microsoft / microsoft/WSL

WSL2 networkingMode=mirrored connection timed out when going over two VPNs

Open
#12,309 16 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

network
Dominant language
C++
Stars
33.7k
Forks
1.8k
Avg merge
3d 17h
Merged PRs (30d)
116

Description

### Windows Version

Microsoft Windows [Version 10.0.22631.4317]

### WSL Version

2.3.26.0

### Are you using WSL 1 or WSL 2?

- [x] WSL 2
- [ ] WSL 1

### Kernel Version

5.15.167.4-1

### Distro Version

Debian 11

### Other Software

_No response_

### Repro Steps

1. Enable mirrored networking
2. Connect via VPN (Cisco AnyConnect)
3. Connect via second VPN (CheckPoint Securemote) - new routes for target networks are added
4. Make ssh from windows cmd - works
5. Make ssh from any WSL2 distro - connection timed out

We use AnyConnect to connect to company network. To access target servers, we need to further connect to other VPN with Checkpoint.
ssh to servers located on first VPN works with mirrored mode from WSL2 distro.
ssh to servers located behind second VPN doesn't work from WSL2 distro.

**However ssh to servers behind second VPN works from windows cmd.**

Routes from Windows are propagated into WSL2 distro, also destination ip is shown in route table through same gateway ip.
Doesn't matter in which order I connect to second VPN/wsl --shutdown.

### Expected Behavior

Working ssh connection from WSL2 distro with mirrored network.

### Actual Behavior

Timed out connection from WSL2 distro with mirrored network.

### Diagnostic Logs

_No response_

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Run the listed WSL2 mirrored-networking reproduction with AnyConnect and CheckPoint VPNs; compare SSH from Windows cmd and from a WSL2 Debian 11 distro, including the propagated routes. Done means SSH to servers behind the second VPN succeeds from WSL2 while the first VPN case remains working.

Written by the indexing model from the issue text.

Assessment

Tech stack
linux
Domain
networking, operating-systems
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.