topic Re: GlobalProtect blocks the network traffic of WSL2 in GlobalProtect Discussions

GlobalProtect blocks the network traffic of WSL2

gbagita — Wed, 07 Oct 2020 20:00:29 GMT

Hello all,

I use WSL2 with an Ubuntu image. It works fine but when I establish a VPN connection by GlobalProtect, it cut the connection from the WSL image to the outside. We have no split tunneling and the connection to the devices behind the tunnel works fine from the Windows environment but not from WSL. And I'm unable to access the internet from WSL as well. Can somebody help me with this issue?

Re: GlobalProtect blocks the network traffic of WSL2

gbagita — Mon, 02 Nov 2020 10:29:37 GMT

I found the solution which solves the problem. You have to change the metric of the interfaces. Here is a PS script for it:

Get-NetIPInterface -InterfaceAlias "vEthernet (WSL)" | Set-NetIPInterface -InterfaceMetric 1 Get-NetAdapter | Where-Object {$_.InterfaceDescription -Match "PANGP Virtual Ethernet Adapter #2"} | Set-NetIPInterface -InterfaceMetric 6000

You have to run it as an administrator.

Re: GlobalProtect blocks the network traffic of WSL2

csmith — Mon, 18 Jan 2021 20:47:22 GMT

This works, but I found that once I run this, WSL can connect to the internet, but Windows can no longer connect to machines on the network over RDP over SSH. It seems to have solved one problem and created another. Any idea why that might happen?

Thanks!

Re: GlobalProtect blocks the network traffic of WSL2

gbagita — Sat, 06 Feb 2021 09:48:59 GMT

The problem is, the WSL2 Linux devices are not running in an emulated environment in Windows, but they are standalone virtual machines and have they own virtual ethernet adapters.It's like you are running two virtual machines in Hyper-V or WMware. One of its is your Windows and the other is the Linux machine you're running in WSL2. Here is described a difference between WSL and WSL2 Comparing WSL 2 and WSL 1 | Microsoft Docs. It also means, when you need to access a devices from the WSL machine at the same remote location as you accessing them from the Win machine, you need to build an other Global Protect VPN tunnel from the WSL machine as well. It works fine for me.

I use GP VPN at home to connect to my office or to customers and I have no other devices at home I need to connect. But I think, you should run a similar script after you disconnect the GP VPN, which returns back the routing settings to the default status.

Re: GlobalProtect blocks the network traffic of WSL2

paulo_graca — Thu, 08 Jul 2021 09:38:50 GMT

I had the same issue, the solution presented here didn't solve it entirely because I had to disconnect the VPN connection to have network connection outside the Windows Subsystem. After several attempts my solution was to downgrade WSL to version 1 and it was is as easy as running this command on my Windows Powershell:

wsl --set-version Ubuntu 1

This solved my VPN connection at Windows Subsystem. Note: I'm using Ubuntu.

Re: GlobalProtect blocks the network traffic of WSL2

JohnnyBigodes — Wed, 28 Jul 2021 07:07:28 GMT

Going to WSL1 is not a solution for me, because I want to use Docker and that only works on WSL2.

Changing the metrics is also a pain, because at our company we dont have admin rights to do so.

AnyConnect seems to have done this on a recent update, so why cant GlobalProtect do the same?

Re: GlobalProtect blocks the network traffic of WSL2

csmith — Wed, 28 Jul 2021 12:07:54 GMT

It's actually from windows that I can't connect to machines over RDP anymore, not from WSL. I didn't even try that. I've seen others say the same but I can't remember where I saw it unfortunately.

Re: GlobalProtect blocks the network traffic of WSL2

csmith — Wed, 28 Jul 2021 12:12:20 GMT

Docker works just fine on WSL1. Still, I'd prefer to use 2 if we could get a real solution for this. It would have to come from Palo and be part of GP. Modifying network adaptors in a scheduled task is not a solution, it's a hack that creates other problems. Lots of people have this issue if you search on Google and other VPN providers seem to have provided software solutions. Not palo, though.

Re: GlobalProtect blocks the network traffic of WSL2

csmith — Wed, 28 Jul 2021 12:16:39 GMT

Microsoft seems to be moving away from WSL1. It's no longer the default. Eventually, this will not be a viable solution.

Re: GlobalProtect blocks the network traffic of WSL2

JohnnyBigodes — Wed, 28 Jul 2021 14:02:05 GMT

Since when does Docker work in WSL1?

I am pretty sure I tried it some months ago and it wouldnt work.

Re: GlobalProtect blocks the network traffic of WSL2

csmith — Wed, 28 Jul 2021 14:05:19 GMT

I use it every day. Definitely works. This link was purple in my search history so maybe it's the one I used?

https://nickjanetakis.com/blog/setting-up-docker-for-windows-and-wsl-to-work-flawlessly

Re: GlobalProtect blocks the network traffic of WSL2

JohnnyBigodes — Wed, 28 Jul 2021 14:09:00 GMT

Will take a look at that.

Seems that Docker has to be installed under WSL1 aswell, while WSL2 uses Docker that is installed on Windows.

But nice to know... I will still miss the speed of WSL2 if I have to go to WSL1.

