Adding IPV6 support to WSL 2 distros

[craigloewen-msft]

This discussion thread is an offshoot of this issue thread: #4518 for any folks who want to continue sharing work arounds / ideas for this space.

Any updates on the progress for this feature will be posted back in the main issue on the 'Issues' board.

[TurnOffNOD]

Maybe 3 most important and desperate features are ipv6 full support, fixed ip support (WSL adapter can be fixed and not recreated) and bridged networking (the same ip or under the same router with host) in wsl2.

[paulstelian97]

SLAAC will allow stable addresses, never managed to properly configure privacy extensions on a Linux system (whether WSL or not). I explicitly mentioned TAP because that means bridged.

Still, without NDP proxy it won't work well. NAT is ugly when it comes to IPv6 and shouldn't be necessary.

[themiron]

NAT is ugly when it comes to IPv6 and shouldn't be necessary.

Well, its ugly only when missaplied (lot of cases - attempt to replace firewall, do proper prefix delegation, etc).
Since it's a tool not a silver bullet, it's pretty valid by design and desired when exactly network address translation is only required - when connections must be originated from one particular address (not prefix or something).
In brief:

• Shared L2 network: NAT is not necessary, NDP proxy not necessary, L2 bridging is enough
• Wireless L2 network: NDP proxy may help tho not always
• P2P L3 network (or other vpn client/ad-hoc): depending on address assignment only NAT can be usable with one /128 address for a route

Taking into account common use of WSL host is desktop - there may be different IPv6 routes via different interfaces, incl. default via Wireless and specific via VPN (hello, COVID-19), so both NDP proxy and NAT should work.

[paulstelian97]

L2 bridging would be best but some WSL shenanigans are incompatible with it.

@themiron I actually get now how NAT would be nice. However some use cases don't work well with NAT. Host has public IP but guest doesn't? How about me trying to run some server on my WSL? Do I have to manually port forward on the host, or rely on the quirky WSL based listener?

[themiron]

However some use cases don't work well with NAT. Host has public IP but guest doesn't? How about me trying to run some server on my WSL? Do I have to manually port forward on the host, or rely on the quirky WSL based listener?

Following can be possible with WSL2:

• Some app starts to listen on interface/address/proto
• Since WSL kernel knows the listening socket list, this info can be passed (probably filtered) via vsock to the host WSL process
• With no NAT host's WSL process starts to listen same proto & ports and to proxy that into WSL
• With NAT possible, just NAT mapping can be created basing on the same info and incoming packets can be simply routed into WSL net keeping the rest of net subsystem as is

Another option, IPv6 world has LW4over6/MAP-E/MAP-T (IPv4 tunnel over IPv6 basically), the latter ones supports one IPv4 address sharing between multiple "clients" - using some math each client gets own non-crossing port ranges, and upstream gateway forwards packet to exact client basing on it's id and port.
Kind of same mechanics can be applied to Host & WSL to share same L3 addresses, this way WSL gets all the interfaces and addresses inside but will not able to listen on (and connect from) ports resered to the host and/or used by the host. Can be a good trade off between non-working IPv6 at all and loosing some port space for incoming connections, while usually most of outgoing are dynamicly ranged.

[tidux]

I'd like to see WSL2 default to full bridging if the host is connected to wired networks only, and do some sort of NAT or proxying if the host is on wifi/VPN/cellular.

[Hades32]

Are there any workarounds, however crude, out there? It's become impossible for me to ssh into my home network, as that is only exposed via IPv6... :(

[paulstelian97]

Maybe some things you could do via SSH but definitely not that well integrated.

[TheTrio]

Whenever I have need to ssh to an IPv6 address, I just use powershell. Not ideal, but pretty straightforward. Hopefully WSL2 sees IPv6 support soon.

[fgfg163]

I created a hyper-v virtual machine running openwrt x86, wsl2 uses wireguard to connect to openwrt, and set up port forwarding. Now I can access wsl2 using openwrt's ip.

[fgfg163]

I use frp instead of wireguard and find that the performance is better, because wireguard must be encrypted and frp does not

[artcancrotp]

This isn't a fix, but it's the workaround I use:

In your WSL terminal, type ssh.exe instead of ssh. This makes it use the Windows binary for ssh instead of the Linux one. Since WSL2 can run Windows command line tools without opening another window, it works pretty much the right way.

[karatekid430]

This is getting beyond a joke. It is 2021 and this issue has been known since 2019. It also means that the Microsoft Defender Application Guard for Microsoft Edge is completely broken for modern networks (IPv6-only).

[tidux]

It's like the bad old Microsoft from the 90s where they just blithely disregarded internet protocols they didn't like is back.

[paulstelian97]

Well to be fair the two alternatives both suck in terms of implementation: NAT requires some sort of proxying which I'm not sure is implemented, NDP proxy is a new protocol which again requires a full protocol implementation.

[craigloewen-msft]

To give a small update here, we are still investigating adding IPv6 support to WSL with the networking team. However this is still a feature request for future releases.

[dorianm]

No way to use WSL2 with Direct Access (full IPv6) is a terrible nightmare in my context. Direct Access works great from Windows but it's useless if I can access to my servers though WSL2. 😭

WSL2 was the best feature to come back from macOS, but it's unusable because of this limitation.

