search

microsoft / WSL

Issues found on WSL
https://docs.microsoft.com/windows/wsl
MIT License
17.46k stars 822 forks source link

Access running WSL services from LAN devices without having to create Firewall rules with `networkingMode=mirrored` #10769

Open tusharsnx opened 12 months ago

tusharsnx commented 12 months ago

Is your feature request related to a problem? Please describe.

This video demo of the new networkingMode = mirrored (at around 8:19 minutes) seems to suggest that services running inside WSL can be accessed from other devices on the same LAN without needing any extra setup. But in my experience LAN devices cannot access WSL services until you explicitly allow that port in the firewall rule.

I tried toggling the new experimental.firewall/wsl2.firewall, but it doesn't seem to make any difference.

Describe the solution you'd like

I think one of these solution should work:

  1. Let the user disable Firewall for WSL. (I expected experimental.firewall = false to do this)
  2. If firewall rules cannot be turned off completely for WSL, auto manage firewall rules for each service running within WSL, and prompt the user for consent if necessary.

Additional Details:

WSL version: 2.0.9.0
Kernel version: 5.15.133.1-1
WSLg version: 1.0.59
MSRDC version: 1.2.4677
Direct3D version: 1.611.1-81528511
DXCore version: 10.0.25131.1002-220531-1700.rs-onecore-base2-hyp
Windows version: 10.0.22631.2506
$ wslinfo --networking-mode
mirrored
github-actions[bot] commented 12 months ago

Hi I'm an AI powered bot that finds similar issues based off the issue title.

Please view the issues below to see if they solve your problem, and if the issue describes your problem please consider closing this one and thumbs upping the other issue to help us prioritize it. Thank you!

Open similar issues:

Closed similar issues:

You can give me feedback by thumbs upping or thumbs downing this comment.

tusharsnx commented 12 months ago

https://github.com/microsoft/WSL/issues/10714 The issue is closely related, but I'm sure the issuer was confused about whether creating a firewall rule is necessary or not. So I created this issue as a feature request rather than a bug.

tusharsnx commented 12 months ago

Turns out that this article describes how you can disable WSL VM's Hyper-V Firewall in two steps:

[!Warning] Disabling Firewall can have unintended consequences. Any malicious app running within wsl gets unrestricted access to internet.

  1. Get WSL VM Id:
$ Get-NetFirewallHyperVVMCreator

VMCreatorId  : {40E0AC32-46A5-438A-A0B2-2B479E8F2E90}
FriendlyName : WSL
  1. Disable Firewall (from an elevated/admin Terminal):
$ Set-NetFirewallHyperVVMSetting -Name '{40E0AC32-46A5-438A-A0B2-2B479E8F2E90}' -Enabled False

At this point, you should be able to access wsl services from other devices on LAN (or from the internet who knows 🙃).

tusharsnx commented 12 months ago

A safer alternative is to Only allow connection to wsl in a Trusted (Private) network: 

New-NetFirewallHyperVRule `
-DisplayName 'Allow All Inbound Traffic to WSL in Private Network' `
-Name 'WSL Rule' `
-Profiles Private `
-Direction Inbound `
-Action Allow `
-VMCreatorId '{40E0AC32-46A5-438A-A0B2-2B479E8F2E90}' `
-Enabled True

This would block connection to wsl in a public (or untrusted) network, which is good.

In case you want to delete the rule, run:

Remove-NetFirewallHyperVRule -Name 'WSL Rule'
illgitthat commented 11 months ago

I experienced the same issue (saw the demo video, tried a bunch of things but couldn't get it to work). This firewall rule accomplished just what I was looking for. Thank you @tusharsnx !

I agree that this needs to be incorporated by default or at least mentioned in the documentation.