Re: GlobalProtect blocks the network traffic of WSL2

adabar — Thu, 05 Aug 2021 23:57:17 GMT

Some replies here have unintended side effects that lead us down a different path:

GP adds "on-link" host routes for itself on the "main" ethernet interface when it connects.
Our workaround was a PS script to add a similar host route (via the WSL adapter virtual ethernet).

e.g. during our test when
- the WSL host had an IP of 172.25.175.245
- netstat showed interface #20 "Hyper-V Virtual Ethernet Adapter #2" held our WSL network
- GlobalProtect's tunnel host route had a metric of 256 (though I imagine any value greater than 1 will do)

we got it working by adding
- route add 172.25.175.245 mask 255.255.255.255 172.25.175.245 metric 256 if 20

Without the route, WSL seems to be treated as coming from a local LAN (which is not allowed by configuration) rather than the local host.

Adding the route "fixes" that.

Ideally I should be able to direct GP to treat more than 1 interface as local on a multi-homed host.
Lacking that, we schedule scripts on interface up/down events.

Re: GlobalProtect blocks the network traffic of WSL2

rhehlp — Wed, 09 Feb 2022 12:16:02 GMT

Hello,

Could you please provide more details? Does it solve the following issue?

- Hyper-V is enabled

- GlobalProtect VPN is enabled

- WSL2 is started

- network connectivity to the internet from within WSL2 is working (wsl2-vpnkit is used)

Issue 1

- services running in WSL2 (web server for instance) are not reachable from the hosts browser

- Solution:
Get-NetIPInterface -InterfaceAlias "vEthernet (WSL)" | Set-NetIPInterface -InterfaceMetric 1
Get-NetAdapter | Where-Object {$_.InterfaceDescription -like "PANGP*"} | Set-NetIPInterface -InterfaceMetric 6000

Issue 2

- issue 1 is solved but

- now e.g. using the host browser (Windows 10) to reach any website (internal and public) leads either to a timeout or is very very slow.

This is probably because GP routing now that traffic through the Hyper-V Virtual Ethernet Adapter #2.

In Cisco AnyConnect is the following option available: https://www.cisco.com/c/en/us/td/docs/security/vpn_client/anyconnect/anyconnect410/administration/guide/b-anyconnect-admin-guide-4-10/troubleshoot-anyconnect.html#Cisco_Task_in_List_GUI.dita_3a9a8101-f034-4e9b-b24a-486ee47b5e9f

That probably would solve that issue.

UPDATE:

Example: route add 172.17.169.14 mask 255.255.255.255 172.17.169.14 metric 256 if 47 (in Windows)

worked indeed and solved the issue. I implemented a CMD/Powershell combination which is executed on logon and whenever the network changes (VPN on/off) which sets a static IP for the WSL2 distribution. If multiple distributions, it sets a static IP for each individual distribution.

Finally, it executes route add for these IPs.

Furthermore, the solution for issue 1 is obsolete then, so far.

Re: GlobalProtect blocks the network traffic of WSL2

rkusumoto — Wed, 06 Apr 2022 15:38:09 GMT

still not working for me:

PS C:\WINDOWS\system32> wsl -d Ubuntu-20.04

The attempted operation is not supported for the type of object referenced.

PS C:\WINDOWS\system32> wsl -l -v

NAME STATE VERSION

* Ubuntu-18.04 Running 1

Ubuntu-20.04 Stopped 2

Re: GlobalProtect blocks the network traffic of WSL2

VincentCollier — Mon, 04 Jul 2022 04:50:19 GMT

This solution works for me and I took the time to script it for the rest of my team.

This should work for almost every one without much modification (save it as a powershell script .ps1):

$var=C:\Windows\System32\wsl.exe -e /bin/bash --noprofile --norc -c "/sbin/ip -o -4 addr list eth0"
$wsl_addr = $var.split()[6].split('/')[0]

$var2 = C:\Windows\System32\wsl.exe -e /bin/bash --noprofile --norc -c "/sbin/ip -o route show table main default"
$wsl_gw = $var2.split()[2]

$ifindex = Get-NetRoute -DestinationPrefix $wsl_gw/32 | Select-Object -ExpandProperty "IfIndex"
$routemetric = Get-NetRoute -DestinationPrefix $wsl_gw/32 | Select-Object -ExpandProperty "RouteMetric"

route add $wsl_addr mask 255.255.255.255 $wsl_addr metric $routemetric if $ifindex

As this need to be run as administrator, You should schedule it using an event based scheduled task, which run the powershell script every time a wsl is booted.

To do this, you need to schedule on this event:

Log: System

Source: Hyper-V-VmSwitch

Event Id : 102

Re: GlobalProtect blocks the network traffic of WSL2

ETatPSU — Wed, 17 Aug 2022 15:47:23 GMT

I had a user experiencing the same trouble while connected to our enterprise Globalprotect VPN. After some testing and looking at different solutions I found https://github.com/sakai135/wsl-vpnkit and used it to resolve the issue with using WSL while connected to the VPN. Just wanted to share to help anyone else that may run into this problem as this add on was much easier than the other provided solution in this thread in my opinion.

Re: GlobalProtect blocks the network traffic of WSL2

Sec101 — Sat, 10 Dec 2022 03:33:00 GMT

so what is the actual long term solution on this one then?

Re: GlobalProtect blocks the network traffic of WSL2

csmith — Mon, 12 Dec 2022 14:43:39 GMT

I couldn't get it to work consistently so I switched to Ubuntu, though, TBH, Palo's Linux client is pretty atrocious. networkmanager-openconnect was much better for a while but a recent Palo upgrade broke it. Duck tape and superglue seems to be getting me by.

Re: GlobalProtect blocks the network traffic of WSL2

Sec101 — Thu, 22 Dec 2022 17:42:11 GMT

as it stands now, I don't think support has a long term solution either.