[jloic]

14 months later, still not there.

[slokhorst]

I think it's wrong to push WSL2 to end-users while it's still lacking some basic functions like this, which are regressions from WSL1. I was pushed to switch to WSL2 by VS Code and now cannot connect to a lot of my machines.. This is a terrible user experience.

[paulstelian97]

There are a few workarounds. For example, run a separate Linux VM and use OpenVPN in bridge (or even in normal) mode. Or heck, run the OpenVPN server on the host Windows and provide IPv6 that way.

There's also ways to just make the WSL2 adapter bridged, which implicitly allows IPv6 to work.

[PavelSosin-320]

It is going to be wirld! On one hand WSL doesn't support IPV6. On other hand inside my Linux distro IP shows Eth0 properties as
6: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP mode DEFAULT group default qlen 1000
link/ether 00:15:5d:60:74:8f brd ff:ff:ff:ff:ff:ff.
and my "Overlay" LAN network managed by my router is double stack:
Wireless LAN adapter Wi-Fi:

Connection-specific DNS Suffix . : lan
IPv6 Address. . . . . . . . . . . : 2a0d:6fc0:8400:200:74c4:2f8c:8ef:f187
IPv6 Address. . . . . . . . . . . : fd7d:e52e:3e3a:0:74c4:2f8c:8ef:f187
Temporary IPv6 Address. . . . . . : 2a0d:6fc0:8400:200:19a5:8703:d0bb:5203
Temporary IPv6 Address. . . . . . : 2a0d:6fc0:8400:200:5846:ed50:d695:b1a5
Temporary IPv6 Address. . . . . . : 2a0d:6fc0:8400:200:8d74:ee79:143c:d340
Temporary IPv6 Address. . . . . . : 2a0d:6fc0:8400:200:f93d:f38a:b54:757a
Temporary IPv6 Address. . . . . . : fd7d:e52e:3e3a:0:19a5:8703:d0bb:5203
Temporary IPv6 Address. . . . . . : fd7d:e52e:3e3a:0:5846:ed50:d695:b1a5
Temporary IPv6 Address. . . . . . : fd7d:e52e:3e3a:0:8d74:ee79:143c:d340
Temporary IPv6 Address. . . . . . : fd7d:e52e:3e3a:0:f93d:f38a:b54:757a
Link-local IPv6 Address . . . . . : fe80::74c4:2f8c:8ef:f187%11
IPv4 Address. . . . . . . . . . . : 192.168.1.140
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : fe80::22b0:1ff:fe36:c2de%11
192.168.1.1
Also my WiFi adapter properties show that it is double-stack. Is it surprising that Home WiFi network supports IPV6?
Should I disable IPV6 for WSL Linux Kernel "ipv6.disable=1"? to please WSL? Is it supported?

[paulstelian97]

You don't need to disable IPv6. Just ensure you have working IPv4, since only that will be configured in the WSL2 virtual machine.

WSL1 will use IPv6 just fine if available on the host since the network stacks aren't separate like in WSL2.

My ISP provides me IPv6 as well, and it is usable in WSL1. Do note that the addresses starting with 2a0d:... are public IP addresses and, if they're not outdated, they can be used to "test" your firewalls.

[artcancrotp]

Bridged networks are great if your machine is attached to Ethernet, but for those of us in the vast remote workforce, our VPN clients only give us one address. This means (unfortunately) that for a virtual machine to attach to IPv6, we need to use NAT66 (ugggggh). WSL1 was great because it just shared the host's network interface, but for WSL2 we need a NAT solution.

Quite frankly, KVM and VirtualBox are the only ones who get this completely right: they use the SLIRP stack to make NAT work without adding an interface to the host operating system. Unfortunately for those of us stuck on Windows machines at work, KVM only works on Linux, and VirtualBox calls home to snitch that we're using Oracle software in a non-home environment, so WSL2 is where we're at now.

Come on Microsoft, IPv6 isn't a "nice to have" in the current year. We need it and we need it now.

[PavelSosin-320]

It was easy to test using Podman run option --network=host, i.e. UDP echo server running as Podman container uses Host WSL VM network stack directly without any bridge. It is beneficial for Podman that the container runs as a slice of the WSL VM instead of process under Docker server. When the echo server is tested using by CURL inside WSL the response is precise as expected from the UDP echo server:
curl --tftp-no-options -6 --verbose tftp://[::0]:69/hello

• Trying :::69...
• Connected to ::0 () port 69 (#0)
• set timeouts for state 0; Total 300, retry 6 maxtry 50

Hostname: MSI-wsl

Request Information:
client_address=::1
client_port=43826
real path=/hello
request_scheme=tftp
It proves that UDP IPV6 stack inside VM works correctly. But the same curl request from the command prompt CURL says:

• Received too short packet
• Closing connection 0
  curl: (7) Received too short packet.
  In other words, UDP packets are corrupted when passing from WSL VM to the Windows host. It points to possible bug in NIC's IPV6 implementation. I'm afraid that WSL reuses code from Hyper-V network adapters that as I found needs special but very recommended configuration on both sides, host and VM to support IPV6. WSL NIC adapter is hard code and corrupts packets from WSL VM to Windows Host.

