161–170 of 194 posts
This is due to Hyper-V, which is being rolled out on Windows 10 and required for WSL2. The OS is now running as a VM, and virtualized programs like WSL2 are running alongside - these VMs can't control each other's traffic. It's interesting that a feature meant to improve sandboxing actually makes firewalling and VPN more difficult, in its current state. I think the the proper fix is at the Hyper-V level, which might…
Earlier quoted context omitted.
Huh - you want linux distributions to have to play with the windows firewall rules? You want windows firewall getting messed up by linux containers? These VPN authors are just idiots - let's stop over complicating things. Half the time people LIKE that they can use linux firewall features on their linux hosts for stuff.
No, I'm pretty sure that is the exact opposite of what they are saying. Maybe work on your reading comprehension?
"How it leaks
WSL2 uses Hyper-V virtual networking and therein lies the problem. The Hyper-V Virtual Ethernet Adapter passes traffic to and from guests without letting the host’s firewall inspect the packets"
So they are complaining that the linux subsystem and distribution packets are not processed by the windows firewall. I don't know what to tell you, but the idea that the windows firewall should be in the mix on a fedora distro seems a bit rediculous?
Earlier quoted context omitted.
>There's no way the banking and finance industry doesn't compete emissions wise with bitcoin not on a per transaction basis, which is the only relevant measure because the banking system supports a lot more people than bitcoin does. A single bitcoin transaction uses 610.20 kWh right now, which is comparable to the energy consumption of an average US household over 20 days.[1] Also for a comparison of scope, Tenpay, T…
Luckily there is a mechanism for resource allocation and it is called price. I pay for 1 MWh, you pay for 1MWh and it doesn't matter what we use the energy for. If you have an issue with how the energy is generated take it up with your local government.
I mean we don't really have that in the case of bitcoin, which is predominantly mined in China these days probably precisely because state subsidised energy projects have created a ton of useless energy surplus, on which bitcoin lives.
Which is ironic in and of itself, the libertarian currency de jure runs on the misallocated resources of a state planned economy lol.
Just imagine if the transactions actually costed as much as their energy consumption suggests and environmental damage priced in.
Earlier quoted context omitted.
Is Windows firewall supposed to apply to WSL? I never expected that! I'm serious - I run a different firewall on my onlinux. Can you confirm that WSL is supposed to be dealing with (the nightmare) of the windows firewall for internet access? How does fedora / ubuntu etc coordinate / know to do this?
It's somewhat unintuitive that a virtualized guest can circumvent the host's firewall/network stack when the guest doesn't have an explicitly bridged or passthrough'd physical adapter.
WSL2 uses Hyper-V, so Windows running WSL2 is running on Hyper-V, not bare metal. Being a different VM than Windows “Dom0”, Linux Kernel in WSL2 would have direct connection to Hyper-V virtual ethernet switch. I think that’s what is happening.
Earlier quoted context omitted.
No, I'm pretty sure that is the exact opposite of what they are saying. Maybe work on your reading comprehension?
Here is what they say is the "leak" "How it leaks WSL2 uses Hyper-V virtual networking and therein lies the problem. The Hyper-V Virtual Ethernet Adapter passes traffic to and from guests without letting the host’s firewall inspect the packets" So they are complaining that the linux subsystem and distribution packets are not processed by the windows firewall. I don't know what to tell you, but the idea that the windo…
Earlier quoted context omitted.
Here’s the issue with your issue: if you are using WSL2 (or other various win10 configurations involving hyper-v), then windows is not running on bare metal anymore. In this scenario, windows is just another guest operating system subject to a hypervisor. Windows is a VM, and your in-VM firewall applies to the VM in which its running. This is how you get real linux “on” windows - the on part is an illusion, trickery…
So WSL1 is reverse wine basically?
https://www.microsoft.com/en-us/research/project/drawbridge/
https://docs.microsoft.com/en-us/archive/blogs/wsl/windows-s...
https://channel9.msdn.com/Blogs/Seth-Juarez/Windows-Subsyste...
It is a bit more advanced than Wine, with first class support from NT kernel.
Whereas WSL 2 uses Hyper-V, which is a type 1 hypervisor, all OSes run as guest, including Windows itself.
This is due to Hyper-V, which is being rolled out on Windows 10 and required for WSL2. The OS is now running as a VM, and virtualized programs like WSL2 are running alongside - these VMs can't control each other's traffic. It's interesting that a feature meant to improve sandboxing actually makes firewalling and VPN more difficult, in its current state. I think the the proper fix is at the Hyper-V level, which might…
Windows 10 can control the Linux VMs traffic because it can control Hyper-V.
Earlier quoted context omitted.
I love everything about Mullvad except their device limit, which is unfortunately a deal breaker for me. 5 is completely inadequate for my use cases.
Mullvad uses the superior way of not having a real account at all - you just get a number you can "deposit" money into. It's the only way they can reliably prevent abuse like a thousand people using one number - because this way you can just track the number of open connections per account number. This is superior to tracking IP-addresses to detect fraud for obvious privacy reasons. I do a similar thing for a service…
Earlier quoted context omitted.
> windows firewall rules should not in any case be applied to traffic coming from a VM I can't agree with this. Everything is running on Windows. The VM runs on Windows and WSL exchanges data with Windows all the time. That the data on the Windows side can leak because I installed a Microsoft-approved product from the Microsoft store on a Windows box with a Microsoft firewall is unacceptable.
> Everything is running on Windows. The VM runs on Windows As far as I understand, that is not quite right. With WSL2, everything is running on Hyper-V, the VM and Windows both run in parallel on Hyper-V.
Earlier quoted context omitted.
> windows firewall rules should not in any case be applied to traffic coming from a VM I can't agree with this. Everything is running on Windows. The VM runs on Windows and WSL exchanges data with Windows all the time. That the data on the Windows side can leak because I installed a Microsoft-approved product from the Microsoft store on a Windows box with a Microsoft firewall is unacceptable.
Here’s the issue with your issue: if you are using WSL2 (or other various win10 configurations involving hyper-v), then windows is not running on bare metal anymore. In this scenario, windows is just another guest operating system subject to a hypervisor. Windows is a VM, and your in-VM firewall applies to the VM in which its running. This is how you get real linux “on” windows - the on part is an illusion, trickery…
It makes perfect sense now you say it - I knew hyper-v was a hypervisor, I knew in basic broad strokes what a hypervisor is and where it sits, but for some reason this didn't occur to me.
It could be very alarming to people running containers 'on a Windows' server, but then such people are probably more familiar with hypervisors anyway.
Is hyper-v networking still somehow configurable from the 'host', or is it undesirable for containers unless you don't want to do anything to the network (in software on that machine)?