43

I have a Ubuntu-20.04 Version 2 WSL running on my Windows 10 Laptop. Everything works fine, I have internet connection. But only as long as I am not connected to a VPN network.

If I connect to my the network of my university using Cisco AnyConnect, I can no longer connect to the internet on WSL, while everything works fine using e.g. firefox in the windows system. I get: ping: google.de: Temporary failure in name resolution

I already tried the following:

Open windows cmd in admin mode and type these commands:

netsh winsock reset
netsh int ip reset all
netsh winhttp reset proxy
ipconfig /flushdns
reboot

That worked once, I had access to the internet. But as soon as I disconnected the VPN connection and connected again, I had the same problem all over again. I tried to just execute the commands again and rebooted, but now thats not working anymore.

So I really do not know what else to do. I really need to use WSL while being connected via VPN

2
  • Nothing working for me, with CheckPoint Endpoint Security. Any specific hints for this one?
    – Alberto
    Apr 18, 2022 at 13:14
  • There's a new fix as of September 2023 -- please see my answer below.
    – jkr
    Nov 30, 2023 at 13:44

13 Answers 13

40

There is an issue with DNS Forwarding in WSL2 when using VPN (see github Issue). Plus there is a issue with the Cisco AnyConnect. So here is a workaround for these problems. Should work for Ubuntu and Debian.

Workaround (new - automatic)

This solution is automatic and was created by EdwardCooke (see https://www.frakkingsweet.com/automatic-dns-configuration-with-wsl-and-anyconnect-client/). This is just the first part of his solution updating resolv.conf when starting WSL.

  1. Re-enable auto generation of resolv.conf (if disabled)

    by commented the disable with #

    sudo nano /etc/wsl.conf
    
    #[network]
    #generateResolvConf = false
    
  2. Create the script

    sudo nano /bin/vpn-dns.sh
    
    #!/bin/bash
    
    echo "Getting current DNS servers, this takes a couple of seconds"
    
    /mnt/c/Windows/System32/WindowsPowerShell/v1.0/powershell.exe -Command '
    $ErrorActionPreference="SilentlyContinue"
    Get-NetAdapter -InterfaceDescription "Cisco AnyConnect*" | Get-DnsClientServerAddress | Select -ExpandProperty ServerAddresses
    Get-NetAdapter | ?{-not ($_.InterfaceDescription -like "Cisco AnyConnect*") } | Get-DnsClientServerAddress | Select -ExpandProperty ServerAddresses
    ' | \
            awk 'BEGIN { print "# Generated by vpn fix func on", strftime("%c"); print } { print "nameserver", $1 }' | \
            tr -d '\r' > /etc/resolv.conf
    clear
    
  3. Make it executable/run as sudo

    sudo chmod +x /bin/vpn-dns.sh
    echo "$(whoami) ALL=(ALL) NOPASSWD: /bin/vpn-dns.sh" | sudo tee /etc/sudoers.d/010-$(whoami)-vpn-dns
    
  4. Make it run on wsl startup

    echo "sudo /bin/vpn-dns.sh" | sudo tee /etc/profile.d/vpn-dns.sh
    

You can also run it manually: sudo /bin/vpn-dns.sh

Workaround (old manual)

  1. Find out nameserver with windows powershell (during VPN Session)

    nslookup
    

    You'll get the IPv4 adress of your corporate nameserver Copy this address.

  2. Disable resolv.conf generation in wsl:

    sudo nano /etc/wsl.conf
    

    copy this text to the file (to disable resolve.conf generation, when wsl starts up)

    [network]                                                                        
    generateResolvConf = false
    
  3. In wsl Add your corporate nameserver to resolv.conf

    sudo nano /etc/resolv.conf
    

    Remove other entries and add your corporate nameserver IP (if you have a secondary nameserver, add it in a separate line)

    • nameserver X.X.X.X (where X.X.X.X is your address obtained in step 1)
  4. Set your VPN adapter (if you have Cisco AnyConnect) open a admin powershell

