networkingMode=mirrored: WSL2 service inaccessible via LAN IP, even from the WSL and host themselves

[KingBridgeSS]

Windows Version

Microsoft Windows [Version 10.0.26100.4652]

WSL Version

2.5.10.0

Are you using WSL 1 or WSL 2?

• WSL 2
• WSL 1

Kernel Version

6.6.87.2-1

Distro Version

Ubuntu 22.04

Other Software

No response

Repro Steps

1. Configure .wslconfig to use networkingMode=mirrored.

2. Ensure WSL is fully restarted by running wsl --shutdown in PowerShell, then restarting the WSL distro.

3. Inside the WSL distro, start a simple web server on port 8000:

   python3 -m http.server 8000

4. In another WSL terminal, perform the following curl requests:

   • Test 1 (localhost loopback):

     curl http://localhost:8000

   • Test 2 (Outbound to LAN):

     # Replace 192.168.31.1 with your actual router's IP address
     curl http://192.168.31.1

   • Test 3 (Hairpin loopback to host's LAN IP, on WSL and host):

     # Replace 192.168.31.33 with your actual host's LAN IP
     curl http://192.168.31.33:8000

Expected Behavior

All three curl commands should succeed. Specifically, the hairpin request (curl http://192.168.31.33:8000) should connect to the Python server and return the directory listing, just as the localhost request does.

Actual Behavior

• Test 1 (localhost): Succeeds as expected.
• Test 2 (Router): Succeeds as expected, proving outbound LAN connectivity is working.
• Test 3 (Host LAN IP): Fails. The curl command hangs until it times out.

This demonstrates a specific failure in the hairpin routing path where a request originating from within WSL, destined for the host's own LAN IP, is dropped.

Diagnostic Logs

I have tried following steps:

1. Full OS Reinstall: The issue persists even after a complete reinstallation of Windows 11, with the problematic behavior reappearing immediately after setting up WSL.
2. Network Resets: Standard (netsh winsock reset, etc.) and advanced (netsh advfirewall reset) network resets have been performed without success.
3. Third-party Software: The system has been tested with all third-party VPNs, proxies, and security software uninstalled. The issue persists on a clean system.
4. Wireshark Analysis: Capturing on the host's physical NIC shows no packets for the failing connection attempt (curl http://192.168.31.33:8000). This indicates the packet is dropped before it reaches the Npcap driver level.
5. Adding NetFirewallHyperVRule New-NetFirewallHyperVRule -DisplayName 'Allow All Inbound Traffic to WSL in Private Network' -Name 'WSL Rule' -Direction Inbound -Action Allow -VMCreatorId '{40E0AC32-46A5-438A-A0B2-2B479E8F2E90}' -Enabled True

Key Evidence from pktmon

The definitive evidence comes from pktmon, Windows' built-in kernel-level packet monitor. A trace reveals the following:

• The TCP SYN packet from WSL to 192.168.31.33:8000 is successfully generated.
• The packet travels down the Tx (Transmit) path of the Windows networking stack.
• Crucially, the packet successfully performs a hairpin turn, and its direction changes from Tx to Rx (Receive) within the kernel.
• The packet then travels all the way up the Rx path, ready for delivery to the listening application.
• There are no Drop events recorded in the entire trace for this packet.

pktmon Log

PktMon.txt

Here is the relevant excerpt from the PktMon.txt log, showing the packet successfully traversing the Tx and Rx paths.

