Endpoint Security Firewall blocks certain network traffic from WSL2/Docker instances
Technical Articles ID:
KB94601
Last Modified: 2023-03-21 10:03:02 Etc/GMT
Endpoint Security (ENS) Firewall 10.x
Microsoft Windows Subsystem for Linux 2 (WSL2) - Supported starting with the ENS 10.7.0 June 2021 Update. For more information, see
KB91411 - Windows Subsystem for Linux (WSL/WSL2) support
.
NOTE:
This issue doesn't affect Microsoft Windows Subsystem for Linux 1 (WSL1).
Docker for Windows - Supported starting with the ENS 10.6.1/10.7.0 November 2020 Update. For more information, see
KB90041 - Windows/Linux/Mac container support with Trellix products
.
ENS Firewall blocks some network traffic from WSL2 or Docker instances.
From the WSL2 console, when you execute
ping google.com
, the DNS resolution fails, which causes the command to fail.
Output results:
ping: google.com: Temporary failure in name resolution
The ENS
FirewallEventMonitor.log
shows blocked network traffic entries similar to the following (application, IP addresses, and port numbers can vary).
Time: 05/27/2021 12:32:52
Event: Traffic
IP Address: 172.19.111.65
Description: HOST PROCESS FOR WINDOWS SERVICES
Path: C:\Windows\System32\svchost.exe
Message: Blocked Incoming UDP - Source 172.19.111.65 : (39171) Destination 172.19.96.1 : dns (53)
Matched Rule: Block all traffic
Create firewall rules to allow incoming traffic on the required local ports so that the default firewall rules don't block the traffic from the WSL2/Docker instance. Examples are provided below, but aren't limited to these details. Create/modify the firewall rules for the environment as needed. Review the ENS
FirewallEventMonitor.log
file for further network connection details.
Sample firewall rules to allow traffic from WSL2/Docker instances:
Example #1:
Allow DNS traffic from container
Rule Action: Allow
Direction: In
Connection type: All types (Wired,Wireless,Virtual)
Protocol: UDP/IPv4, UDP/IPv6
Local port: 53
Example #2:
Allow inbound FTP client connections from container
Rule Action: Allow
Direction: In
Connection type: All types (Wired,Wireless,Virtual)
Protocol: TCP/IPv4, TCP/IPv6
Local port: 21
Example #3:
Allow inbound HTTP/HTTPS traffic from container
Rule Action: Allow
Direction: In
Connection type: All types (Wired,Wireless,Virtual)
Protocol: TCP/IPv4, TCP/IPv6
Local port: 80, 443