Windows Firewall WSL Traffic Fix – Complete Guide (2026)

Windows Firewall WSL traffic fix is one of the most common searches for developers using Windows Subsystem for Linux 2 who suddenly lose network connectivity.

When Windows Firewall silently blocks traffic to and from your WSL2 virtual machine, you may experience “Connection timed out” errors, apt update failures, or the inability to SSH into your Linux environment.

According to Broadcom’s support documentation, WSL2 and Windows Sandbox use Hyper‑V technology to create a NAT’d connection from the host NIC to the guest NIC via virtual switches.

The firewall running on the host operating system sees this traffic as unsolicited IP traffic and blocks it. This comprehensive Windows Firewall WSL traffic fix guide covers 10 proven methods to diagnose and resolve these issues.

When you search for a Windows Firewall WSL traffic fix, you are likely dealing with symptoms like curl google.com hanging, sudo apt update failing with connection errors, or SSH clients timing out when trying to connect to WSL2.

According to Microsoft’s Hyper‑V Firewall documentation, starting in Windows 11 version 22H2, Hyper‑V Firewall is a network firewall solution that enables filtering of inbound and outbound traffic to/from containers hosted by Windows, including WSL.

This Windows Firewall WSL traffic fix guide walks you through every step needed to restore connectivity.

1. Understanding Windows Firewall and WSL2 Traffic

WSL2 runs on a lightweight Hyper‑V virtual machine that uses NAT (Network Address Translation) to communicate with the host.

According to a detailed WSL2 networking guide, WSL2 essentially runs on a Hyper‑V hypervisor. When the virtual machine communicates with the physical Windows host, data flows through a “Hyper‑V Virtual Switch.”

Windows Firewall (especially the new Hyper‑V Firewall) inspects this traffic.

Common reasons Windows Firewall blocks WSL2 traffic include:

• Hyper‑V Firewall default inbound block: The Hyper‑V Firewall has a DefaultInboundAction of Block by default. According to Microsoft, the Hyper‑V Firewall’s default rule policies apply to packets entering or leaving the WSL container.
• Public network profile: WSL’s network is often treated as Public, which has stricter firewall rules. According to a Stack Overflow discussion, WSL’s network is considered Public, and you need to delete or modify the Block rule.
• Virtual IP addresses: By default, Windows Defender Firewall treats incoming requests from virtual networks as unauthorized and drops them silently.
• Enterprise firewalls: Corporate firewalls drop unrecognized virtual IP packets to prevent security spoofing.
• Third‑party security software: Products like Symantec Endpoint Protection cannot track applications running inside the WSL VM and will block the traffic.

Understanding these root causes is the first step in any Windows Firewall WSL traffic fix guide.

2. Windows Firewall WSL Traffic Fix: Enable Mirrored Networking

Enabling Mirrored Networking is the most effective Windows Firewall WSL traffic fix for Windows 11 users.

According to a Medium guide, mirrored networking forces WSL to mirror your Windows internet connection exactly. This makes WSL traffic look completely identical to your authorized Windows traffic.

This is the recommended approach for corporate and enterprise environments.

Step 1: Open a text editor to create .wslconfig:
    notepad %USERPROFILE%\.wslconfig

Step 2: Add the following configuration:
    [wsl2]
    networkingMode=mirrored
    dnsTunneling=true

Step 3: Save and close the file

Step 4: Clear legacy DNS conflicts (inside WSL):
    sudo rm -f /etc/resolv.conf

Step 5: Ensure WSL regenerates resolv.conf (inside WSL):
    sudo nano /etc/wsl.conf
    Add: [network]
          generateResolvConf = true

Step 6: Restart WSL:
    wsl --shutdown

Step 7: Flush DNS cache:
    ipconfig /flushdns

Step 8: Reopen WSL and test connectivity:
    ping google.com
    curl -Iv https://github.com

According to the Medium guide, this configuration is completely set‑and‑forget. When you head home or jump on a hotspot, Windows will automatically mirror your new connection profiles.

