How does wsl-vpnkit work?

[mikicho]

Hey,
I came across this repo after couple of days of trying amy configuration on the internet to fix connectivity issues with wsl while connected to the VPN (pulse secure on my case).

First, THANK YOU!!
Second, im extremely curious what the problem is (what prevents wsl to connect to the internet when vpn is on), and how wsl-vpnkit solves this problem.
I'd appreciate if you shed some light on this matter.

[sakai135]

Some VPNs are configured to route all traffic to/from the host through the VPN and block any other connections. Since the WSL 2 VM is on a separate network to the VPN, connections to/from the VM are blocked as well.

Both VPNKit (used in Docker Desktop) and gvisor-tap-vsock (used in Red Hat CRC) get around this by transferring the network connections from the VM to the Windows process on the host. For more details, you can take a look at the documentation from VPNKit and gvisor-tap-vsock.

[mikicho]

Thanks!

[phil-blain]

Hi ! I took a look at the VPNKit and gvisor-tap-vsock docs but I'm still unsure how the wsl-vpnkit eth1 device is getting added in the "client" WSL 2 VM.

How does that work ? What's the flow of things when a program in the client VM wants to connect to the Internet ?
I'm guessing the wsl-vpnkit VM "hijacks" all traffic from all WSL 2 VMs somehow, and somehow creates the tap device when a connection is first attempted ?

[smerschjohann]

You can see the magic here: https://github.com/sakai135/wsl-vpnkit/blob/main/wsl-vpnkit#L105 The script created some iptables rules for that purpose. The Tap device and the windows counterpart are part of the setup process as well

[phil-blain]

I took a look at the script but as far as I understand this runs in the wsl-vpnkit VM, not the client VM... that's the bit I'm missing. Then again I might be missing something :)

[smerschjohann]

All wsl2 instances share the same kernel space including the network stack. If you add iptable rules in one "VM", they apply to all other "VMs" as well.

[phil-blain]

Thanks ! That was indeed the missing bit in my understanding, now it makes sense.

More info on what is shared and what is not between the different WSL2 VMs: https://superuser.com/questions/1715273/wsl2-two-separate-centos-distributions-have-same-eth0-inet-addres