	00-15-5D-23-23-30 > BC-EC-A0-4A-FE-08, ethertype IPv4 (0x0800), length 66: 192.168.31.33.10455 > 192.168.31.33.8000: Flags [S], seq 3857641395, win 65535, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
[02]0000.0000::2025-08-10 12:14:09.843709700 [Microsoft-Windows-PktMon] PktGroupId 562949953421432, PktNumber 1, Appearance 0, Direction Tx , Type Ethernet , Component 49, Edge 1, Filter 0, OriginalSize 66, LoggedSize 66 
	00-15-5D-23-23-30 > BC-EC-A0-4A-FE-08, ethertype IPv4 (0x0800), length 66: 192.168.31.33.10455 > 192.168.31.33.8000: Flags [S], seq 3857641395, win 65535, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
[02]0000.0000::2025-08-10 12:14:09.843712200 [Microsoft-Windows-PktMon] PktGroupId 562949953421433, PktNumber 1, Appearance 0, Direction Tx , Type Ethernet , Component 49, Edge 2, Filter 0, OriginalSize 66, LoggedSize 66 
	00-15-5D-23-23-30 > BC-EC-A0-4A-FE-08, ethertype IPv4 (0x0800), length 66: 192.168.31.33.10455 > 192.168.31.33.8000: Flags [S], seq 3857641395, win 65535, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
[02]0000.0000::2025-08-10 12:14:09.843714000 [Microsoft-Windows-PktMon] PktGroupId 562949953421434, PktNumber 1, Appearance 0, Direction Tx , Type Ethernet , Component 50, Edge 1, Filter 0, OriginalSize 66, LoggedSize 66 
	00-15-5D-23-23-30 > BC-EC-A0-4A-FE-08, ethertype IPv4 (0x0800), length 66: 192.168.31.33.10455 > 192.168.31.33.8000: Flags [S], seq 3857641395, win 65535, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
[02]0000.0000::2025-08-10 12:14:09.843716800 [Microsoft-Windows-PktMon] PktGroupId 562949953421435, PktNumber 1, Appearance 0, Direction Tx , Type Ethernet , Component 50, Edge 2, Filter 0, OriginalSize 66, LoggedSize 66 
	00-15-5D-23-23-30 > BC-EC-A0-4A-FE-08, ethertype IPv4 (0x0800), length 66: 192.168.31.33.10455 > 192.168.31.33.8000: Flags [S], seq 3857641395, win 65535, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
[02]0000.0000::2025-08-10 12:14:09.843718600 [Microsoft-Windows-PktMon] PktGroupId 562949953421436, PktNumber 1, Appearance 0, Direction Tx , Type Ethernet , Component 51, Edge 1, Filter 0, OriginalSize 66, LoggedSize 66 
	00-15-5D-23-23-30 > BC-EC-A0-4A-FE-08, ethertype IPv4 (0x0800), length 66: 192.168.31.33.10455 > 192.168.31.33.8000: Flags [S], seq 3857641395, win 65535, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
[02]0000.0000::2025-08-10 12:14:09.843729200 [Microsoft-Windows-PktMon] PktGroupId 562949953421437, PktNumber 1, Appearance 0, Direction Tx , Type Ethernet , Component 51, Edge 2, Filter 0, OriginalSize 66, LoggedSize 66 
	00-15-5D-23-23-30 > BC-EC-A0-4A-FE-08, ethertype IPv4 (0x0800), length 66: 192.168.31.33.10455 > 192.168.31.33.8000: Flags [S], seq 3857641395, win 65535, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
[02]0000.0000::2025-08-10 12:14:09.843731400 [Microsoft-Windows-PktMon] PktGroupId 562949953421438, PktNumber 1, Appearance 0, Direction Tx , Type Ethernet , Component 11, Edge 1, Filter 0, OriginalSize 66, LoggedSize 66 
	00-15-5D-23-23-30 > BC-EC-A0-4A-FE-08, ethertype IPv4 (0x0800), length 66: 192.168.31.33.10455 > 192.168.31.33.8000: Flags [S], seq 3857641395, win 65535, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
[02]0000.0000::2025-08-10 12:14:09.843742100 [Microsoft-Windows-PktMon] PktGroupId 562949953421439, PktNumber 1, Appearance 0, Direction Tx , Type Ethernet , Component 126, Edge 1, Filter 0, OriginalSize 66, LoggedSize 66 
	00-15-5D-23-23-30 > BC-EC-A0-4A-FE-08, ethertype IPv4 (0x0800), length 66: 192.168.31.33.10455 > 192.168.31.33.8000: Flags [S], seq 3857641395, win 65535, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
[02]0000.0000::2025-08-10 12:14:09.843743800 [Microsoft-Windows-PktMon] PktGroupId 562949953421440, PktNumber 1, Appearance 0, Direction Tx , Type Ethernet , Component 52, Edge 1, Filter 0, OriginalSize 66, LoggedSize 66 
	00-15-5D-23-23-30 > BC-EC-A0-4A-FE-08, ethertype IPv4 (0x0800), length 66: 192.168.31.33.10455 > 192.168.31.33.8000: Flags [S], seq 3857641395, win 65535, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
[02]0000.0000::2025-08-10 12:14:09.843747300 [Microsoft-Windows-PktMon] PktGroupId 562949953421441, PktNumber 1, Appearance 0, Direction Tx , Type Ethernet , Component 52, Edge 2, Filter 0, OriginalSize 66, LoggedSize 66 
	00-15-5D-23-23-30 > BC-EC-A0-4A-FE-08, ethertype IPv4 (0x0800), length 66: 192.168.31.33.10455 > 192.168.31.33.8000: Flags [S], seq 3857641395, win 65535, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
