microsoft / microsoft/WSL

WSL NetworkMode mirrored unable to connect to Windows host via TCP

Open
#40,343 8 comments 5 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

emailed-logs network
Dominant language
C++
Stars
33.7k
Forks
1.8k
Avg merge
3d 17h
Merged PRs (30d)
116

Description

### Windows Version

Microsoft Windows [Version 10.0.22631.6936]

### WSL Version

2.6.3.0

### Are you using WSL 1 or WSL 2?

- [x] WSL 2
- [ ] WSL 1

### Kernel Version

6.6.87.2-microsoft-standard-WSL2+

### Distro Version

Ubuntu 26.04

### Other Software

* Windows App Running TCP server on 20000
* Linux python script connecting to localhost:20000

### Repro Steps

When a WSL2 client attempts to connect to a Windows host application via 127.0.0.1 in mirrored networking mode, the TCP handshake fails because the Windows network stack returns the SYN-ACK to a different ephemeral port than the one the SYN was sent from. The Linux kernel does not match the SYN-ACK to the original socket and responds with RST, making it impossible to establish a connection to Windows host services via loopback.

This happens even with hostAddressLoopback=true set in .wslconfig.

1. Set networkingMode=mirrored and hostAddressLoopback=true in %USERPROFILE%\.wslconfig
2. Run wsl --shutdown and restart WSL
3. Start a TCP server on Windows host listening on port 20000 (e.g. any app bound to 0.0.0.0:20000)
4. From WSL, attempt to connect to 127.0.0.1:20000: `nc -v 127.0.0.1 20000`
5. Capture traffic in WSL: `sudo tcpdump -i any -n port 20000`

### Expected Behavior

The TCP three-way handshake completes successfully:
```
WSL (port X) → SYN → Windows:20000
WSL (port X) ← SYN-ACK ← Windows:20000
WSL (port X) → ACK → Windows:20000
```
The SYN-ACK should be addressed back to the same source port that sent the SYN, allowing the Linux kernel to match it to the existing socket and complete the connection.

### Actual Behavior

The SYN-ACK is returned to a different port than the one that sent the SYN, causing the Linux kernel to send RST and drop the connection:
```
WSL (port 41264) → SYN → Windows:20000 ✅
WSL (port 36677) ← SYN-ACK ← Windows:20000 ❌ wrong port!
WSL (port 36677) → RST → Windows:20000 ❌ connection dropped
```
The connection never establishes. The Windows app keeps retransmitting SYN-ACK to incorrect ports, each time receiving a RST from the Linux kernel.

### Diagnostic Logs

`tcpdump` output from WSL during connection attempt:
```
13:24:14.179902 loopback0 Out IP 127.0.0.1.41264 > 127.0.0.1.20000: Flags [S], seq 2406906390, win 64240, options [mss 1460,sackOK,TS val 3610728993 ecr 0,nop,wscale 7], length 0
13:24:14.180534 loopback0 In IP 127.0.0.1.20000 > 127.0.0.1.36677: Flags [S.], seq 2977463670, ack 2406906391, win 8192, options [mss 65495,nop,wscale 8,sackOK,TS val 6756090 ecr 3610728993], length 0
13:24:14.180569 loopback0 Out IP 127.0.0.1.36677 > 127.0.0.1.20000: Flags [R], seq 2406906391, win 0, length 0
13:24:15.192632 loopback0 In IP 127.0.0.1.20000 > 127.0.0.1.35723: Flags [S.], seq 2977463670, ack 2406906391, win 8192, options [mss 65495,nop,wscope 8,sackOK,TS val 6757102 ecr 3610728993], length 0
13:24:15.192678 loopback0 Out IP 127.0.0.1.35723 > 127.0.0.1.20000: Flags [R], seq 2406906391, win 0, length 0
13:24:17.195141 loopback0 In IP 127.0.0.1.33820 > 127.0.0.1.20000: Flags [S.], seq 2977463670, ack 2406906391, win 8192, options [mss 65495,nop,wscale 8,sackOK,TS val 6759105 ecr 3610728993], length 0
13:24:17.195186 loopback0 Out IP 127.0.0.1.33820 > 127.0.0.1.20000: Flags [R], seq 2406906391, win 0, length 0
```

`.wslconfig`:
```
[wsl2]
networkingMode=mirrored
kernel=C:\\Users\\User\\vmlinux

[experimental]
hostAddressLoopback=true
```

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the failure with networkingMode=mirrored and hostAddressLoopback=true in %USERPROFILE%\.wslconfig, using nc against the Windows service on port 20000. Capture loopback0 traffic with tcpdump and compare the source port in the SYN with the destination port in each SYN-ACK. Done means the SYN-ACK returns to the original source port and the TCP handshake completes.

Written by the indexing model from the issue text.

Assessment

Tech stack
linux
Domain
networking, operating-systems
Issue type
Bug
Difficulty
5/5
Estimated time
Over a week
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.