file to a path.
  2. In wsl, sudo apt install net-tools
  3. In powershell (administrator mode), type ".\script.ps1" | powershell.exe -c -. This is to run the file. Right-clicking the file to "Run with powershell" won't work.
  4. To test that it works, in powershell, type netsh interface portproxy show v4tov4
0

There may be conflicts between netsh interface portproxy and the WSL "magic" port forwarders attempting to start listening on the same (TCP) port, according to output of netstat -an | findstr ":PORT_NUMBER".

Let's say a Linux service is started. It listens to a TCP port 443. WSL wires the Windows's localhost:443 to the Linux service's port 443. This is visible to netstat showing a listener on localhost:443 that is not wired as a connection.

PS C:\WINDOWS\system32> netstat -an | findstr ":443"
[...]
  TCP    127.0.0.1:443          0.0.0.0:0              LISTENING

Attempting to forward from any other network interface's port 443 to localhost:443 with netsh does not show an error but is seen in netstat as an unexpected listener on a different TCP port. I consider this a bug of netsh interface portproxy.

PS C:\WINDOWS\system32> netsh interface portproxy set v4tov4 listenport=443 listenaddress=0.0.0.0 connectport=443 connectaddress=127.0.0.1

PS C:\WINDOWS\system32> curl.exe -iskS https://10.X.Y.Z/
curl: (7) Failed to connect to 10.X.Y.Z port 443 after 2022 ms: Connection refused


PS C:\WINDOWS\system32> netsh interface portproxy show v4tov4

Listen on ipv4:             Connect to ipv4:

Address         Port        Address         Port
--------------- ----------  --------------- ----------
[...]
0.0.0.0         443         127.0.0.1       443

I believe I caught netsh interface portproxy red-handed after seeing a TCP connection from an unexpectedly random TCP port on the unexpected interface 127.0.0.1 to 127.0.0.1:443,

PS C:\WINDOWS\system32> netstat -an | findstr ":443"
[...]
  TCP    127.0.0.1:443          0.0.0.0:0              LISTENING
  TCP    127.0.0.1:63916        127.0.0.1:443          TIME_WAIT

If the above theory of a bug in netsh is correct, I can understand why my earlier intuitive separation of port numbers worked. That is, the Linux service can be configured to listen to a different port number such as 10443, and then the Windows side can be set up to forward from port 443 to localhost:10443.

I guess the same conflict might have caused the original post's situation if a netsh interface portproxy forwarding is set up before starting the Linux service.

Update. It seems my current woes are due to a corprorate-enforced firewall manager on my laptop. My answer above is not credible.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.