Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Linux under WSL2 can be leaking

mullvad.net

Post reply on HN
Print view View original

131–140 of 194 posts

Re: Linux under WSL2 can be leaking

#131

Post by fphhotchips »

mehrdadn wrote: post #123
donor20 wrote: post #103

The idea of the a linux distribution is going to be using the WINDOWS firewall?? seems a bit crazy to me. I expect the distributions on WSL to use their own firewall - that's half of the fun of using WSL. PLEASE don't push fake news like this that results in distribution on WSL having to deal with / modify the window firewall - that would be a total nightmare!

My guess is people are confused because Microsoft has marketed WSL2 as a replacement for WSL1, and it makes sense for WSL1 to go through the Windows firewall, so people assumed WSL2 would behave similarly.

If nothing else, I now understand that I'm going to have to read up more on how WSL2 actually works, because I found WSL1 to be a really elegant way of running Linux on Windows without having a whole bunch of virtualisation in place, but it sounds like there's more virtualisation now, and also Hyper V networking has previously broken my network stack.

Re: Linux under WSL2 can be leaking

#132

Post by dataflow »

fphhotchips wrote: post #131
mehrdadn wrote: post #123

Earlier quoted context omitted.

My guess is people are confused because Microsoft has marketed WSL2 as a replacement for WSL1, and it makes sense for WSL1 to go through the Windows firewall, so people assumed WSL2 would behave similarly.

If nothing else, I now understand that I'm going to have to read up more on how WSL2 actually works, because I found WSL1 to be a really elegant way of running Linux on Windows without having a whole bunch of virtualisation in place, but it sounds like there's more virtualisation now, and also Hyper V networking has previously broken my network stack.

tl;dr is WSL2 is just a VM running under Hyper-V. The host is hence Hyper-V, not Windows.

Re: Linux under WSL2 can be leaking

#133

Post by smarx007 »

gerdesj wrote: post #117
closeparen wrote: post #50

Earlier quoted context omitted.

A good reminder that you really want proxying done on a separate device (router, Raspberry Pi, etc) physically between the endpoint and the internet.

This sounds like working as designed and not a flaw. If your Linux box needs a firewall then put one on it. As the article says, the VM is using Hyper-V networking so it is likely that the connection is either bridged with a virty software switch or is NATted in some way but with a short cut through the host firewall. If the VM has an IP on your LAN it is bridged and if it doesn't and you don't have to fiddle with yo…

I think the key idea is that Mullvad client changes firewall config on the fly to insert a 2nd highest prio rule "deny outgoing" allowing outgoing internet access only to itself until the VPN tunnel is established and then withdraws it automatically afterwards. So, a generic firewall advice is not applicable here as it's used in quite a specific way. If Microsoft does not fix the problem described in the blog post, I assume the easiest way would be to introduce some kind of daemon in a Windows client that a slave client tool installed in WSL env would have to connect to or the other way around to mirror a firewall config inside the Linux machine. And that will only work on recent versions, see https://github.com/microsoft/WSL/issues/4212#issue-459183662

UPD: I think it will be resolved in a much neater way soon https://github.com/microsoft/WSL/issues/4277#issuecomment-69...

Re: Linux under WSL2 can be leaking

#134

Post by zokier »

rbanffy wrote: post #125
logical_person wrote: post #79

Earlier quoted context omitted.

vmswitch is configurable by the host. these VPN authors have no clue what they're doing, windows firewall rules should not in any case be applied to traffic coming from a VM. ridiculous.

> windows firewall rules should not in any case be applied to traffic coming from a VM I can't agree with this. Everything is running on Windows. The VM runs on Windows and WSL exchanges data with Windows all the time. That the data on the Windows side can leak because I installed a Microsoft-approved product from the Microsoft store on a Windows box with a Microsoft firewall is unacceptable.

> Everything is running on Windows. The VM runs on Windows

As far as I understand, that is not quite right. With WSL2, everything is running on Hyper-V, the VM and Windows both run in parallel on Hyper-V.

Re: Linux under WSL2 can be leaking

#135

Post by xnyan »

rbanffy wrote: post #125
logical_person wrote: post #79

Earlier quoted context omitted.

vmswitch is configurable by the host. these VPN authors have no clue what they're doing, windows firewall rules should not in any case be applied to traffic coming from a VM. ridiculous.

> windows firewall rules should not in any case be applied to traffic coming from a VM I can't agree with this. Everything is running on Windows. The VM runs on Windows and WSL exchanges data with Windows all the time. That the data on the Windows side can leak because I installed a Microsoft-approved product from the Microsoft store on a Windows box with a Microsoft firewall is unacceptable.

Here’s the issue with your issue: if you are using WSL2 (or other various win10 configurations involving hyper-v), then windows is not running on bare metal anymore. In this scenario, windows is just another guest operating system subject to a hypervisor. Windows is a VM, and your in-VM firewall applies to the VM in which its running.

This is how you get real linux “on” windows - the on part is an illusion, trickery to make using linux transparent and integrated. By comparison, WSL1, which is still supported, is “just” (it’s actually pretty impressive in its own right) syscalls translated to the NT kernel.

