GlobalProtect blocks the network traffic of WSL2

[gbagita]

Hello all,

I use WSL2 with an Ubuntu image. It works fine but when I establish a VPN connection by GlobalProtect, it cut the connection from the WSL image to the outside. We have no split tunneling and the connection to the devices behind the tunnel works fine from the Windows environment but not from WSL. And I'm unable to access the internet from WSL as well. Can somebody help me with this issue?

[gbagita · Accepted solution]

I found the solution which solves the problem. You have to change the metric of the interfaces. Here is a PS script for it:

Get-NetIPInterface -InterfaceAlias "vEthernet (WSL)" | Set-NetIPInterface -InterfaceMetric 1
Get-NetAdapter | Where-Object {$_.InterfaceDescription -Match "PANGP Virtual Ethernet Adapter #2"} | Set-NetIPInterface -InterfaceMetric 6000

You have to run it as an administrator.

[csmith]

This works, but I found that once I run this, WSL can connect to the internet, but Windows can no longer connect to machines on the network over RDP over SSH. It seems to have solved one problem and created another. Any idea why that might happen?

Thanks!

[gbagita]

The problem is, the WSL2 Linux devices are not running in an emulated environment in Windows, but they are standalone virtual machines and have they own virtual ethernet adapters.It's like you are running two virtual machines in Hyper-V or WMware. One of its is your Windows and the other is the Linux machine you're running in WSL2. Here is described a difference between WSL and WSL2 Comparing WSL 2 and WSL 1 | Microsoft Docs. It also means, when you need to access a devices from the WSL machine at the same remote location as you accessing them from the Win machine, you need to build an other Global Protect VPN tunnel from the WSL machine as well. It works fine for me.

I use GP VPN at home to connect to my office or to customers and I have no other devices at home I need to connect. But I think, you should run a similar script after you disconnect the GP VPN, which returns back the routing settings to the default status.

[paulo_graca]

I had the same issue, the solution presented here didn't solve it entirely because I had to disconnect the VPN connection to have network connection outside the Windows Subsystem. After several attempts my solution was to downgrade WSL to version 1 and it was is as easy as running this command on my Windows Powershell:

wsl --set-version Ubuntu 1

This solved my VPN connection at Windows Subsystem. Note: I'm using Ubuntu.

[JohnnyBigodes]

Going to WSL1 is not a solution for me, because I want to use Docker and that only works on WSL2.

Changing the metrics is also a pain, because at our company we dont have admin rights to do so.

AnyConnect seems to have done this on a recent update, so why cant GlobalProtect do the same?

[csmith]

It's actually from windows that I can't connect to machines over RDP anymore, not from WSL. I didn't even try that. I've seen others say the same but I can't remember where I saw it unfortunately.

[csmith]

Docker works just fine on WSL1.  Still, I'd prefer to use 2 if we could get a real solution for this. It would have to come from Palo and be part of GP.  Modifying network adaptors in a scheduled task is not a solution, it's a hack that creates other problems. Lots of people have this issue if you search on Google and other VPN providers seem to have provided software solutions.  Not palo, though.

[csmith]

Microsoft seems to be moving away from WSL1. It's no longer the default. Eventually, this will not be a viable solution.

[JohnnyBigodes]

Since when does Docker work in WSL1?

I am pretty sure I tried it some months ago and it wouldnt work.