    • Find out your VPN adapter name: Get-NetIPInterface (in my case: "Cisco AnyConnect")
    • Set adapter metric (Replace -Match with your name), in my case I have to run this after ever reboot or VPN reconnect:
    Get-NetAdapter | Where-Object {$_.InterfaceDescription -Match "Cisco AnyConnect"} | Set-NetIPInterface -InterfaceMetric 6000
    

    (What is interface metric: Used to determine route, windows use interface with lowest metric)

  5. Restart wsl in powershell: wsl.exe --shutdown

  6. Test it in wsl run: wget google.com - if this command works, you are done.

In my case I get DNS issues when try to connect to internal stuff via browser (on Windows 10, f.e.: intranet), caused by the high metric value set in step 4 (basically kind of disabling VPN Route). So here is the workaround for the workaround:

  1. Check your default metric (of VPNs Interface) in powershell (replace -Match with your interface name)
Get-NetAdapter | Where-Object {$_.InterfaceDescription -Match "Cisco AnyConnect"} | Get-NetIPInterface
  1. When running into problems on Windows 10 restore this default value with admin powershell (replace value at the end with your default value):
Get-NetAdapter | Where-Object {$_.InterfaceDescription -Match "Cisco AnyConnect"} | Set-NetIPInterface -InterfaceMetric 1
12
  • 1
    This solution helped me! I didn't succeed using corporate DNS server found by nslookup but simply filling Google DNS server 8.8.8.8 in /etc/resolv.conf worked.
    – Frank Wang
    Dec 31, 2021 at 0:21
  • 1
    Can someone tell me what this does and why this is working? Is it a routing issue? How would one automate this to work automatically? (windows noob)
    – Timo
    Jan 24, 2022 at 9:48
  • 1
    gist.githubusercontent.com/MatMercer/… captures this. I had to delete a dangling reference to /etc/resolve.conf ; and use absolute path to poweshell.exe
    – Jayan
    Aug 23, 2022 at 6:13
  • 1
    /etc/wsl.conf change mentioned here has no real use . The resolv.conf will be recreated. [WSL 2 keeps overwriting resolv.conf ](github.com/microsoft/WSL/issues/5420). The status says closed but I had to use work around mentioned in the same page
    – Jayan
    Aug 26, 2022 at 4:20
  • 1
    Why would I get "/bin/vpn-dns.sh: line 11: /etc/resolv.conf: Permission denied" when trying this script?
    – pak
    Aug 17, 2023 at 12:39
10

For Windows 11 there was an update to WSL2 in September 2023 with (hopefully) a fix for this issue. Create a file %UserProfile%\.wslconfig with the content below, and then restart wsl. Run wsl.exe --shutdown. I also had to restart my computer but I am not sure if that is always necessary.

[wsl2]
networkingMode=mirrored
dnsTunneling=true

After changing these settings restart WSL (i.e. run wsl --shutdown; just closing the running distribution isn't sufficient).

Update 2024-02-27

These settings should now fall under [wsl2] instead of [experimental]. Related docs

References:

4
  • 1
    Unfortunately the networkingMode=mirrored and dnsTunneling=true settings only work if you're on Windows 11 :( Jan 29 at 1:08
  • 2
    Thx really saved my day :D
    – Chris
    Mar 6 at 12:30
  • I've just updated to windows 11 and I see these messages: > wsl: Mirrored networking mode is not supported, falling back to NAT networking > wsl: DNS Tunneling is not supported
    – Piotrek
    Mar 24 at 13:02
  • Not working with Wsl2, Windows and OpenVPN, both /etc/wsl.conf or global .wslconfig May 15 at 1:27
9

This seems to be a bug in WSL 2, see https://github.com/microsoft/WSL/issues/4277.

The workaround offered here worked for me: Uninstall the Cisco AnyConnect client and install the version from the Microsoft Store.

2
  • 1
    This worked for me. Apr 12, 2022 at 22:22
  • This should be the accepted answer. Aug 26, 2022 at 22:24
4

The easiest workaround (before either Microsoft or Cisco come up with a permanent fix) is to launch WSL before connecting to the VPN:

wsl --shutdown
# disconnect VPN
wsl
# connect VPN again

Works on Windows 10 with WSL2+Ubuntu 20.04 and Cisco AnyConnect.