According to a Dev.to article, enabling mirrored networking solved the issue instantly and is now one of the first things to check whenever WSL2 suddenly loses connectivity.

Outcome: WSL2 shares the Windows network stack, making traffic indistinguishable from Windows traffic.

3. Create Hyper‑V Firewall Rules with PowerShell

Creating explicit Hyper‑V Firewall rules is a precise Windows Firewall WSL traffic fix.

According to Microsoft’s Hyper‑V Firewall documentation, you can use PowerShell to configure Hyper‑V firewall rules and settings.

Step 1: Open PowerShell as Administrator

Step 2: Get the WSL VMCreatorId (should be {40E0AC32-46A5-438A-A0B2-2B479E8F2E90}):
    Get-NetFirewallHyperVVMCreator

Step 3: Check current Hyper‑V firewall settings for WSL:
    Get-NetFirewallHyperVVMSetting -PolicyStore ActiveStore -Name '{40E0AC32-46A5-438A-A0B2-2B479E8F2E90}'

Step 4: Allow inbound traffic to WSL on a specific port:
    New-NetFirewallHyperVRule -DisplayName "Allow WSL Inbound" -Direction Inbound -VMCreatorId '{40E0AC32-46A5-438A-A0B2-2B479E8F2E90}' -Action Allow

Step 5: Allow outbound traffic from WSL:
    New-NetFirewallHyperVRule -DisplayName "Allow WSL Outbound" -Direction Outbound -VMCreatorId '{40E0AC32-46A5-438A-A0B2-2B479E8F2E90}' -Action Allow

Step 6: Create a rule for a specific port (e.g., port 80 for web services):
    New-NetFirewallHyperVRule -DisplayName "WSL Port 80 Inbound" -Direction Inbound -Protocol TCP -LocalPort 80 -Action Allow -VMCreatorId '{40E0AC32-46A5-438A-A0B2-2B479E8F2E90}'

Step 7: Verify the rules:
    Get-NetFirewallHyperVRule | Where-Object { $_.VMCreatorId -eq '{40E0AC32-46A5-438A-A0B2-2B479E8F2E90}' }

According to Microsoft's documentation, the WSL VMCreatorId is {40E0AC32-46A5-438A-A0B2-2B479E8F2E90}.

A GitHub project also provides a WSL2 Hyper‑V Firewall Manager GUI that uses these PowerShell cmdlets under the hood.

Outcome: Explicit Hyper‑V firewall rules allow WSL2 traffic through the firewall.

4. Set Network Profile to Private

Setting the network profile to Private is a simple Windows Firewall WSL traffic fix.

According to a GitHub issue, a safer alternative is to only allow connections to WSL in a Trusted (Private) network.

Step 1: Open Settings (Windows + I)
Step 2: Go to Network & Internet
Step 3: Click on your active network (Ethernet or Wi‑Fi)
Step 4: Under Network profile, select "Private"
Step 5: If you have multiple networks, repeat for each

Alternative via PowerShell:
    Set-NetConnectionProfile -NetworkCategory Private -InterfaceAlias "Ethernet"

According to a Microsoft Q&A user, if the network adapter profile is set to Public, it can restrict network access.

Outcome: The network profile is set to Private, allowing less restrictive firewall rules.

5. Allow WSL Through Windows Defender Firewall

Allowing WSL through the Windows Defender Firewall is a common Windows Firewall WSL traffic fix.

According to TheWindowsClub, you can create an exception for your application in Windows Firewall.

Step 1: Open Control Panel → Windows Defender Firewall
Step 2: Click "Allow an app or feature through Windows Defender Firewall"
Step 3: Click "Change settings"
Step 4: Look for "Windows Subsystem for Linux" or "WSL"
Step 5: If not listed, click "Allow another app" and browse to:
    C:\Windows\System32\wsl.exe
Step 6: Check both Private and Public boxes
Step 7: Click OK

Alternative via PowerShell:
    New-NetFirewallRule -DisplayName "WSL" -Direction Inbound -InterfaceAlias "vEthernet (WSL)" -Action Allow

According to a Stack Overflow answer, you may need to create a rule targeting the "vEthernet (WSL)" interface.

