Access WSL2 from your Network

I host this website on a Linux VPS and I run various services on my Linux homelab server, but I daily drive Windows, thus I'm a big fan of WSL. I wanted to share the WSL network settings I had to uncover to test this website's mobile experience on my phone while developing it.

Preamble Ramble

Often I find it easier to open WSL in VSCode over rebooting to a Linux partition, push to a git repo and deploy it on a Linux server. There's just one problem. By default you can't connect to a server process in WSL outside of the host Windows machine. When developing a site's desktop and mobile stylesheets, Chrome and Firefox's Responsive Design Modes are great, but there's nothing like testing on a real mobile device. Or maybe you're developing a multi-user LAN web application and want to connect multiple clients.

By default WSL uses the "NAT" networking mode, which means that your Windows machine is acting as a router for its Linux virtual machines. It assigns each VM an address in the 172.16/12 IP range. In practical terms, if you run ip addr inside WSL:

$ ip addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet 10.255.255.254/32 brd 10.255.255.254 scope global lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
    link/ether 00:15:5d:14:24:0d brd ff:ff:ff:ff:ff:ff
    inet 172.26.17.194/20 brd 172.26.31.255 scope global eth0
       valid_lft forever preferred_lft forever
    inet6 fe80::215:5dff:fe14:240d/64 scope link
       valid_lft forever preferred_lft forever

You'll see a loopback interface, lo, and a virtual ethernet port, eth0. If you ping its eth0 inet address from windows, (ping 172.26.17.194 in my case) you'll get a response. But if you try to ping it or connect to a port from another device on your local network, you'll get nothing. Windows is handling network address translation (NAT) within itself, but not to the broader network.

Enable Access over the Network

I assume you already have WSL2 setup with your preferred Linux distro, I'm using Ubuntu. You also need a process to listen on a port, python3 -m http.server is my go to way of quickly spinning up an http server.

First enable Mirrored Networking mode. Via GUI, open the WSL settings app > Networking tab > Network Mode. Otherwise open ~/.wslconfig in your text editor of choice and type:

[wsl2]
networkingMode=mirrored

Now WSL will share all your Windows network interfaces, thus it's IPv4 address is your Windows IPv4 address. This is where I got stumped for a bit. Turns out WSL also has it's own Firewall which blocks incoming traffic by default! You can read the documentation if you prefer it to my writing, I won't be offended.

In Windows Powershell, to see your WSL firewall settings, run:

Get-NetFirewallHyperVVMSetting -PolicyStore ActiveStore -Name '{40E0AC32-46A5-438A-A0B2-2B479E8F2E90}'

The magic incantation at the end is the name of WSL firewall policy group, which you can verify using the command: Get-NetFirewallHyperVVMCreator.

To change the setting in question, you need to change DefaultInboundAction to Allow:

Set-NetFirewallHyperVVMSetting -Name '{40E0AC32-46A5-438A-A0B2-2B479E8F2E90}' -DefaultInboundAction Allow

Then restart WSL from Powershell:

wsl --shutdown

Once that finishes, if you open up WSL and host a service such as python3 -m http.server, you should be able to access it on your phone via your windows IP address (assuming you're on the same local network of course).