[paulstelian97]

WSL doesn't just reuse code from Hyper-V adapters, but uses actual Hyper-V adapters. If the Hyper-V adapters are responsible for corrupting packets, you may forward the request to the Hyper-V team.

The UDP IPv6 stack inside the VM is just the stack in the virtualized Linux kernel. Nothing special there. The host doesn't know jack shit about what happens in the virtualized Linux kernel, except for the fact that a process exists outside of the WSL distros themselves that monitors what is listening on the network interfaces so that some sort of forwarding is done from the host.

[shigenobuokamoto]

Here's an idea.
If your network can delegate prefixes with DHCPv6-PD, you can get prefixes from upstream on WSL1 and distribute them to the WSL2 network.

WSL2: ubuntu
WSL1: alpine　(apk add dhcpcd)

Run this script on WSL2 instance.

#! /bin/sh

distro=Alpine
dhcpcdconf=/tmp/.dhcpcd.conf

devs=$(wsl.exe -d $distro -u root cat /proc/net/route | egrep -v '^(Iface|lo)' | sed 's/^\([a-z0-9]*\)[^0-9a-z]*.*$/\1/' | sort | uniq)
_d=$(powershell.exe "Get-NetRoute -DestinationPrefix '0.0.0.0/0'| select ifIndex|Get-NetAdapter|Format-List;Get-NetAdapter -Name 'vEther*'|select Name|Format-List" | tr -d '\r')
defaultindex=$(echo -e "$_d" | egrep '^InterfaceIndex' | sed -r 's/^.*:[ ]*([0-9]*)$/\1/')
defaultname=$( echo -e "$_d" | egrep '^Name' |grep -v vEther | sed -r 's/^.*:[ ]*(.*)$/\1/')
wsl1if=$(wsl.exe -d $distro -u root ip -4 addr 2> /dev/null)
primary=$(echo "${wsl1if}" | grep "${defaultindex}:" | sed 's/^[0-9]*: *\([^:]*\):.*$/\1/')
devs=$(echo "${devs}" | grep -v ${primary} | tr '\n' ' ')
c="denyinterfaces ${devs}\ninterface ${primary}\nscript /dev/null\nnogateway\nnoipv6rs\nipv6only\nnodhcp\nnoipv4\nnoipv4ll\ndhcp6\nia_pd 1\n"
echo "echo \"${c}\" > ${dhcpcdconf}" | wsl.exe -d ${distro} -u root

delegate=$(echo "dhcpcd -f ${dhcpcdconf} -x 2>/dev/null;dhcpcd -f ${dhcpcdconf} 2>&1" | wsl.exe -d ${distro} -u root | grep delegated)
prefix=$(echo $delegate| sed 's/^.*prefix \([0-9a-f:]*\)::\/60/\1/')
default=$(cat <<- EOF
        Set-NetIPInterface -Forwarding Enabled -InterfaceIndex ${defaultindex};
        Set-NetIPInterface -InterfaceAlias 'vEthernet (${defaultname})' -AddressFamily IPv6 -Dhcp Disabled -RouterDiscovery Disabled;
        EOF
)
address=$(openssl rand -hex 8 | sed -r 's/^(.{4})(.{4})(.{4})(.{4})/\1:\2:\3:\4/')
i=0
_defaultswitch=$(echo -e "$_d"|egrep '^Name'|grep vEther|grep Default| sed -r 's/^.*:[ ]*(.*)$/\1/g')
_wslswitch=$(echo -e "$_d"|egrep '^Name'|grep vEther|grep WSL| sed -r 's/^.*:[ ]*(.*)$/\1/g')
for interface in "$_wslswitch" "$_defaultswitch"
do
    if [ -n "$interface" ]; then
        virtual=$virtual$(cat <<- EOF
        Get-NetIPAddress -InterfaceAlias '${interface}' -AddressFamily IPv6 | where {\`\$_.IPAddress.StartsWith('2')} | Remove-NetIPAddress -Confirm:\`\$false -PassThru;
        New-NetIPAddress -IPAddress ${prefix}:${address} -PrefixLength 64 -InterfaceAlias '${interface}' -SkipAsSource \`\$True -PolicyStore ActiveStore;
        Set-NetIPInterface -InterfaceAlias '${interface}' -AddressFamily IPv6 -Advertising Enabled -AdvertiseDefaultRoute Enabled -Forwarding Enabled -PassThru;
        EOF
        )
        route=$route"Set-NetRoute -InterfaceAlias '${interface}' -AddressFamily IPv6 -DestinationPrefix '${prefix}::/64' -Publish yes;"
        i=`expr $i + 1`
        prefix=$(echo $prefix| sed "s/.\$/${i}/")
    fi
done
c="${default}${virtual}sleep 5;${route}"
powershell.exe start-process -windowstyle hidden powershell -Verb runas "\"${c}\""

[withinboredom]

Does that actually work? IIRC, the kernel is missing a few key routing pieces to actually route ipv6 packets.

[shigenobuokamoto]

[withinboredom]

I'm trying to understand the script you've posted, might be worth adding some comments as to what some things are doing?

It doesn't work for me (dhcpd fails to come up) but I don't know why because I'm not sure what the other lines are doing.

[shigenobuokamoto]

have you installed dhcpcd?

after running this script, Alpine:/tmp/.dhcpcd.conf should be created. you can use it to see if you can get delegation from an upstream router.