[02]0000.0000::2025-08-10 12:14:09.843749100 [Microsoft-Windows-PktMon] PktGroupId 562949953421442, PktNumber 1, Appearance 0, Direction Tx , Type Ethernet , Component 53, Edge 1, Filter 0, OriginalSize 66, LoggedSize 66 
	00-15-5D-23-23-30 > BC-EC-A0-4A-FE-08, ethertype IPv4 (0x0800), length 66: 192.168.31.33.10455 > 192.168.31.33.8000: Flags [S], seq 3857641395, win 65535, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
[02]0000.0000::2025-08-10 12:14:09.843756000 [Microsoft-Windows-PktMon] PktGroupId 562949953421443, PktNumber 1, Appearance 0, Direction Tx , Type Ethernet , Component 53, Edge 2, Filter 0, OriginalSize 66, LoggedSize 66 
	00-15-5D-23-23-30 > BC-EC-A0-4A-FE-08, ethertype IPv4 (0x0800), length 66: 192.168.31.33.10455 > 192.168.31.33.8000: Flags [S], seq 3857641395, win 65535, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
[02]0000.0000::2025-08-10 12:14:09.843758100 [Microsoft-Windows-PktMon] PktGroupId 562949953421444, PktNumber 1, Appearance 0, Direction Tx , Type Ethernet , Component 12, Edge 1, Filter 0, OriginalSize 66, LoggedSize 66 
	00-15-5D-23-23-30 > BC-EC-A0-4A-FE-08, ethertype IPv4 (0x0800), length 66: 192.168.31.33.10455 > 192.168.31.33.8000: Flags [S], seq 3857641395, win 65535, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
[02]0000.0000::2025-08-10 12:14:09.843766000 [Microsoft-Windows-PktMon] PktGroupId 562949953421445, PktNumber 1, Appearance 0, Direction Rx , Type Ethernet , Component 12, Edge 1, Filter 0, OriginalSize 66, LoggedSize 66 
	00-15-5D-23-23-30 > BC-EC-A0-4A-FE-08, ethertype IPv4 (0x0800), length 66: 192.168.31.33.10455 > 192.168.31.33.8000: Flags [S], seq 3857641395, win 65535, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
[02]0000.0000::2025-08-10 12:14:09.843767100 [Microsoft-Windows-PktMon] PktGroupId 562949953421446, PktNumber 1, Appearance 0, Direction Rx , Type Ethernet , Component 53, Edge 2, Filter 0, OriginalSize 66, LoggedSize 66 
	00-15-5D-23-23-30 > BC-EC-A0-4A-FE-08, ethertype IPv4 (0x0800), length 66: 192.168.31.33.10455 > 192.168.31.33.8000: Flags [S], seq 3857641395, win 65535, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
[02]0000.0000::2025-08-10 12:14:09.843773200 [Microsoft-Windows-PktMon] PktGroupId 562949953421447, PktNumber 1, Appearance 0, Direction Rx , Type Ethernet , Component 53, Edge 1, Filter 0, OriginalSize 66, LoggedSize 66 
	00-15-5D-23-23-30 > BC-EC-A0-4A-FE-08, ethertype IPv4 (0x0800), length 66: 192.168.31.33.10455 > 192.168.31.33.8000: Flags [S], seq 3857641395, win 65535, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
[02]0000.0000::2025-08-10 12:14:09.843774600 [Microsoft-Windows-PktMon] PktGroupId 562949953421448, PktNumber 1, Appearance 0, Direction Rx , Type Ethernet , Component 52, Edge 2, Filter 0, OriginalSize 66, LoggedSize 66 
	00-15-5D-23-23-30 > BC-EC-A0-4A-FE-08, ethertype IPv4 (0x0800), length 66: 192.168.31.33.10455 > 192.168.31.33.8000: Flags [S], seq 3857641395, win 65535, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
[02]0000.0000::2025-08-10 12:14:09.843836400 [Microsoft-Windows-PktMon] PktGroupId 562949953421449, PktNumber 1, Appearance 0, Direction Rx , Type Ethernet , Component 52, Edge 1, Filter 0, OriginalSize 66, LoggedSize 66 
	00-15-5D-23-23-30 > BC-EC-A0-4A-FE-08, ethertype IPv4 (0x0800), length 66: 192.168.31.33.10455 > 192.168.31.33.8000: Flags [S], seq 3857641395, win 65535, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
[02]0000.0000::2025-08-10 12:14:09.843839900 [Microsoft-Windows-PktMon] PktGroupId 562949953421450, PktNumber 1, Appearance 0, Direction Rx , Type Ethernet , Component 126, Edge 1, Filter 0, OriginalSize 66, LoggedSize 66 
	00-15-5D-23-23-30 > BC-EC-A0-4A-FE-08, ethertype IPv4 (0x0800), length 66: 192.168.31.33.10455 > 192.168.31.33.8000: Flags [S], seq 3857641395, win 65535, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
[02]0000.0000::2025-08-10 12:14:09.843845500 [Microsoft-Windows-PktMon] PktGroupId 562949953421451, PktNumber 1, Appearance 0, Direction Rx , Type Ethernet , Component 246, Edge 1, Filter 0, OriginalSize 66, LoggedSize 66 
	00-15-5D-23-23-30 > BC-EC-A0-4A-FE-08, ethertype IPv4 (0x0800), length 66: 192.168.31.33.10455 > 192.168.31.33.8000: Flags [S], seq 3857641395, win 65535, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0

