GlobalProtect blocks the network traffic of WSL2

[gbagita]

Hello all,

I use WSL2 with an Ubuntu image. It works fine but when I establish a VPN connection by GlobalProtect, it cut the connection from the WSL image to the outside. We have no split tunneling and the connection to the devices behind the tunnel works fine from the Windows environment but not from WSL. And I'm unable to access the internet from WSL as well. Can somebody help me with this issue?

[gbagita · Accepted solution]

I found the solution which solves the problem. You have to change the metric of the interfaces. Here is a PS script for it:

Get-NetIPInterface -InterfaceAlias "vEthernet (WSL)" | Set-NetIPInterface -InterfaceMetric 1
Get-NetAdapter | Where-Object {$_.InterfaceDescription -Match "PANGP Virtual Ethernet Adapter #2"} | Set-NetIPInterface -InterfaceMetric 6000

You have to run it as an administrator.

[csmith]

This works, but I found that once I run this, WSL can connect to the internet, but Windows can no longer connect to machines on the network over RDP over SSH. It seems to have solved one problem and created another. Any idea why that might happen?

Thanks!

[gbagita]

The problem is, the WSL2 Linux devices are not running in an emulated environment in Windows, but they are standalone virtual machines and have they own virtual ethernet adapters.It's like you are running two virtual machines in Hyper-V or WMware. One of its is your Windows and the other is the Linux machine you're running in WSL2. Here is described a difference between WSL and WSL2 Comparing WSL 2 and WSL 1 | Microsoft Docs. It also means, when you need to access a devices from the WSL machine at the same remote location as you accessing them from the Win machine, you need to build an other Global Protect VPN tunnel from the WSL machine as well. It works fine for me.

I use GP VPN at home to connect to my office or to customers and I have no other devices at home I need to connect. But I think, you should run a similar script after you disconnect the GP VPN, which returns back the routing settings to the default status.

[paulo_graca]

I had the same issue, the solution presented here didn't solve it entirely because I had to disconnect the VPN connection to have network connection outside the Windows Subsystem. After several attempts my solution was to downgrade WSL to version 1 and it was is as easy as running this command on my Windows Powershell:

wsl --set-version Ubuntu 1

This solved my VPN connection at Windows Subsystem. Note: I'm using Ubuntu.

[JohnnyBigodes]

Going to WSL1 is not a solution for me, because I want to use Docker and that only works on WSL2.

Changing the metrics is also a pain, because at our company we dont have admin rights to do so.

AnyConnect seems to have done this on a recent update, so why cant GlobalProtect do the same?

[csmith]

It's actually from windows that I can't connect to machines over RDP anymore, not from WSL. I didn't even try that. I've seen others say the same but I can't remember where I saw it unfortunately.

[csmith]

Docker works just fine on WSL1.  Still, I'd prefer to use 2 if we could get a real solution for this. It would have to come from Palo and be part of GP.  Modifying network adaptors in a scheduled task is not a solution, it's a hack that creates other problems. Lots of people have this issue if you search on Google and other VPN providers seem to have provided software solutions.  Not palo, though.

[csmith]

Microsoft seems to be moving away from WSL1. It's no longer the default. Eventually, this will not be a viable solution.

[JohnnyBigodes]

Since when does Docker work in WSL1?

I am pretty sure I tried it some months ago and it wouldnt work.

[csmith]

I use it every day. Definitely works. This link was purple in my search history so maybe it's the one I used?

https://nickjanetakis.com/blog/setting-up-docker-for-windows-and-wsl-to-work-flawlessly

[JohnnyBigodes]

Will take a look at that.

Seems that Docker has to be installed under WSL1 aswell, while WSL2 uses Docker that is installed on Windows.

But nice to know... I will still miss the speed of WSL2 if I have to go to WSL1.

[adabar]

Some replies here have unintended side effects that lead us down a different path:

GP adds "on-link" host routes for itself on the "main" ethernet interface when it connects.
Our workaround was a PS script to add a similar host route (via the WSL adapter virtual ethernet).

e.g. during our test when
- the WSL host had an IP of 172.25.175.245
- netstat showed interface #20  "Hyper-V Virtual Ethernet Adapter #2"  held our WSL network
- GlobalProtect's tunnel host route had a metric of 256 (though I imagine any value greater than 1 will do)

we got it working by adding
- route add 172.25.175.245 mask 255.255.255.255 172.25.175.245 metric 256 if 20

Without the route, WSL seems to be treated as coming from a local LAN (which is not allowed by configuration) rather than the local host.

Adding the route "fixes" that.

Ideally I should be able to direct GP to treat more than 1 interface as local on a multi-homed host.
Lacking that, we schedule scripts on interface up/down events.

[rhehlp]

Hello,

Could you please provide more details? Does it solve the following issue?

- Hyper-V is enabled

- GlobalProtect VPN is enabled

- WSL2 is started

- network connectivity to the internet from within WSL2 is working (wsl2-vpnkit is used)

Issue 1

- services running in WSL2 (web server for instance) are not reachable from the hosts browser

- Solution:
Get-NetIPInterface -InterfaceAlias "vEthernet (WSL)" | Set-NetIPInterface -InterfaceMetric 1
Get-NetAdapter | Where-Object {$_.InterfaceDescription -like "PANGP*"} | Set-NetIPInterface -InterfaceMetric 6000

Issue 2

- issue 1 is solved but

- now e.g. using the host browser (Windows 10) to reach any website (internal and public) leads either to a timeout or is very very slow.

This is probably because GP routing now that traffic through the Hyper-V Virtual Ethernet Adapter #2.

In Cisco AnyConnect is the following option available: https://www.cisco.com/c/en/us/td/docs/security/vpn_client/anyconnect/anyconnect410/administration/gu...

That probably would solve that issue.

UPDATE:

Example: route add 172.17.169.14 mask 255.255.255.255 172.17.169.14 metric 256 if 47 (in Windows)

worked indeed and solved the issue. I implemented a CMD/Powershell combination which is executed on logon and whenever the network changes (VPN on/off) which sets a static IP for the WSL2 distribution. If multiple distributions, it sets a static IP for each individual distribution.

Finally, it executes route add for these IPs.

Furthermore, the solution for issue 1 is obsolete then, so far.

[rkusumoto]

still not working for me:

PS C:\WINDOWS\system32> wsl -d Ubuntu-20.04

The attempted operation is not supported for the type of object referenced.

PS C:\WINDOWS\system32> wsl -l -v

NAME STATE VERSION

* Ubuntu-18.04 Running 1

  Ubuntu-20.04 Stopped 2