$ wsl -d Alpine -u root dhcpcd -f /tmp/.dhcpcd.conf -1

(results and some errors...)

eth0: delegated prefix 2........................................
if you can find a line like this, dhcpcd has completed the required task.

[shigenobuokamoto]

@withinboredom
i understand the issue. that script does not seem to work in alpine 3.15.
I have prepared an installer, which can be found here.

https://github.com/shigenobuokamoto/wsl2ipv6

[PavelSosin-320]

Bad news for Microsoft: I finally got end-to-end IPV6 connectivity over WiFi (Technicolor router). After upgrading to Windows 11, the picture became absolutely inconsistent: Microsoft 365 is resolved both as IPV4 and IPV6 addresses. From Windows CMD, I got ping 2620:1ec:21::16 Average 13 ms and from WSL I got "ping: connect: Network is unreachable". On one hand, Microsoft offers new services reachable via IPV6. On the other hands' blocks access to Cloud services due to a lack of IPV6 support. WSL VM itself has an IPV6 address on Eth0. So, why NIC blocks it?

[PavelSosin-320]

Having 2 machines: 1st with Windows 10 /WSL2 and 2nd with the Linux workstation connected to the same WiFi router I found the major difference in how Linux machines configure themselves in the same network managed by the IPV6 gateway. In both cases, the router advertises itself with its gateway IPV6 address and IPV6 DNS addresses. The router supports and is pre-configured as a pure IPV6 gateway because ISP and router's manufacturer desired it to support as many as possible IoT and mobile streaming devices with security in the mind. Linux and Windows 10 & 11 machines store IPV6 configuration, communicate with the Internet infrastructure using IPV6 protocol via IPV6 gateway. The resolvers advertised by the router or configured by the administrator are IPV6 capable too. Otherwise, problems, similar to WSL internet access have appeared. All mobile, WiFi-connected, running Android or Linux derivatievs devices that use IPV6 IPV4-only communication equipment can be scrapped by IT or ISP. When Windows 10 was released the situation was the opposite - IPV6 support was scarce. MS provided the IPV configuration doc.
It looks like Hyper-V virtual switches never supported IPV6 and always followed to NAT approach. The NAT is redundant in IPV6 but the same code is used in Windows 11.

[Daniel15]

All the workarounds seem complex, so I ended up switching to WSL1 to get IPv6 support:

PS C:\Users\Daniel> wsl --list --verbose
  NAME                   STATE           VERSION
* Ubuntu                 Running         2
  docker-desktop         Running         2
  docker-desktop-data    Running         2

PS C:\Users\Daniel> wsl --set-version Ubuntu 1
Conversion in progress, this may take a few minutes...
Conversion complete.

Not ideal, but it seems like the best approach for now 😕

[Bilge]

Can't use Docker in WSL1.

[birdman74]

This statement about Docker is incorrect: https://stackoverflow.com/questions/66466339/docker-for-windows-and-wsl1-to-work-together

[Daniel15]

@Bilge Why do you want to run Docker in WSL instead of running it directly on Windows via Docker Desktop?

[Bilge]

File system performance.

[withinboredom]

I attempted a workaround by setting up a wireguard server on the host and in wsl, routing ::0/0 through wireguard.

Windows side:

[Interface]
PrivateKey = REDACTED
ListenPort = 51000
Address = 10.9.0.2/24

[Peer]
PublicKey = pWFAj6c7ZZ1tdQH1ZizHIMDbzQFRak0ysvhHKo0sAC4=

WSL2:

[Interface]
Address = 10.9.0.1/24, 2001:8b0:2c1:4b50::2/128
PrivateKey = REDACTED

[Peer]
PublicKey = ihfrkKZKwTWPTnfss1Jgeb/YfeKlAtrRIJkKFVYTX20=
AllowedIPs = ::0/0
Endpoint = 192.168.1.22:51000
PersistentKeepalive = 10

However, it appears the kernel isn't even compiled with routing for IPV6 (not compiled with CONFIG_IPV6_MULTIPLE_TABLES) so while I'm able to create a default route via ipv6, I'm unable to use the route without creating the rule to exclude the actual net link.

[PavelSosin-320]

Highly desired! After connection of entire residential building to high speed internet via OpenWRT-based WiFi routers IPV4 DHCP got dementia.

[withinboredom]

I managed to get this working with the awesome kernel over in this repo.

The Wireguard server is on my router, I couldn't get it working in Windows (ipv6 packet forwarding issues). Here's the configs:

# RT-AX86U (IPv4/IPv6) Server 2
[Interface]
PrivateKey = REDACTED
Address = 10.50.2.1/24,2001:REDACTED::100:1/64
ListenPort = 11502

# wsl device
[Peer]
PublicKey = REDACTED
AllowedIPs = 10.50.2.3/32,2001:REDACTED::1002/128
PresharedKey = REDACTED

and for the client:

# wsl
[Interface]
PrivateKey = REDACTED
Address = 2001:REDACTED::1002/128
DNS = REDACTED,

[Peer]
PublicKey = REDACTED
AllowedIPs = ::/0     # IPv6
Endpoint = REDACTED:11502
PresharedKey = REDACTED
PersistentKeepalive = 25

[bviktor]

I want to set my servers' sshd to IPv6-only, but since I manage them via Ansible from WSL, this is blocking me, because Ansible connects via SSH. Please fix this regression.

