There may be conflicts between netsh interface portproxy
and the WSL "magic" port forwarders attempting to start listening on the same (TCP) port, according to output of netstat -an | findstr ":PORT_NUMBER"
.
Let's say a Linux service is started. It listens to a TCP port 443. WSL wires the Windows's localhost:443
to the Linux service's port 443. This is visible to netstat
showing a listener on localhost:443
that is not wired as a connection.
PS C:\WINDOWS\system32> netstat -an | findstr ":443"
[...]
TCP 127.0.0.1:443 0.0.0.0:0 LISTENING
Attempting to forward from any other network interface's port 443 to localhost:443
with netsh
does not show an error but is seen in netstat
as an unexpected listener on a different TCP port. I consider this a bug of netsh interface portproxy
.
PS C:\WINDOWS\system32> netsh interface portproxy set v4tov4 listenport=443 listenaddress=0.0.0.0 connectport=443 connectaddress=127.0.0.1
PS C:\WINDOWS\system32> curl.exe -iskS https://10.X.Y.Z/
curl: (7) Failed to connect to 10.X.Y.Z port 443 after 2022 ms: Connection refused
PS C:\WINDOWS\system32> netsh interface portproxy show v4tov4
Listen on ipv4: Connect to ipv4:
Address Port Address Port
--------------- ---------- --------------- ----------
[...]
0.0.0.0 443 127.0.0.1 443
I believe I caught netsh interface portproxy
red-handed after seeing a TCP connection from an unexpectedly random TCP port on the unexpected interface 127.0.0.1
to 127.0.0.1:443
,
PS C:\WINDOWS\system32> netstat -an | findstr ":443"
[...]
TCP 127.0.0.1:443 0.0.0.0:0 LISTENING
TCP 127.0.0.1:63916 127.0.0.1:443 TIME_WAIT
If the above theory of a bug in netsh
is correct, I can understand why my earlier intuitive separation of port numbers worked. That is, the Linux service can be configured to listen to a different port number such as 10443, and then the Windows side can be set up to forward from port 443 to localhost:10443
.
I guess the same conflict might have caused the original post's situation if a netsh interface portproxy
forwarding is set up before starting the Linux service.
Update. It seems my current woes are due to a corprorate-enforced firewall manager on my laptop. My answer above is not credible.