Linux WSL 2 bypasses the Windows 10 Firewall
The Windows Subsystem for Linux 2 will bypass the Windows 10 firewall and any configured rules, raising security concerns for those who use the feature.
their product includes an 'Always require VPN' option that blocks Internet access via the Windows Firewall unless connected to the VPN.
it was determined that WSL2 Linux distributions bypass the Windows 10 firewall and its configured rules, and prevent the VPN's 'Always require VPN' security feature from working.
Linux WSL 2 bypasses the Windows firewall
The problem is that this has nothing to do with VPN software and is simply how the Windows Subsystem for Linux 2 was developed.
The first version of the Windows Subsystem for Linux (WSL 1) uses a Linux-compatible kernel that translates Linux system into calls that work with the Windows NT kernel.
When using WSL 1, any network traffic is filtered through the Windows Advanced Firewall (WAF), and the Linux distro honors any configured rules.
With the release of WSL 2, Microsoft introduced a true Linux kernel operating in a Hyper-V virtual machine with a Hyper-V virtual network adapter.
Unlike WSL 1, WSL 2 traffic is sent to the correct connection, whether it's your LAN Ethernet adapter or VPN, but it completely bypasses the Windows Firewall.
For example, Windows Firewall rule that blocks all outbound traffic to port 80 (HTTP) and 443 (HTTPS), the default ports when connecting to web sites.
When enabled, this rule blocked all outbound connections to websites from Windows 10 and WSL 1 Linux distributions.
To make sure that this was not a strange configuration on my end, numerous other people helped test the bypass, and they confirmed that it was happening on their end as well.
How to discover?
The main concern with WSL 2 bypassing the Windows Firewall is that no one knows about it.
If you are coming from WSL 1, you would expect your outbound connections from WSL Linux distributions to be filtered through the Windows Firewall, as that is the usual behavior.
After you upgrade to WSL 2, though, it no longer honors your firewall configuration, and any security that relies on it no longer works.
WSL 2 distributions can support a wide array of Linux applications, including server implementations like Docker, it does make sense to be seen as an independent operating system that does not rely on the Windows Firewall.
Users need to know that their configured Windows Firewall rules will be ignored.
WSL 2 supports Linux firewall implementations that can control network traffic that's a good news.
After installing iptables, you can use the following command to block connections to port 80 and 443.
sudo iptables -A OUTPUT -p tcp --match multiport --dports 80,443 -j DROP
After this rule is enabled, attempting to connect to a website from the
WSL 2 Linux distro no longer works.
Suppose you rely on the Windows Firewall to control your network
communications. In that case, you need to pay special consideration to
how you configure your WSL 2 distributions so that you can replicate
your configured Windows security.
The Windows Subsystem for Linux version 2 (WSL 2) is far more powerful
than the first version, with it comes security considerations that users
should be aware of.