[Daniel15]

This is one of the main reasons I need IPv6 as well. I have some servers that are IPv6-only. I ended up reverting to WSL1 to get Ansible working.

[JelmerD]

Need IPV6 support. I'm unable to use curl to install laravel at this point.

[limes007]

I need IPv6 too, would be great if that would be possible

[shigenobuokamoto]

flowchart TD
  A[network/windows can use ipv6]
  A -- no --> B[wsl2 cannot use ipv6]
  A -- Yes --> C[network provide dhcpv6-pd?]
  C -- no --> D[windows is pro or above?*]
  C -- yes --> E[get prefix with dhcpcd in wsl1 and use powershell to provide ra to vethernet_wsl]
  D -- no --> B
  D -- yes --> F[use bridge** in wsl2]
  E --> G[wsl2 can use ipv6]
  F --> G

*please proceed to 'yes', if you can use hyper-v on windows home.(is that ok, license-wise?)
**you can use bridge mode in wsl preview 0.51.x. but bridge mode is not an officially provided feature.
#4150 (comment)

[pmarcum]

Can you provide step-by-step instructions for "get prefix with dhcpcd in wsl1 and use powershell to provide ra to vethernet_wsl"? (What does "ra" stand for?)

[shigenobuokamoto]

here it is
#5855 (comment)

ra is 'router advertisement'

[Dragon1573]

Excuse me? What is a "dhcpv6-pd" in your chart?

Network/Windows can use IPv6? (Yes)

Bridge mode enabled? (Yes)

IPv6 check? (Can't ping6 but able to curl IPv6 domain)

[shigenobuokamoto]

dhcpv6-pd is a DHCP function that delegate prefixes to downstream routers.

for more information, see
https://www.rfc-editor.org/rfc/rfc8415
6.3. DHCP for Prefix Delegation

but,,,
if you have already enabled bridge mode, you can enable IPv6 by simply adding one sentence to .wslconfig.

ipv6=true

[tidux]

Protip for anyone following this issue: invert it. Ditch WSL, put Linux on bare metal, and put your Windows in a KVM+libvirt VM. Bridged networking for IPv4+IPv6 is straightforward to set up that way.

That is, unless Microsoft commits to bridged mode as a supported feature.

[bviktor]

That's not a "protip", you're not helping, you're just wasting everyone's time. If not using Windows was an option, we wouldn't be reporting our issues with WSL in the first place.

[iMonZ]

Anything new here? This is actually really important.
How can this not be implemented

[jimmbelll]

I know, right? I say spin up a linux VM and get on with your life.

[dhilditch]

I came to this thread after trying to run sudo apt-get update and a docker package was trying to connect with IP6.

I tried disabling IP6 on windows then restarting everything, but as I watch the update it seems like the IP4 from docker gets redirected to an IP6 address.

What ended up working for me was altering my networking settings in Windows and changing the DNS servers for IP6 over to the Cloudflare IP6 servers - 2606:4700:4700::1111 and 2606:4700:4700::1001.

Now after restarting WSL, the apt-get update works and downloads from the docker repo.

Not sure why this works if others in here are saying that IP6 doesn't work - I would guess that somehow Cloudflare is spotting that IP6 is failing and it's redirecting the request back to IP4??

Here is an image of it failing: https://i.imgur.com/NN11nc4.png

Here is an image of it working after changing IP6 DNS on Windows: https://i.imgur.com/NUdWETg.png

Although looking at the images, the docker update just says 'hit' and not 'get' so maybe it's just failing silently now? Although this page says that this should mean it succeeded in checking against the remote repo: https://askubuntu.com/questions/960575/what-do-hit-and-get-mean-in-the-output-of-apt-get-update

[neverabsolute]

WSL2 is useless in my team's development workflow since we leverage several cloud providers like fly that use IPV6 only subnets

How has this been ignored for 3+ years???

WSL2 is great because of many things like

• better filesystem performance
• all the familiarities you'd expect from a unix based system
• great integration with windows filesystems
• baked in GUI support (on win 11)
• tons of distros to choose from right out of the box
• way better than dual booting

but falls flat on its face with networking in general, stuff like DNS randomly breaking, no native ipv6 support, and other various quirks

It honestly feels like the senior team behind this is just ignoring this and letting the tech debt accumulate until enough complaints build up or a new hire does it for them

[netphils]

Even NAT66 is better than nothing at all. It has been 3 years, please implement native IPv6 support.

[rossnet]

I am adding my vote to the pile here: WSL2 needs IPv6 support ASAP.

[withinboredom]

In the last couple of days, I managed to get ipv6 working by manually injecting some packets. Here's the tool to do it automatically if you want to give it a go: https://github.com/withinboredom/ipv6-wsl/tree/v0.1.0.5

[paulstelian97]

This is amazing in a good way for you and in a not-so-good way for MS in the sense that... did you literally expose a bug in the Windows network bridge implementation??

[withinboredom]

It does look like there is a bug in the routing table. If I had to take a wild guess it's probably an off-by-one, oversight, or typo type bug since it's just sending the packets to the wrong interface.

It's probably a one-line fix if the code is architected like how I think it is. Maybe a few lines of setup need to be added to get the correct interface.