Outcome: WSL is explicitly allowed through the Windows Firewall.

6. Remove Blocking Inbound Rules

Sometimes the firewall creates a Block rule that needs to be removed.

According to Stack Overflow, Windows Defender Firewall may have created a Block rule for the virtual network that you need to delete or modify.

Step 1: Open Windows Defender Firewall with Advanced Security:
    Press Win + R, type "wf.msc", and press Enter

Step 2: Click "Inbound Rules" in the left pane

Step 3: Look for any rules related to WSL, Hyper‑V, or vEthernet

Step 4: If you see a Block rule, right‑click and select "Disable" or "Delete"

Step 5: Check "Outbound Rules" as well

Step 6: Restart WSL:
    wsl --shutdown

According to a Stack Overflow user, if you don't explicitly allow traffic, it will be blocked by default, which also blocks connections from WSL.

Outcome: Blocking firewall rules are removed, allowing WSL2 traffic.

7. Restart Internet Connection Sharing (ICS) Service

The Internet Connection Sharing (ICS) Service is critical for WSL2 networking.

According to a detailed troubleshooting guide, the ICS Service must be running for WSL2 to function properly.

Step 1: Press Windows + R, type "services.msc", and press Enter

Step 2: Find "Internet Connection Sharing (ICS)"

Step 3: Ensure "Startup type" is set to "Automatic"

Step 4: If the service is not running, right‑click and select "Start"

Step 5: If it's already running, right‑click and select "Restart"

Step 6: Restart WSL:
    wsl --shutdown

Step 7: Reopen WSL and test connectivity

According to a Microsoft Q&A user, restarting the ICS Service resolved Hyper‑V Default Switch issues.

Outcome: The ICS Service is running, enabling proper WSL2 networking.

8. Disable Third‑Party Firewall and VPN

Third‑party security software can interfere with WSL2 traffic.

According to Broadcom’s support documentation, Endpoint Protection (SEP) firewall blocks WSL2 traffic because it cannot track applications running inside the guest VM.

Step 1: Temporarily disable third‑party antivirus or firewall software
    - Symantec Endpoint Protection
    - McAfee
    - Kaspersky
    - Others

Step 2: Disconnect any active VPN connection

Step 3: Test WSL connectivity:
    ping google.com

Step 4: If connectivity is restored, add an exception for WSL in your security software

Step 5: Re‑enable your security software

According to the Broadcom guide, you need to create a firewall rule to allow both the host MAC address and the WSL2 MAC address as a source.

Outcome: Third‑party security software is identified as the cause and configured to allow WSL traffic.

9. Update WSL and Windows

Updating WSL and Windows can resolve firewall and networking bugs.

According to TheWindowsClub, older WSL releases contain networking bugs that Microsoft has fixed in newer versions.

Step 1: Open PowerShell or Command Prompt as Administrator

Step 2: Update WSL:
    wsl --update

Step 3: Check for Windows updates:
    Settings → Windows Update → Check for updates

Step 4: Install all pending updates

Step 5: Restart your computer

Step 6: After restart, restart WSL:
    wsl --shutdown

Step 7: Test connectivity

According to TheWindowsClub, updating WSL installs the latest networking improvements and fixes for localhost forwarding.

Outcome: WSL and Windows are updated with the latest networking fixes.

10. Reset Windows Network Stack

Resetting the network stack can resolve persistent Windows Firewall WSL traffic fix issues.

According to a Linux Vox guide, loss of internet access in WSL2 is typically caused by misconfigured networking, DNS issues, or firewall rules.

