Windows wsl port forwarding

I want to share with you a pro tip to make programming on Windows a little easier with the help of the WSL 2.

Imagine you are developing an API, web app, website, etc. on your Windows machine under WSL2. For example, in my case, my own website. I use the React framework Next.js, and yarn as package manager, so if I want to start the development server to check my site I just do:

yarn dev

With the above command, the development server will start and listen on port 3000. It will serve the page to every device that can reach it, as it’s serving the site on the 0.0.0.0 address by default.

Картинка с сайта: aalonso.dev

Click on image to enlarge

Then, if I visit localhost:3000 on my Windows machine, everything works. The server returns my live website. However, what happens when I try to open my live site from my mobile phone? I navigate to <my_windows_local_ip>:3000 and then

Картинка с сайта: aalonso.dev

Click on image to enlarge

The solution: forwarding ports in WSL 2 NAT

WSL 2 creates a virtualized Ethernet adapter with its own unique IP address, so in fact it creates a NAT between your WSL instance and your Windows host computer. So to be able to access applications running in your WSL from within your Local Area Network (LAN), you must port forward the desired ports.

The solution is to add a port proxy in the Windows Firewall, so we open a PowerShell terminal with administrator rights and execute the following command:

netsh interface portproxy add v4tov4 listenport=3000 listenaddress=0.0.0.0 connectport=3000 connectaddress=<the_wsl_ip>

You can get the WSL virtual machine IP right from PowerShell, by executing bash:

bash.exe -c "ip -4 addr show eth0 | grep -oP '(?<=inet\s)\d+(\.\d+){3}'"

Or the same from within the WSL instance:

ip -4 addr show eth0 | grep -oP '(?<=inet\s)\d+(\.\d+){3}'

After executing the netsh interface command in an administrator PowerShell, the server can now be reached without further configuration needed, nor restarting the server.

Картинка с сайта: aalonso.dev

Click on image to enlarge

Bonus: a PowerShell script to simplify this task

The IP address of the WSL VM changes every time it reboots (like when you power off your Windows), so if you have already added a port proxy for an IP address, it might not work if you restart your computer.

I have created a PowerShell script to simplify this task when you need it to be done. You could also configure a Windows task to execute this PowerShell script on every reboot, if you also start WSL on boot (because WSL needs to be launched to get its IP address). Or could be a way to executing it from WSL once it starts. I’m not explaining here how to achieve this, as I don’t have configured it that way. I don’t usually access apps running inside WSL from my LAN, so when I need to do this, I just execute the following script in an administrator PowerShell terminal (explanation below):

$remoteport = bash.exe -c "ip -4 addr show eth0 | grep -oP '(?<=inet\s)\d+(\.\d+){3}'"
$found = $remoteport -match '\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}';

if( $found ){
  $remoteport = $matches[0];
} else{
  echo "The Script Exited, the ip address of WSL 2 cannot be found";
  exit;
}

#[Ports]

#All the ports you want to forward separated by coma
$ports=@(80,443,3000,3001,3002,3333,5000,5432,6000,8080,8081,19000,19001);


#[Static ip]
#You can change the addr to your ip config to listen to a specific address
$addr='0.0.0.0';
$ports_a = $ports -join ",";


#Remove Firewall Exception Rules
iex "Remove-NetFireWallRule -DisplayName 'WSL 2 Firewall Unlock' ";

#adding Exception Rules for inbound and outbound Rules
iex "New-NetFireWallRule -DisplayName 'WSL 2 Firewall Unlock' -Direction Outbound -LocalPort $ports_a -Action Allow -Protocol TCP";
iex "New-NetFireWallRule -DisplayName 'WSL 2 Firewall Unlock' -Direction Inbound -LocalPort $ports_a -Action Allow -Protocol TCP";

for( $i = 0; $i -lt $ports.length; $i++ ){
  $port = $ports[$i];
  iex "netsh interface portproxy delete v4tov4 listenport=$port listenaddress=$addr";
  iex "netsh interface portproxy add v4tov4 listenport=$port listenaddress=$addr connectport=$port connectaddress=$remoteport";
}

What this script does is:

• Gets the IP address of the WSL VM.
• Defines the ports you want to proxy/forward. You can therefore edit the $ports array as you wish. Here I have written all the ports I could potentially use, so the script will be valid for multiple apps/technologies.
• Adds Windows Firewall rules to allow all inbound/outbound traffic to the WSL. Also removes old rules from previous script executions (with different IP addresses).
• Adds the required port proxies, at the same times that removes old ones from old script executions (with different IP addresses).