I wouldn't say it's necessarily a bad look for MS. I've definitely written worse bugs in my career.

[satmandu]

Maybe it is worth forwarding this report to secure@microsoft.com ?

[kenvix]

Seemingly there is no hope to get a native IPv6 support for wsl2. As far as I know, VMware's vEth has built-in NAT66 support. Is there any way to bridge WSL2 traffic to VMware's vEth (VMNet8) to enable IPv6 support?

[withinboredom]

#9354 might be an answer. Just set up a service to ping an ipv6 address with the wsl in bridge mode

[kenvix]

@withinboredom Thanks for your reply, but I'm using a laptop for work which means I often need to switch between WLAN and Ethernet, so I need to bridge at least two NICs, do you know how to set up multiple NICs for WSL2? Besides, my university only provides /128 ipv6 addresses due to "technical issues", so I also need to use NAT66 and may need to add another NIC to bridge to vmnet8 for WinNAT doesn't support NAT66 at all.

[withinboredom]

In bridged mode, it looks like a whole different computer on the network, so it will get its own IP address instead of sharing yours. Sometimes it doesn't work correctly for wireless devices, but it might be worth giving it a shot. But switching between physical NICs is a pita, though theoretically, you could add both devices to the same bridge. I've never tried that before, but maybe it will work.

[satmandu]

mac address of actual network adapter: AA:AA:AA:AA:AA:AA
mac address inside .wslconfig: AA:AA:AA:AA:AA:AA
manually set mac address of Hyperv bridge (names wsl): AA:AA:AA:AA:AA:AB

So .wslconfig is thus:

[wsl2]
networkingMode=bridged #<--
vmSwitch=wsl #<--
dhcp=true #<--
ipv6=true #<--
macAddress=AA:AA:AA:AA:AA:AA #<--

localhostforwarding=true #<--
debugConsole=false

I can test ipv6 with: ping 2600::
So now ipv4 & ipv6 works just fine inside wsl2... and ipv4 works fine from windows 11, but I ipv6 now doesn't work outside wsl2...
ipconfig from cmd shows mac address AA:AA:AA:AA:AA:AB is being used, and ifconfig from inside wsl2 shows mac address AA:AA:AA:AA:AA:AA is being used.

It's not the end of the world... but it might be useful for some.

[xanderificnl]

Note: I'm using different adapter names, i.e. your extern is wsl for me and your WSL is Default Switch for me. In my comments below & the screenshot, I've tried to use your naming scheme to avoid confusion - but it's something to keep in mind.

I have both vEthernet (WSL), which is the internal network, WSL is currently connected to and vEthernet (extern), which is the Hyper-V Switch for my physical interface.

That makes sense. Can you post a screenshot of your vSwitch configuration? It should look similar to:

I tried both the %userprofile\.wslconfig and in the wsl distro /etc/wsl.conf

[boot]
systemd=true

[wsl2]
networkingMode=bridged
vmSwitch=extern
dhcp=true
ipv6=true
macAddress=D1:A5:17:12:CF:2B

You should only have to update %UserProfile%\.wslconfig. The boot.systemd resulted in an error for me so I removed that, additionally I'm not specifying dhcp or macAddress at all.

So this is my config now:

[wsl2]
networkingMode=bridged
vmSwitch=extern
ipv6=true

#WSL
$ ip addr show dev eth0
6: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
    link/ether 00:15:5d:07:70:6a brd ff:ff:ff:ff:ff:ff
    inet 172.22.20.146/20 brd 172.22.31.255 scope global eth0
       valid_lft forever preferred_lft forever
    inet6 fe80::215:5dff:fe07:706a/64 scope link
       valid_lft forever preferred_lft forever

The MAC address is still the old one, not the one I set. Maybe the wsl.conf is not even getting read?

I would advice you to let Windows take care of assigning the MAC addresses for you unless there's a compelling reason to do it manually. In my setup, Windows gave my NIC's MAC to the vSwitch and it assigned a random MAC to WSL, i.e.:

# Windows (vSwitch uses Realtek's MAC)
$ getmac.exe /v | grep 30 
Ethernet        Realtek PCIe Gb 30-xx-xx-xx-xx-85   N/A
vEthernet (extern) Hyper-V Virtual 30-xx-xx-xx-xx-85  \Device\Tcpip_*

# Linux - seemingly random MAC.
$ ip link show dev eth0 | awk '/ether /{print $2}'
5c:xx:xx:xx:xx:fa

(I know there is not IPv6 on the Host right now, but the bridge should work for IPv4 too, right?)

Yes, it should.

Are these config options documented somewhere? The network section of learn.microsoft.com/en-us/windows/wsl/wsl-config does not list them.

I'm not sure

[JM-Lemmi]

Got a Dual Stack Networking running for my Test Setup.

My Hyper-V Switch looks the same:

My .wslconfig is now exactly the same as in your comment

[wsl2]
networkingMode=bridged
vmSwitch=extern
ipv6=true

But my WSL is still connected to the original Default WSL Network.

csaudit@Audit-W11:/mnt/c/Users/LocalAdmin$ ip addr show dev eth0
6: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
    link/ether 00:15:5d:4f:99:92 brd ff:ff:ff:ff:ff:ff
    inet 172.24.8.50/20 brd 172.24.15.255 scope global eth0
       valid_lft forever preferred_lft forever
    inet6 fe80::215:5dff:fe4f:9992/64 scope link
       valid_lft forever preferred_lft forever

I don wonder, why I have a "WSL" and "Default Switch" Network, and your WSL is connected to the Hyper-V Default Switch. Did you set up Hyper-V before WSL? Mine is a fresh W11 where I first set up WSL, then installed Hyper-V.

