添加链接
link管理
链接快照平台
  • 输入网页链接,自动生成快照
  • 标签化管理网页链接

Endpoint Security Firewall blocks certain network traffic from WSL2/Docker instances

Endpoint Security (ENS) Firewall 10.x
  • Microsoft Windows Subsystem for Linux 2 (WSL2) - Supported starting with the ENS 10.7.0 June 2021 Update. For more information, see KB91411 - Windows Subsystem for Linux (WSL/WSL2) support .
    NOTE: This issue doesn't affect Microsoft Windows Subsystem for Linux 1 (WSL1).
  • Docker for Windows - Supported starting with the ENS 10.6.1/10.7.0 November 2020 Update. For more information, see KB90041 - Windows/Linux/Mac container support with Trellix products .
  • ENS Firewall blocks some network traffic from WSL2 or Docker instances.
    From the WSL2 console, when you execute ping google.com , the DNS resolution fails, which causes the command to fail.
    Output results:
    ping: google.com: Temporary failure in name resolution
    The ENS FirewallEventMonitor.log shows blocked network traffic entries similar to the following (application, IP addresses, and port numbers can vary).
    Time: 05/27/2021 12:32:52
    Event:  Traffic
    IP Address:  172.19.111.65
    Description:  HOST PROCESS FOR WINDOWS SERVICES
    Path:  C:\Windows\System32\svchost.exe
    Message:      Blocked Incoming UDP  -  Source  172.19.111.65 :  (39171)   Destination  172.19.96.1 : dns (53)
    Matched Rule:  Block all traffic
    Create firewall rules to allow incoming traffic on the required local ports so that the default firewall rules don't block the traffic from the WSL2/Docker instance. Examples are provided below, but aren't limited to these details. Create/modify the firewall rules for the environment as needed. Review the ENS FirewallEventMonitor.log file for further network connection details.
    Sample firewall rules to allow traffic from WSL2/Docker instances:
    Example #1:
    Allow DNS traffic from container
    Rule Action: Allow
    Direction: In
    Connection type: All types (Wired,Wireless,Virtual)
    Protocol: UDP/IPv4, UDP/IPv6
    Local port: 53

    Example #2:
    Allow inbound FTP client connections from container
    Rule Action: Allow
    Direction: In
    Connection type: All types (Wired,Wireless,Virtual)
    Protocol: TCP/IPv4, TCP/IPv6
    Local port: 21

    Example #3:
    Allow inbound HTTP/HTTPS traffic from container
    Rule Action: Allow
    Direction: In
    Connection type: All types (Wired,Wireless,Virtual)
    Protocol: TCP/IPv4, TCP/IPv6
    Local port: 80, 443