WSL NetworkMode mirrored unable to connect to Windows host via TCP
Nobody has claimed this yet.
- Dominant language
- C++
- Stars
- 33.7k
- Forks
- 1.8k
- Avg merge
- 3d 17h
- Merged PRs (30d)
- 116
Description
### Windows Version
Microsoft Windows [Version 10.0.22631.6936]
### WSL Version
2.6.3.0
### Are you using WSL 1 or WSL 2?
- [x] WSL 2
- [ ] WSL 1
### Kernel Version
6.6.87.2-microsoft-standard-WSL2+
### Distro Version
Ubuntu 26.04
### Other Software
* Windows App Running TCP server on 20000
* Linux python script connecting to localhost:20000
### Repro Steps
When a WSL2 client attempts to connect to a Windows host application via 127.0.0.1 in mirrored networking mode, the TCP handshake fails because the Windows network stack returns the SYN-ACK to a different ephemeral port than the one the SYN was sent from. The Linux kernel does not match the SYN-ACK to the original socket and responds with RST, making it impossible to establish a connection to Windows host services via loopback.
This happens even with hostAddressLoopback=true set in .wslconfig.
1. Set networkingMode=mirrored and hostAddressLoopback=true in %USERPROFILE%\.wslconfig
2. Run wsl --shutdown and restart WSL
3. Start a TCP server on Windows host listening on port 20000 (e.g. any app bound to 0.0.0.0:20000)
4. From WSL, attempt to connect to 127.0.0.1:20000: `nc -v 127.0.0.1 20000`
5. Capture traffic in WSL: `sudo tcpdump -i any -n port 20000`
### Expected Behavior
The TCP three-way handshake completes successfully:
```
WSL (port X) → SYN → Windows:20000
WSL (port X) ← SYN-ACK ← Windows:20000
WSL (port X) → ACK → Windows:20000
```
The SYN-ACK should be addressed back to the same source port that sent the SYN, allowing the Linux kernel to match it to the existing socket and complete the connection.
### Actual Behavior
The SYN-ACK is returned to a different port than the one that sent the SYN, causing the Linux kernel to send RST and drop the connection:
```
WSL (port 41264) → SYN → Windows:20000 ✅
WSL (port 36677) ← SYN-ACK ← Windows:20000 ❌ wrong port!
WSL (port 36677) → RST → Windows:20000 ❌ connection dropped
```
The connection never establishes. The Windows app keeps retransmitting SYN-ACK to incorrect ports, each time receiving a RST from the Linux kernel.
### Diagnostic Logs
`tcpdump` output from WSL during connection attempt:
```
13:24:14.179902 loopback0 Out IP 127.0.0.1.41264 > 127.0.0.1.20000: Flags [S], seq 2406906390, win 64240, options [mss 1460,sackOK,TS val 3610728993 ecr 0,nop,wscale 7], length 0
13:24:14.180534 loopback0 In IP 127.0.0.1.20000 > 127.0.0.1.36677: Flags [S.], seq 2977463670, ack 2406906391, win 8192, options [mss 65495,nop,wscale 8,sackOK,TS val 6756090 ecr 3610728993], length 0
13:24:14.180569 loopback0 Out IP 127.0.0.1.36677 > 127.0.0.1.20000: Flags [R], seq 2406906391, win 0, length 0
13:24:15.192632 loopback0 In IP 127.0.0.1.20000 > 127.0.0.1.35723: Flags [S.], seq 2977463670, ack 2406906391, win 8192, options [mss 65495,nop,wscope 8,sackOK,TS val 6757102 ecr 3610728993], length 0
13:24:15.192678 loopback0 Out IP 127.0.0.1.35723 > 127.0.0.1.20000: Flags [R], seq 2406906391, win 0, length 0
13:24:17.195141 loopback0 In IP 127.0.0.1.33820 > 127.0.0.1.20000: Flags [S.], seq 2977463670, ack 2406906391, win 8192, options [mss 65495,nop,wscale 8,sackOK,TS val 6759105 ecr 3610728993], length 0
13:24:17.195186 loopback0 Out IP 127.0.0.1.33820 > 127.0.0.1.20000: Flags [R], seq 2406906391, win 0, length 0
```
`.wslconfig`:
```
[wsl2]
networkingMode=mirrored
kernel=C:\\Users\\User\\vmlinux
[experimental]
hostAddressLoopback=true
```
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the failure with networkingMode=mirrored and hostAddressLoopback=true in %USERPROFILE%\.wslconfig, using nc against the Windows service on port 20000. Capture loopback0 traffic with tcpdump and compare the source port in the SYN with the destination port in each SYN-ACK. Done means the SYN-ACK returns to the original source port and the TCP handshake completes.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- linux
- Domain
- networking, operating-systems
- Issue type
- Bug
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100