GlobalProtect blocks the network traffic of WSL2

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

GlobalProtect blocks the network traffic of WSL2

L1 Bithead

Hello all,

I use WSL2 with an Ubuntu image. It works fine but when I establish a VPN connection by GlobalProtect, it cut the connection from the WSL image to the outside. We have no split tunneling and the connection to the devices behind the tunnel works fine from the Windows environment but not from WSL. And I'm unable to access the internet from WSL as well. Can somebody help me with this issue?

1 accepted solution

Accepted Solutions

L1 Bithead

I found the solution which solves the problem. You have to change the metric of the interfaces. Here is a PS script for it:

Get-NetIPInterface -InterfaceAlias "vEthernet (WSL)" | Set-NetIPInterface -InterfaceMetric 1
Get-NetAdapter | Where-Object {$_.InterfaceDescription -Match "PANGP Virtual Ethernet Adapter #2"} | Set-NetIPInterface -InterfaceMetric 6000

You have to run it as an administrator.

View solution in original post

21 REPLIES 21

L1 Bithead

I found the solution which solves the problem. You have to change the metric of the interfaces. Here is a PS script for it:

Get-NetIPInterface -InterfaceAlias "vEthernet (WSL)" | Set-NetIPInterface -InterfaceMetric 1
Get-NetAdapter | Where-Object {$_.InterfaceDescription -Match "PANGP Virtual Ethernet Adapter #2"} | Set-NetIPInterface -InterfaceMetric 6000

You have to run it as an administrator.

This works, but I found that once I run this, WSL can connect to the internet, but Windows can no longer connect to machines on the network over RDP over SSH. It seems to have solved one problem and created another. Any idea why that might happen?

Thanks!

The problem is, the WSL2 Linux devices are not running in an emulated environment in Windows, but they are standalone virtual machines and have they own virtual ethernet adapters.It's like you are running two virtual machines in Hyper-V or WMware. One of its is your Windows and the other is the Linux machine you're running in WSL2. Here is described a difference between WSL and WSL2 Comparing WSL 2 and WSL 1 | Microsoft Docs. It also means, when you need to access a devices from the WSL machine at the same remote location as you accessing them from the Win machine, you need to build an other Global Protect VPN tunnel from the WSL machine as well. It works fine for me.

I use GP VPN at home to connect to my office or to customers and I have no other devices at home I need to connect. But I think, you should run a similar script after you disconnect the GP VPN, which returns back the routing settings to the default status.

L0 Member

I had the same issue, the solution presented here didn't solve it entirely because I had to disconnect the VPN connection to have network connection outside the Windows Subsystem. After several attempts my solution was to downgrade WSL to version 1 and it was is as easy as running this command on my Windows Powershell:

 

wsl --set-version Ubuntu 1

 

This solved my VPN connection at Windows Subsystem. Note: I'm using Ubuntu.

Going to WSL1 is not a solution for me, because I want to use Docker and that only works on WSL2.

 

Changing the metrics is also a pain, because at our company we dont have admin rights to do so.

 

AnyConnect seems to have done this on a recent update, so why cant GlobalProtect do the same?

L1 Bithead

It's actually from windows that I can't connect to machines over RDP anymore, not from WSL. I didn't even try that. I've seen others say the same but I can't remember where I saw it unfortunately.

Docker works just fine on WSL1.  Still, I'd prefer to use 2 if we could get a real solution for this. It would have to come from Palo and be part of GP.  Modifying network adaptors in a scheduled task is not a solution, it's a hack that creates other problems. Lots of people have this issue if you search on Google and other VPN providers seem to have provided software solutions.  Not palo, though.

Microsoft seems to be moving away from WSL1. It's no longer the default. Eventually, this will not be a viable solution.

Since when does Docker work in WSL1?

I am pretty sure I tried it some months ago and it wouldnt work.

I use it every day. Definitely works. This link was purple in my search history so maybe it's the one I used?

https://nickjanetakis.com/blog/setting-up-docker-for-windows-and-wsl-to-work-flawlessly

Will take a look at that.

 

Seems that Docker has to be installed under WSL1 aswell, while WSL2 uses Docker that is installed on Windows.

 

But nice to know... I will still miss the speed of WSL2 if I have to go to WSL1.

L0 Member

Some replies here have unintended side effects that lead us down a different path:

 

GP adds "on-link" host routes for itself on the "main" ethernet interface when it connects.
Our workaround was a PS script to add a similar host route (via the WSL adapter virtual ethernet).

 

e.g. during our test when
- the WSL host had an IP of 172.25.175.245
- netstat showed interface #20  "Hyper-V Virtual Ethernet Adapter #2"  held our WSL network
- GlobalProtect's tunnel host route had a metric of 256 (though I imagine any value greater than 1 will do)

 

we got it working by adding
- route add 172.25.175.245 mask 255.255.255.255 172.25.175.245 metric 256 if 20

 

Without the route, WSL seems to be treated as coming from a local LAN (which is not allowed by configuration) rather than the local host.

Adding the route "fixes" that.

 

Ideally I should be able to direct GP to treat more than 1 interface as local on a multi-homed host.
Lacking that, we schedule scripts on interface up/down events.

Hello,

 

Could you please provide more details? Does it solve the following issue?

- Hyper-V is enabled

- GlobalProtect VPN is enabled

- WSL2 is started

- network connectivity to the internet from within WSL2 is working (wsl2-vpnkit is used)

 

Issue 1

- services running in WSL2 (web server for instance) are not reachable from the hosts browser

- Solution:
Get-NetIPInterface -InterfaceAlias "vEthernet (WSL)" | Set-NetIPInterface -InterfaceMetric 1
Get-NetAdapter | Where-Object {$_.InterfaceDescription -like "PANGP*"} | Set-NetIPInterface -InterfaceMetric 6000

 

Issue 2

- issue 1 is solved but

- now e.g. using the host browser (Windows 10) to reach any website (internal and public) leads either to a timeout or is very very slow.

 

This is probably because GP routing now that traffic through the Hyper-V Virtual Ethernet Adapter #2.

 

In Cisco AnyConnect is the following option available: https://www.cisco.com/c/en/us/td/docs/security/vpn_client/anyconnect/anyconnect410/administration/gu...

That probably would solve that issue.

 

UPDATE:

Example: route add 172.17.169.14 mask 255.255.255.255 172.17.169.14 metric 256 if 47 (in Windows)

worked indeed and solved the issue. I implemented a CMD/Powershell combination which is executed on logon and whenever the network changes (VPN on/off) which sets a static IP for the WSL2 distribution. If multiple distributions, it sets a static IP for each individual distribution.

Finally, it executes route add for these IPs.

Furthermore, the solution for issue 1 is obsolete then, so far.

still not working for me:

 

PS C:\WINDOWS\system32> wsl -d Ubuntu-20.04

The attempted operation is not supported for the type of object referenced.

PS C:\WINDOWS\system32> wsl -l -v

NAME STATE VERSION

* Ubuntu-18.04 Running 1

  Ubuntu-20.04 Stopped 2

  • 1 accepted solution
  • 43721 Views
  • 21 replies
  • 1 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!