Using WSL should be a very last resort anyway. Just use Linux straight on your hardware if you have a choice and ditch Windows.
Linux under WSL2 can be leaking
11–20 of 194 posts
Re: Linux under WSL2 can be leaking
#12Is anyone really Surprised by this? If you want security then you dont use Windows. Windows subsystem for linux is a joke. Just install linux like everyone else
Re: Linux under WSL2 can be leaking
#13We have tested a few other VPN clients from competitors and found that all of them leak in the same way. The way Microsoft has implemented virtual networking for Linux guests makes it very difficult to properly secure them.
Sometimes that's a feature. At least with VirtualBox I have made the experience that NAT virtual networking leads to significant slowdown on a linux guest compared to bridging one of the host's ethernet adapters. I suspect that's due to windows' firewall software or similar things happening in the host system. It also means one less hop to debug when it comes to network issues.
I think the question is whether you consider a VM more like another machine in your network that merely happens to run on the same hardware or a part of the host system.
Re: Linux under WSL2 can be leaking
#14Using WSL should be a very last resort anyway. Just use Linux straight on your hardware if you have a choice and ditch Windows.
This. WSL is like supergluing a BMW motor to the hood of a burned out 1999 Honda Civic. Its still going to run like garbage no matter how much you put lipstick on that pig
Re: Linux under WSL2 can be leaking
#15We have tested a few other VPN clients from competitors and found that all of them leak in the same way. The way Microsoft has implemented virtual networking for Linux guests makes it very difficult to properly secure them.
It’s a shit show. Can’t trace packets either via wireshark on the host and tcpdump doesn’t work on the guest. I’ve gone back to virtualbox and eviscerated WSL. Another total waste of my life.
Better yet just install linux and if you need windows, use it in a locked down VM
Re: Linux under WSL2 can be leaking
#16A bit off topic, but this sort of transparency is why I don't mind paying $6 / mo for a vpn when mullvad's competitors are much cheaper. Their wireguard support is great, and their speeds are much faster than what I got through openVpn on pia.
Re: Linux under WSL2 can be leaking
#17Earlier quoted context omitted.
I would think that anyone who relies on a VPN for safety or is really particularly security conscious (1) isn't using Windows 10, (2) has networking disabled if they are using it, for example, in a VM, and (3) is probably using a dedicated device like a Slate router or pfSense box as their VPN point.
With the way these companies advertise, they make it seem like a silver bullet for internet anonymity. Almost every YouTube video I've seen recently seems to have one as a sponsor, and I am sure they are picking up many non-technical customers. I don't think users of NordVPN, ExpressVPN, MullvadVPN et al. are as sophisticated as you think.
The way Express VPN's ad copy reads it seems their own people don't understand the difference between encryption and traffic tunneling (much less encryption in transit versus encryption at rest).
Re: Linux under WSL2 can be leaking
#18Potential workaround: is it possible to configure VPN clients to _ignore_ the WSL2 runtime and instead run a VPN client inside WSL2? That way the Linux network config can deal with the Linux side of things and the Windows network config can deal with the Windows VPN routing. Of course you can just configure OpenVPN inside WSL2 and also run a VPN on the desktop but that's tunnels in tunnels and that way madness and ne…
If I read it correctly that wouldn't be tunnels in tunnels. It would be 2 separate tunnels side by side. Which is not necessarily a bad thing.
WSL2 is basically a VM and any VM which binds directly to the Adapter (e.g. not NAT mode) will have the same behaviour. In some cases you'd even want it to do this.
Re: Linux under WSL2 can be leaking
#19This is the exact reason I didn't try running weird VPN configs like this. The reliable way is to run Linux inside a VirtualBox and have it connected to VPN on its own.
Currently, I run Linux on a Xen domU and configure VPN client inside the guest.
PS: I don't want all my traffic to go through VPN. Especially things like Netflix or Youtube where VPNs are blocked (and VPN BW is lower anyway).
Re: Linux under WSL2 can be leaking
#20We have tested a few other VPN clients from competitors and found that all of them leak in the same way. The way Microsoft has implemented virtual networking for Linux guests makes it very difficult to properly secure them.
It’s a shit show. Can’t trace packets either via wireshark on the host and tcpdump doesn’t work on the guest. I’ve gone back to virtualbox and eviscerated WSL. Another total waste of my life.
Conceptually this makes sense. It doesn't really run Under windows, it runs beside windows. Unlike WSL1 which was basically part of Windows. It's strange tcpdump doesn't run though as WSL2 is running a real kernel.
Personally I really liked the resource efficient WSL1 approach and I lament that they dropped it. But I know for some usecases (e.g. docker) a real Linux kernel was needed.