If this is the first time that you execute this script, or you have added a new port, you can get a lot of not found messages. These are normal warnings that you can safely ignore, as these occur because the script is trying to delete non-existent firewall rules (first time execution) or port proxies (when you add a new port).

I hope this serves you to improve your developer experience in WSL and make you more productive. If you want to continue improving your WSL experience, check how to run GUI applications on WSL2.

I hope my article has helped you, or at least, that you have enjoyed reading it. I do this for fun and I don’t need money to keep the blog running. However, if you’d like to show your gratitude, you can pay for my next coffee with a one-time donation of just $1.00. Thanks!

In this post you will learn how to open / forward ports of programs running in WSL2 in the Windows firewall so that they are accessible from the home network. How can I access a WSL2 Linux with SSH? How do I share a web server via WSL2? These questions are answered below

Find out IP address in WSL2

First, the WSL2 IP address is required so that Windows can be told to which address the request must be forwarded. The command depends on the Linux distribution.

Ubuntu

ifconfig

Debian

ip a

In my case the IP address of the WSL2 Linux was 172.29.192.157 , this should be adjusted in all following commands.

Run PowerShell or Command Prompt as Administrator

For the following commands it is necessary to start Windows PowerShell or Command Prompt as administrator (right click: Run as administrator)

It is important again to adjust the IP address in the commands.

Forward OpenSSH server

If you want to enable OpenSSH, this is port 22 by default, alternatively you can also set a different port in the config of the SSH server.

Proxy forwarding

netsh interface portproxy add v4tov4 listenaddress=0.0.0.0 listenport=22 connectaddress=172.29.192.157 connectport=22

Firewall rule

netsh advfirewall firewall add rule name=”WSL2 Forward Port 22” dir=in action=allow protocol=TCP localport=22

Forward web server

If you want to enable Apache or Nginx, this is port 80 by default.

Proxy forwarding

netsh interface portproxy add v4tov4 listenaddress=0.0.0.0 listenport=80 connectaddress=172.29.192.157 connectport=80

Firewall rule

netsh advfirewall firewall add rule name=”WSL2 Forward Port 80” dir=in action=allow protocol=TCP localport=80

Check proxy rules

The following PowerShell command can be used to display all entered proxy rules

netsh interface portproxy show v4tov4

Check firewall rules

Windows Defender Firewall -> Advanced Settings -> Inbound Rules

Delete proxy rules

If you want to delete a proxy rule with a specific port, this works with the following PowerShell command, before using {port} should be replaced with the desired port to be deleted

netsh interface portproxy delete v4tov4 listenport={port} listenaddress=0.0.0.0

Delete firewall rules

Windows Defender Firewall -> Advanced Settings -> Inbound Rules

Release no longer works after the reboot

After each reboot, the WSL2 Linux gets a new IP address, which means that the old rules no longer work. I wrote a PowerShell script to solve them.

The script retrieves the IP address of a WSL2 Ubuntu distribution, deletes all existing PortProxy rules and creates them again with the new WSL2 IP address

#### ------------ Set WSL 2 Machine IP ------------ ####

$wsl_ip = (ubuntu.exe -c "ifconfig eth0 | grep 'inet '").trim().split()| where {$_}
$regex = [regex] "\b(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\b"

$ip_array = $regex.Matches($wsl_ip) | %{ $_.value }

$wsl_ip = $ip_array[0]

Write-Host "WSL Machine IP: ""$wsl_ip"""

#### ------------ Delete PortProxy rules ------------ ####

netsh int portproxy reset all

#### ------------ Rule: SSH - Port 22 ------------ ####

netsh interface portproxy add v4tov4 listenport=22 listenaddress=0.0.0.0 connectport=22 connectaddress=$wsl_ip

#### ------------ Rule: Webserver SSL - Port 443 ------------ ####

netsh interface portproxy add v4tov4 listenport=443 listenaddress=0.0.0.0 connectport=443 connectaddress=$wsl_ip

#### ------------ Rule: Webserver SSL Regel - Port 80 ------------ ####

netsh interface portproxy add v4tov4 listenport=80 listenaddress=0.0.0.0 connectport=80 connectaddress=$wsl_ip