GlobalProtect blocks the network traffic of WSL2

[gbagita]

Hello all,

I use WSL2 with an Ubuntu image. It works fine but when I establish a VPN connection by GlobalProtect, it cut the connection from the WSL image to the outside. We have no split tunneling and the connection to the devices behind the tunnel works fine from the Windows environment but not from WSL. And I'm unable to access the internet from WSL as well. Can somebody help me with this issue?

[gbagita · Accepted solution]

I found the solution which solves the problem. You have to change the metric of the interfaces. Here is a PS script for it:

Get-NetIPInterface -InterfaceAlias "vEthernet (WSL)" | Set-NetIPInterface -InterfaceMetric 1
Get-NetAdapter | Where-Object {$_.InterfaceDescription -Match "PANGP Virtual Ethernet Adapter #2"} | Set-NetIPInterface -InterfaceMetric 6000

You have to run it as an administrator.

[gbagita · Accepted solution]

I found the solution which solves the problem. You have to change the metric of the interfaces. Here is a PS script for it:

Get-NetIPInterface -InterfaceAlias "vEthernet (WSL)" | Set-NetIPInterface -InterfaceMetric 1
Get-NetAdapter | Where-Object {$_.InterfaceDescription -Match "PANGP Virtual Ethernet Adapter #2"} | Set-NetIPInterface -InterfaceMetric 6000

You have to run it as an administrator.

[csmith]

This works, but I found that once I run this, WSL can connect to the internet, but Windows can no longer connect to machines on the network over RDP over SSH. It seems to have solved one problem and created another. Any idea why that might happen?

Thanks!

[gbagita]

The problem is, the WSL2 Linux devices are not running in an emulated environment in Windows, but they are standalone virtual machines and have they own virtual ethernet adapters.It's like you are running two virtual machines in Hyper-V or WMware. One of its is your Windows and the other is the Linux machine you're running in WSL2. Here is described a difference between WSL and WSL2 Comparing WSL 2 and WSL 1 | Microsoft Docs. It also means, when you need to access a devices from the WSL machine at the same remote location as you accessing them from the Win machine, you need to build an other Global Protect VPN tunnel from the WSL machine as well. It works fine for me.

I use GP VPN at home to connect to my office or to customers and I have no other devices at home I need to connect. But I think, you should run a similar script after you disconnect the GP VPN, which returns back the routing settings to the default status.