[github-actions]

Logs are required for review from WSL team

If this a feature request, please reply with '/feature'. If this is a question, reply with '/question'.
Otherwise, please attach logs by following the instructions below, your issue will not be reviewed unless they are added. These logs will help us understand what is going on in your machine.

How to collect WSL logs

Download and execute collect-wsl-logs.ps1 in an administrative powershell prompt:

Invoke-WebRequest -UseBasicParsing "https://raw.githubusercontent.com/microsoft/WSL/master/diagnostics/collect-wsl-logs.ps1" -OutFile collect-wsl-logs.ps1
Set-ExecutionPolicy Bypass -Scope Process -Force
.\collect-wsl-logs.ps1

The script will output the path of the log file once done.

If this is a networking issue, please use collect-networking-logs.ps1, following the instructions in Collect WSL logs for networking issues

Once completed please upload the output files to this GitHub issue.

See Collect WSL logs (recommended method).

If you choose to email these logs instead of attaching them to the bug, please send them to wsl-gh-logs@microsoft.com with the GitHub issue number in the subject, and include a link to your GitHub issue comment in the message body, and reply with '/emailed-logs'.

[KingBridgeSS]

WslNetworkingLogs-2025-08-10_13-09-37.zip

[github-actions]

Diagnostic information

.wslconfig found
Detected appx version: 2.5.10.0
optional-components.txt not found

[KingBridgeSS]

It's a problem suddenly appeals after everything works fine in a couple of months.

[apsvb]

Got a similar issue under Windows 11 latest version while activating "mirrored" mode. I had to fallback to NAT.

[KingBridgeSS]

Update: I found the culprit! I previously thought I had disabled all my VPNs, but the OpenVPN service was actually still active in the background. Once I killed the service and ran wsl --shutdown, everything started working again.

Just a heads-up for others: make sure to check your background services, not just the desktop apps!

[KingBridgeSS]

Update: I found the culprit! I previously thought I had disabled all my VPNs, but the OpenVPN service was actually still active in the background. Once I killed the service and ran wsl --shutdown, everything started working again.

Just a heads-up for others: make sure to check your background services, not just the desktop apps!

It seems there is a conflict between WSL2's networking stack and the VPN's virtual network adapter.