Querying the HCNetwork Win32 API also shows the VM connected to the internal network:

PS > ./hcndiag list
Found 3 networks:
Id, Name, Type, Dns
AB1BD58A-2C96-4E10-BD4C-ED390B121265: extern, Transparent, []
C08CB7B8-9B3C-408E-8E30-5E16A3AEB444: Default Switch, ICS, []
B95D0C5E-57D4-412B-B571-18A81A16E005: WSL, ICS, []
PS > ./hcndiag nodes
Found 2 nodes:
Id, Name, Network ID, MAC, IP, DNS
c4ed747c-2dcb-4870-acbc-577e20b5613a: Ethernet, b95d0c5e-57d4-412b-b571-18a81a16e005, 172.24.1.223/20 , 00-15-5D-4F-9B-1D, [172.24.0.1]
1fe0a77b-96b0-42aa-baa9-05c7bcdbf55e: Ethernet, b95d0c5e-57d4-412b-b571-18a81a16e005, 172.24.6.30/20 , 00-15-5D-4F-97-B5, [172.24.0.1]

One of the nodes is WSA, the other is WSL.

[xanderificnl]

Can you try wsl.exe --update?

$ wsl.exe --version
WSL version: 1.1.6.0
Kernel version: 5.15.90.1
WSLg version: 1.0.50
MSRDC version: 1.2.3770
Direct3D version: 1.608.2-61064218
DXCore version: 10.0.25131.1002-220531-1700.rs-onecore-base2-hyp
Windows version: 10.0.22621.1413

and

$ wsl.exe -l -v
  NAME                   STATE           VERSION
* Ubuntu-22.04           Running         2

---

My .wslconfig is not exactly the same as in your comment

[wsl2]
networkingMode=bridged
vmSwitch=extern
ipv6=true

Have you restarted WSL (i.e. wsl.exe --shutdown) after changing `%UserProfile%.wslconfig?

I don wonder, why I have a "WSL" and "Default Switch" Network, and your WSL is connected to the Hyper-V Default Switch. Did you set up Hyper-V before WSL? Mine is a fresh W11 where I first set up WSL, then installed Hyper-V.

I've been using WSL for awhile now and only yesterday installed Hyper-V & configured the new switch.

Querying the HCNetwork Win32 API also shows the VM connected to the internal network:

PS > ./hcndiag list
Found 3 networks:
Id, Name, Type, Dns
AB1BD58A-2C96-4E10-BD4C-ED390B121265: extern, Transparent, []
C08CB7B8-9B3C-408E-8E30-5E16A3AEB444: Default Switch, ICS, []
B95D0C5E-57D4-412B-B571-18A81A16E005: WSL, ICS, []
PS > ./hcndiag nodes
Found 2 nodes:
Id, Name, Network ID, MAC, IP, DNS
c4ed747c-2dcb-4870-acbc-577e20b5613a: Ethernet, b95d0c5e-57d4-412b-b571-18a81a16e005, 172.24.1.223/20 , 00-15-5D-4F-9B-1D, [172.24.0.1]
1fe0a77b-96b0-42aa-baa9-05c7bcdbf55e: Ethernet, b95d0c5e-57d4-412b-b571-18a81a16e005, 172.24.6.30/20 , 00-15-5D-4F-97-B5, [172.24.0.1]

New morning, fresh eyes.

> hnsdiag list networks # note the difference between hcndiag & hnsdiag
Network : 1A506A4D-16D2-4778-A3A1-71537B47A9D1
    Name             : wsl
    Type             : Transparent

Network : C08CB7B8-9B3C-408E-8E30-5E16A3AEB444
    Name             : Default Switch
    Type             : ICS
    Subnet Address   : 172.28.112.0/20
    Gateway          : 172.28.112.1

Finally, are you running the WSL preview? https://aka.ms/wslstorepage

[spagu]

no luck.

[fgfg163]

Virtual Switch WSL will reset when windows restart.

[Waldorf3]

So does anyone know what is the plan for adding IPv6 support to wsl/wsl2?

The IPv6 train is finally starting to take off and it seems MS is left at the station.

[paulstelian97]

No knowledge on top of what is on this very page. I suspect that Microsoft will report if they do have a plan to add it.

I do understand the fact that the technology simply isn't there for a proper IPv6 implementation with Hyper-V. WSL2 does however have bridged mode as an official feature that you can set in wsl.conf to work around this issue (in that case, all that needs to support IPv6 is your router, and the IPv6 stack could well even be disabled in Windows and still work inside WSL)

[Waldorf3]

So why is that not just set automatically. What feature is that, how is it set. Where is wsl.conf? I am just a user, not an expert on wsl, is that a requirement to use it?

[paulstelian97]

wsl.conf is in your user profile directory. If you type in %HOMEPATH% in your file explorer address bar it will send you there. You need to create the file yourself, by default it's absent.

