Windows Subsystem For Linux 2 Bypasses The Windows 10 Firewall

The Windows Subsystem for Linux 2 will bypass the Windows 10 firewall and any configured rules, raising security concerns for those who use the feature.

In a blog post today, Mullvad VPN explained that their product includes an ‘Always require VPN’ option that blocks Internet access via the Windows Firewall unless connected to the VPN.

After Mullvad received a tip from a user, it was determined that WSL2 Linux distributions bypass the Windows 10 firewall and its configured rules, and prevent the VPN’s  ‘Always require VPN’ security feature from working.

WSL 2 bypasses the Windows firewall

Mullvad states that they tested this issue with multiple VPN products, and the problem exists in all of them.

The problem is that this has nothing to do with VPN software and is simply how the Windows Subsystem for Linux 2 was developed.

The first version of the Windows Subsystem for Linux (WSL 1) uses a Linux-compatible kernel that translates Linux system into calls that work with the Windows NT kernel.

When using WSL 1, any network traffic is filtered through the Windows Advanced Firewall (WAF), and the Linux distro honors any configured rules.

With the release of WSL 2, Microsoft introduced a true Linux kernel operating in a Hyper-V virtual machine with a Hyper-V virtual network adapter.

Unlike WSL 1, WSL 2 traffic is sent to the correct connection, whether it’s your LAN Ethernet adapter or VPN, but it completely bypasses the Windows Firewall.

For example, I created a Windows Firewall rule that blocks all outbound traffic to port 80 (HTTP) and 443 (HTTPS), the default ports when connecting to web sites.

When enabled, this rule blocked all outbound connections to websites from Windows 10 and WSL 1 Linux distributions.

On the other hand, when I tested from a WSL 2 Ubuntu distribution, I had no problems connecting to Google.com as it bypassed the Windows Firewall’s filtering.

To make sure that this was not a strange configuration on my end, numerous other people helped Bleeping Computer test the bypass, and they confirmed that it was happening on their end as well.

Also Read: Data Storage Security Standards: What Storage Professionals Need To Know

What’s the big deal?

The main concern with WSL 2 bypassing the Windows Firewall is that no one knows about it.

If you are coming from WSL 1, you would expect your outbound connections from WSL Linux distributions to be filtered through the Windows Firewall, as that is the usual behavior.

Once you upgrade to WSL 2, though, it no longer honors your firewall configuration, and any security that relies on it no longer works.

As WSL 2 distributions can support a wide array of Linux applications, including server implementations like Docker, it does make sense to be seen as an independent operating system that does not rely on the Windows Firewall.

It is necessary, though, that users know that their configured Windows Firewall rules will be ignored.

The good news is that WSL 2 supports Linux firewall implementations like iptables that can control network traffic.

For example, after installing iptables, you can use the following command to block connections to port 80 and 443.

sudo iptables -A OUTPUT -p tcp --match multiport --dports 80,443 -j DROP

Once this rule is enabled, attempting to connect to a website from the WSL 2 Linux distro no longer works.

Also Read: 10 Principles On How To Build A Good Governance Model

The Windows Subsystem for Linux version 2 (WSL 2) is far more powerful than the first version, but with it comes security considerations that users should be aware of.

Suppose you rely on the Windows Firewall to control your network communications. In that case, you need to pay special consideration to how you configure your WSL 2 distributions so that you can replicate your configured Windows security.

BleepingComputer has contacted Microsoft with questions related to this story but has not heard back.

H/T YCombinator Hacker News
Special thanks to @CVEandABV, @5eanT, @tppetkov, @sundhaug92, and @IISResetMe for their help testing WSL 2 distros against the Windows Firewall.