<story><title>Linux under WSL2 can be leaking</title><url>https://mullvad.net/en/blog/2020/9/30/linux-under-wsl2-can-be-leaking/</url></story><parent_chain><item><author>closeparen</author><text>A good reminder that you really want proxying done on a separate device (router, Raspberry Pi, etc) physically between the endpoint and the internet.</text></item><item><author>smarx007</author><text>The title is wrong. The VPN traffic does NOT leak. What leaks is the traffic that the VPN software tries to block when the VPN connection is not active. Mullvad uses Windows Firewall to block all internet access if VPN is not active (if the user configured so) and WSL2 bypasses this by not going through Windows Firewall. When the VPN is active, WSL2 traffic IS tunneled through the VPN.&lt;p&gt;UPD: The solution may be to have Windows Firewall rules apply to WSL2 or have Mullvad control Linux internet access through on-the-fly UFW settings update or completely disconnect internet (but that likely does not work nicely and is why Mullvad went for the Windows Firewall based solution in the first place).</text></item></parent_chain><comment><author>gerdesj</author><text>This sounds like working as designed and not a flaw.  If your Linux box needs a firewall then put one on it.  As the article says, the VM is using Hyper-V networking so it is likely that the connection is either bridged with a virty software switch or is NATted in some way but with a short cut through the host firewall.  If the VM has an IP on your LAN it is bridged and if it doesn&amp;#x27;t and you don&amp;#x27;t have to fiddle with your internet router then NAT is in play.&lt;p&gt;Linux has lots of options for firewalling.  For Windows sysadmins, firewalld with a GUI could be a reasonably familiar option.  Failing that, ufw is quick and reasonably easy for simple use cases.  If you are feeling macho, then roll your own with iptables or nftables.  The last time I did that properly was with ipchains ...</text></comment>
<story><title>Linux under WSL2 can be leaking</title><url>https://mullvad.net/en/blog/2020/9/30/linux-under-wsl2-can-be-leaking/</url></story><parent_chain><item><author>closeparen</author><text>A good reminder that you really want proxying done on a separate device (router, Raspberry Pi, etc) physically between the endpoint and the internet.</text></item><item><author>smarx007</author><text>The title is wrong. The VPN traffic does NOT leak. What leaks is the traffic that the VPN software tries to block when the VPN connection is not active. Mullvad uses Windows Firewall to block all internet access if VPN is not active (if the user configured so) and WSL2 bypasses this by not going through Windows Firewall. When the VPN is active, WSL2 traffic IS tunneled through the VPN.&lt;p&gt;UPD: The solution may be to have Windows Firewall rules apply to WSL2 or have Mullvad control Linux internet access through on-the-fly UFW settings update or completely disconnect internet (but that likely does not work nicely and is why Mullvad went for the Windows Firewall based solution in the first place).</text></item></parent_chain><comment><author>vmception</author><text>Does anyone have a raspberry pi hardened disk image for this? I just don&amp;#x27;t have time to troubleshoot all these things anymore</text></comment>