Step 1: Open PowerShell as Administrator

Step 2: Run these commands in order:
    wsl --shutdown
    netsh winsock reset
    netsh int ip reset all
    netsh winhttp reset proxy
    ipconfig /flushdns

Step 3: Restart your computer

Step 4: After restart, open WSL and test connectivity:
    ping google.com

According to a Microsoft Q&A user, resetting the network stack can help resolve Ethernet and Hyper‑V problems following Windows updates.

Outcome: The network stack is reset, resolving configuration corruption.

11. Frequently Asked Questions

Why is Windows Firewall blocking WSL2 traffic?

Windows Firewall blocks WSL2 traffic because WSL2 runs as a virtual machine with its own IP address. The firewall sees traffic from virtual networks as unsolicited. According to Broadcom, the firewall cannot track applications running inside the WSL VM, so it treats the traffic as unsolicited IP traffic and blocks it.

How do I allow WSL2 through Windows Firewall?

Enable Mirrored Networking in %USERPROFILE%\.wslconfig with networkingMode=mirrored and dnsTunneling=true. Alternatively, create Hyper‑V Firewall rules with PowerShell using New-NetFirewallHyperVRule.

What is the Hyper‑V Firewall in Windows 11?

Starting in Windows 11 version 22H2, Hyper‑V Firewall is a network firewall solution that enables filtering of inbound and outbound traffic to/from containers hosted by Windows, including WSL.

What is mirrored networking mode in WSL2?

Mirrored networking mode forces WSL to mirror your Windows internet connection exactly. This makes WSL traffic look identical to your authorized Windows traffic. This resolves firewall blocks in corporate environments.

How do I create a Hyper‑V Firewall rule for WSL?

Open PowerShell as Administrator and run: New-NetFirewallHyperVRule -DisplayName "Allow WSL" -Direction Inbound -VMCreatorId '{40E0AC32-46A5-438A-A0B2-2B479E8F2E90}' -Action Allow.

Why does WSL lose connectivity after a Windows update?

Windows updates can modify firewall configurations or reset Hyper‑V settings. According to a CSDN article, a Windows update or security patch can change Hyper‑V firewall settings and block WSL network requests.

Can a third‑party firewall block WSL traffic?

Yes. Products like Symantec Endpoint Protection cannot track applications running inside the WSL VM and will block the traffic. You need to create exceptions or disable the firewall temporarily.

How do I check if Hyper‑V Firewall is enabled for WSL?

Run PowerShell as Administrator: Get-NetFirewallHyperVVMSetting -PolicyStore ActiveStore -Name '{40E0AC32-46A5-438A-A0B2-2B479E8F2E90}'. This shows the Enabled status and default actions.

What is the difference between “Connection timed out” and “Connection refused”?

According to a WSL2 troubleshooting guide, “timed out” means packets are being silently dropped by a firewall (DROP). “Refused” means no service is listening on the port. This distinction helps identify firewall issues.

Where can I find more WSL2 troubleshooting help?

Explore our Windows 11 Troubleshooting Hub and guides on WSL2 DNS resolution fix and WSL2 proxy configuration guide.

12. Conclusion

Windows Firewall WSL traffic fix is an essential skill for any developer or IT professional using Windows Subsystem for Linux 2.

This guide has covered 10 proven methods—from enabling Mirrored Networking and creating Hyper‑V Firewall rules to setting network profiles to Private, removing blocking rules, restarting ICS, and disabling third‑party firewalls.

According to Broadcom’s documentation, WSL2 traffic appears as unsolicited IP traffic to the host firewall and will be blocked unless explicit rules are created.

Start with the simplest approach — enabling Mirrored Networking on Windows 11 — and escalate to PowerShell Hyper‑V Firewall rules or third‑party firewall configuration only if needed.

For more Windows troubleshooting, explore our Windows 11 Troubleshooting Hub and guides on WSL2 DNS resolution fix and WSL2 proxy configuration guide.

With the right approach from this Windows Firewall WSL traffic fix guide, you can restore network connectivity and keep your WSL2 development environment running smoothly.