Microsoft could do a better job communicating this, but I don’t think any of their design decisions are bad in this regard.

Re: Linux under WSL2 can be leaking

#136

Post by shmerl »

filmgirlcw wrote: post #96
shmerl wrote: post #63

Earlier quoted context omitted.

If you are playing games on Linux, WSL doesn't help anything for sure, it only adds overhead.

But legit question, why would you want to play a game in Linux and not in Windows? I’m not even being rhetorical, I’m genuinely curious if there are games with significantly better performance under Linux (and I’m assuming we would have to be talking about using an AMD card so I’m also curious if that performance under Linux is better than an Nvidia card under either OS), because maybe there are and I’m just totally…

Because Linux is my OS of preference in general, so I play games on it as well.

But it's good to clarify a few things to avoid confusion:

1. You can use Nvidia on Linux, including for gaming. Nvidia's problems are related to lack of support for modern features (Wayland use cases and so on) caused by the fact that their blob driver in not upstreamed. But it's usable otherwise.

2. AMD drivers are open source and upstreamed, that's why it's a common preference for Linux gamers. Performance of AMD is very good on Linux (amdgpu, radeonsi, radv/aco and etc. all provide very good performance). That stereotype that "Nvidia drivers are faster" has been false for quite a while already. When comparing same classes of cards, AMD is totally on par with Nvidia if not better.

3. Besides native games, you can play many Windows only games using Wine + dxvk / vkd3d, Proton and etc. Performance in such cases usually is slightly lower than on Windows, but not significantly. The only problems now remain mostly with intrusive, rootkit styled "anti-cheats" that don't work in Wine, but I personally wouldn't even touch such games, so that doesn't bother me.

To sum up - using Linux for gaming is totally doable, as long as you want to use Linux in the first place and don't want to use Windows.

Re: Linux under WSL2 can be leaking

#137

Post by gerdesj »

smarx007 wrote: post #133
gerdesj wrote: post #117

Earlier quoted context omitted.

This sounds like working as designed and not a flaw. If your Linux box needs a firewall then put one on it. As the article says, the VM is using Hyper-V networking so it is likely that the connection is either bridged with a virty software switch or is NATted in some way but with a short cut through the host firewall. If the VM has an IP on your LAN it is bridged and if it doesn't and you don't have to fiddle with yo…

I think the key idea is that Mullvad client changes firewall config on the fly to insert a 2nd highest prio rule "deny outgoing" allowing outgoing internet access only to itself until the VPN tunnel is established and then withdraws it automatically afterwards. So, a generic firewall advice is not applicable here as it's used in quite a specific way. If Microsoft does not fix the problem described in the blog post, I…

I assume you mean this because I can't find any mention in the article about 2nd highest prio rules:

"How it leaks WSL2 uses Hyper-V virtual networking and therein lies the problem. The Hyper-V Virtual Ethernet Adapter passes traffic to and from guests without letting the host’s firewall inspect the packets in the same way normal packets are inspected. The forwarded (NATed) packets are seen in the lower layers of WFP (OSI layer 2) as Ethernet frames only. This type of leak can happen to any guest running under Windows Sandbox or Docker as well if they are configured to use Hyper-V for networking."

That is how virtual machines are supposed to work. Hyper-V is a virtualisation thing. Whatever Mullvad is doing is immaterial - they are only worrying about the host. If you use full on virty stuff, you need to treat each VM as a VM, not a container.

Re: Linux under WSL2 can be leaking

#138

Post by totony »

marcan_42 wrote: post #97
Jonnax wrote: post #39

Earlier quoted context omitted.

Why? In my opinion Linux desktop environments are terrible compared to Windows. How's the display scaling these days? Is it still a better experience to run a 4k monitor at a lower resolution? What's the Nvidia driver situation? Still janky because their drivers are doing their own thing?

I just switched to a 4K monitor last week. Set display scaling to 1.5x in the KDE settings, logged in again, and everything looks great and scales cleanly. I haven't noticed any weird artifacts or bizarre UIs yet. It just works. Except Spotify, that needs a command line flag to set the scale factor, but that app is well known to be half-assed on Linux (they also don't support input methods, so searching for Japanese…

If you have different DPI needs, xorg has a lot of difficulty with it. works on windows.

Wayland doesn't work on nvidia and is missing some features too. Linux desktop sucks.

Re: Linux under WSL2 can be leaking

#139

Post by maple3142 »

A little bit off-topic, but I have a problem with WSL2 and Wireguard for Windows. When I enable Wireguard for Windows, WSL2's default DNS server will stop working, but directly setting dns server to 8.8.8.8, 1.1.1.1 or something similar works.

Re: Linux under WSL2 can be leaking

#140

Post by ani-ani »

This is due to Hyper-V, which is being rolled out on Windows 10 and required for WSL2. The OS is now running as a VM, and virtualized programs like WSL2 are running alongside - these VMs can't control each other's traffic. It's interesting that a feature meant to improve sandboxing actually makes firewalling and VPN more difficult, in its current state. I think the the proper fix is at the Hyper-V level, which might need to explicitly manage firewall and VPN features.
Post reply on HN