2
  • 4
    Doesn't work for me. Apr 12, 2022 at 22:19
  • Also does not work for me. Aug 14, 2022 at 16:48
1

I solved the problem. open Microsoft Store -> Search and Install Anyconnect -> the vpn connection now works with WSL2.

1
  • 2
    Welcome to Super User. Your answer got flagged for review since it was your first post. In my opinion, this needs a lot more detail. The person asking the original question clearly had AnyConnect installed already, so telling them the answer is to install AnyConnect doesn't seem to make a lot of sense without more information. Aug 18, 2021 at 21:46
1

In my case, i set VPN network interface metric to 6000 and both vpn and internet within wsl is now working: Get-NetAdapter | Where-Object {$_.InterfaceDescription -Match "Cisco AnyConnect"} | Set-NetIPInterface -InterfaceMetric 6000

Cisco AnyConnect mentioned in command above is my VPN. yours could be different. along with the metric number.

and then used following to fix the DNS:
echo "nameserver 8.8.8.8" | tr -d '\r' | sudo tee /etc/resolv.conf
echo "nameserver 8.8.4.4" | tr -d '\r' | sudo tee /etc/resolv.conf

You can also put DNS fix into .bashrc

1

The problem is that the VPN Ethernet Adaptor's DNS server settings are not taken by the WSL. These steps worked for me to add these settings manually:

  1. cd ~/../../etc (go to etc folder in WSL).
  2. echo "[network]" | sudo tee wsl.conf (Create wsl.conf file and add the first line).
  3. echo "generateResolvConf = false" | sudo tee -a wsl.conf (Append wsl.conf the next line).
  4. wsl -l (Get the . Debian-XX or Ubuntu-XX (Default) etc.)
  5. wsl --terminate (Terminate WSL in Windows cmd, from the step 4).
  6. cd ~/../../etc (go to etc folder in WSL).
  7. sudo rm -Rf resolv.conf (Delete the resolv.conf file).
  8. In windows cmd, ps or terminal with the vpn connected do: Get-NetIPInterface or ipconfig /all for get the dns primary and secondary. Look for Ethernet adaptor with Description "Cisco AnyConnect...". From under it take values for DNS Servers. It has primary and secondary DNS server IPs.
  9. Use commands in next two steps by replacing X.X.X.X for values of Primary and Secondary DNS server IPs respectively
  10. echo "nameserver X.X.X.X" | sudo tee resolv.conf (Create resolv.conf and append the line.)
  11. echo "nameserver X.X.X.X" | sudo tee -a resolv.conf (Append the line in resolv.conf)
  12. wsl --terminate (Terminate WSL in Windows cmd, from the step 4).
  13. sudo chattr +i resolv.conf
  14. And finally in windows cmd, ps or terminal: Get-NetAdapter | Where-Object {$_.InterfaceDescription -Match "Cisco AnyConnect"} | Set-NetIPInterface -InterfaceMetric 6000

Credit: @MartinCaccia, @yukosgiti, @machuu and @AlbesK: https://github.com/microsoft/WSL/issues/4277 https://github.com/microsoft/WSL/issues/4246


Original resoltuion:

  1. Create a file: /etc/wsl.conf.
  2. Put the following lines in the file in order to ensure the your DNS changes do not get blown away

[network] generateResolvConf = false

  1. In a cmd window, run wsl --shutdown
  2. Restart WSL2
  3. Create a file: /etc/resolv.conf. If it exists, replace existing one with this new file.
  4. Put the following line in the file

nameserver 8.8.8.8 # Or use your DNS server instead of 8.8.8.8 which is a Google DNS server

  1. Repeat step 3 and 4. You will see git working fine now.

Credit: https://github.com/microsoft/WSL/issues/4285#issuecomment-522201021 Sign up for free

Steps are also documented here: https://gist.github.com/akshayhiremath/1b3bff527b3eca6cd41cf60ce88f3a56/8570f9fb4dbd681fc7aabcc817fa18cbab5f1e86#file-fix-wsl2-dns-resolution

I have forked and updated the steps by https://gist.github.com/coltenkrauter to make them easier.