Defaulting to bridged mode isn't a flawless option, not enough that it can ever be made default. In bridged mode WSL2 becomes a separate computer on the network the Windows machine is connected, and has its own requirements (such as firewall needs) done independently from Windows.

[owenhaynes]

Yeah IPV6 support is more needed.

We have started to look into cloud flare zero-trust to connect to our cloud VPCs and the most sensible thing to do is expose things over IPV6 to avoid IP range clashes with all the different VPC.

Yes cloudflare has things to help with this but it not seamless. Once you have lots off k8s clusters running IPV4 private space starts becoming a bit limited and planning becomes a nightmare

[fgfg163]

I created a hyper-v virtual machine running openwrt x86, wsl2 uses wireguard to connect to openwrt, and set up port forwarding. Now I can access wsl2 using openwrt's ip.

[fgfg163]

I use frp instead of wireguard and find that the performance is better, because wireguard must be encrypted and frp does not

[giovannicandido]

I edit my .wslconfig and added the lines:

networkingMode=bridged
vmSwitch=External
ipv6=true

Created a External vSwitch connect to my physical lan.
WSL get a ipv4 and ipv6. Ipv4 is working but ipv6 do not.
Also created a virtual machine in that external virtual switch and no ipv6. I think this is a problem with Hyper-v virtualswitch but could find a solution.

If vmware vctl was usefull with my dev workflow (i use testcontainers which required a docker daemon) I whould try it, but wsl2 + docker is the best integrated approach. I would like to have ipv6 support in hyper-v consequently wsl2 as well

[giovannicandido]

Ok got it working. The config I use is the same above, I just change the External Switch to use my cable network and not my wifi!!!

Why this don't work on wifi?

I figure out because I tested vmware and had the same problem! Virtual machines cannot use a bridge network with ipv6 over wifi. In vmware was even worse because the ipv4 also do not work!

[giovannicandido]

I have reasons to use wifi and not a cable. I do not find anything in internet that explains this or provide a solution

[Slug-V]

run ip -6 neigh flush dev eth0 and check connectivity. unfortunately this is not persistent, it'll work for several minutes
read this japanese post if auto-translator works

[withinboredom]

Why this don't work on wifi?

Wifi frames ... that's why. In some mesh configurations (802.11-something), a secondary mac address can be added per station. If you have this configuration, then it will work just like when wired. I spent a month trying to figure out why it worked on my home wifi, but not on my work wifi before I ended up getting down to the wifi frames.

Anyway, I suspect this will never work in bridged mode on all wifi networks. They need to add proper ipv6 support in non-bridged mode.

[systems1]

I moved to new place and here isp gives ipv6 address ,windows cmd works but not wsl2 network
I was able to get around my internet wsl2 download needs by disabling ipv6 in wireless adapter network properties and reboot win10
hope could be of help to some who just need internet on wsl2
there is another way to try ipv4 first then ipv6 updating windows 10 registry values but this is simpler disable ipv6 in my network adapter

[kenvix]

For someone who has mobility needs, so both NAT66 and Bridging (WiFi+Ethernet) mode are required:

Someone has created a project WSLAttachSwitch and I've modified it to add the ability to add NICs with static MAC addresses: you can get my modified version here, if the author hasn't merged it yet

Then, set up three switches:

• One connected to the physical WiFi
• One connected to the physical Ethernet
• One connected to the VMware's NAT interface. Yes, it is a little stupid, but only VMWare's provide NAT66

Now, you can get native IPv6 address if either wifi or ethernet provides it for free, or use VMWare's NAT66 if not.

[slokhorst]

Finally! Microsoft just released WSL 2.0 (in preview), which adds a "mirrored" networking mode.

.wslconfig:

[experimental]
networkingMode=mirrored

And that's it, IPv6 now works in WSL!

(while WSL 2.0 is still in preview, first run wsl --update; wsl --update --pre-release).

[kenvix]

Unfortunately, it seems that most of features are not available for Windows 10 and they have no plan for this

[DennisGlindhart]

This seems generally to work fine, except contacting [::1] from the host (Windows) does not seem to be shared/reach the WSL-part, while 127.0.0.1 works.

I.e i start netcat -l 4444 -4 in WSL and running curl -v 127.0.0.1:4444 on host gets a connection established, while doing netcat -l 4444 -6 in WSL and running curl -v [::1]:4444 on host doesn't respond. Running the curl commands from WSL works in both cases.

Any hints why this might be the case?

[paulstelian97]

@DennisGlindhart I suspect that for IPv6 WSL doesn't do those special port forwards that are application based. That is, while IPv6 connectivity is given the full WSL1-like behaviour is potentially not implemented unlike IPv4 where NAT made it easy.

[azzazkhan]

You can now set networkingMode=mirrored in .wslconfig file and IPv6 will be enabled! You need to restart your WSL VM though.

https://learn.microsoft.com/en-us/windows/wsl/wsl-config#main-wsl-settings

[artcancrotp]

Super! What version of Windows and/or WSL is required for that option to be available?

[azzazkhan]

You can now set networkingMode=mirrored in .wslconfig file and IPv6 will be enabled! You need to restart your WSL VM though.

https://learn.microsoft.com/en-us/windows/wsl/wsl-config#main-wsl-settings