5
  • 1
    Do not make people follow a link to learn the answer. Include ALL the steps in the solu here in this post, or this will be removed for being a link-only answer. Links should be left for attribution or further research purposes only. May 2, 2022 at 5:11
  • Please quote the essential parts of the answer from the reference link(s), as the answer can become invalid if the linked page(s) change.
    – DavidPostill
    May 2, 2022 at 6:45
  • Detailed steps are added May 2, 2022 at 13:37
  • I have maintained the links at the end of the answer as a reference. If user follows steps in the answer the problem solves May 2, 2022 at 13:58
  • Not working with openvpn May 15 at 1:30
1

Another method that is reliable is to use wsl-vpnkit (https://github.com/sakai135/wsl-vpnkit).

The basic setup installs a WSL distro to handle network traffic from your WSL 2 distros (and containers).

Works with Cisco AnyConnect configuration that restricts local network traffic.

0

This might be obvious but I did not think of this. Another workaround is to install VPN in wsl if that is an option for the VPN you are using.

0

I was skeptical at first about hsq_roy's method, but since none of the workarounds worked for me I just did what hsq_roy was suggesting.

  1. I deleted my Cisco Anyconnect client
  2. I reinstalled it via Windows Store.
  3. I opened Anyconnect and clicked on manage VPN which forwarded me to the Windows System settings.
  4. I set up a new VPN connection within the Windows settings choosing Anyconnect instead of Windows (integrated).
  5. I started WSL and it connected to the internet while using a VPN in Windows. It works perfectly fine for me, with no issues whatsoever.
2
  • 1
    Your answer could be improved with additional supporting information. Please edit to add further details, such as citations or documentation, so that others can confirm that your answer is correct. You can find more information on how to write good answers in the help center.
    – Community Bot
    Nov 9, 2021 at 16:02
  • 1
    Edit your answer to remove the quoted text - totally unnecessary. The @ don't work in an answer anyway.. so NotTheDr01ds may never see your message/reply. Also, state your process using list formatting to make it clearer. Nov 9, 2021 at 16:46
0

The answer from @kraego worked for me.

I was though unable to make out the adapter from Get-NetIPInterface

but I used instead Get-NetAdapter

And I verified it by looking at the results with and without the VPN connection active.

1
  • Your answer could be improved with additional supporting information. Please edit to add further details, such as citations or documentation, so that others can confirm that your answer is correct. You can find more information on how to write good answers in the help center.
    – Community Bot
    Dec 22, 2021 at 12:46
0

I had the same problem (no internet when VPN connected) running WSL version 2. To resolve I uninstalled Ubuntu, then from powershell set the default version to WSL 1 when installing a new distro wsl --set-default-version <Version#> then re-installed Ubuntu. That resolved the issue. To check the WSL versions being used for each distro, from powershell enter wsl -l -v

2
  • This does not really explain the reason you had to run WSL1 instances instead of WSL2. Downgrading to an inferior version of WSL seems like a workaround and an overall inferior solution compared to the other solutions outlined in other answers.
    – Ramhound
    Sep 3, 2022 at 5:40
  • 1
    You can simply convert an existing wsl2 install to a wsl1 install with wsl --set-version [NAME] 1 Nov 14, 2022 at 22:25
0

so this works the best way possible!

after connecting to your vpn

wsl


  • open /etc/wsl.conf, add the following
[network]
generateResolvConf=false
  • sudo cp /etc/resolv.conf /etc/resolv.conf.new #this is to revert back to the resolv.conf of the wsl when vpn is closed
  • nano /etc/resolv.conf now add the following:
nameserver <XXX.XXX.XXX.XXX> 
#<dns ip of your vpn> 
#to find this run ipconfig /all in windows powershell admin

windows powershell

 wsl --shutdown
 wsl 
 Get-NetAdapter | Where-Object {$_.InterfaceDescription -Match "Cisco AnyConnect"} | Set-NetIPInterface -InterfaceMetric 6000
1
  • How is this different from other answers?
    – Toto
    Oct 30, 2023 at 10:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .