Endpoint Security Firewall blocks certain network traffic from WSL2/Docker instances

Technical Articles ID: KB94601
Last Modified: 2023-03-21 10:03:02 Etc/GMT

Environment

Endpoint Security (ENS) Firewall 10.x

Microsoft Windows Subsystem for Linux 2 (WSL2) - Supported starting with the ENS 10.7.0 June 2021 Update. For more information, see KB91411 - Windows Subsystem for Linux (WSL/WSL2) support.

NOTE: This issue doesn't affect Microsoft Windows Subsystem for Linux 1 (WSL1).
Docker for Windows - Supported starting with the ENS 10.6.1/10.7.0 November 2020 Update. For more information, see KB90041 - Windows/Linux/Mac container support with Trellix products.

Problem

ENS Firewall blocks some network traffic from WSL2 or Docker instances.

From the WSL2 console, when you execute ping google.com, the DNS resolution fails, which causes the command to fail.

Output results:

ping: google.com: Temporary failure in name resolution

The ENS FirewallEventMonitor.log shows blocked network traffic entries similar to the following (application, IP addresses, and port numbers can vary).

Time: 05/27/2021 12:32:52
Event: Traffic
IP Address: 172.19.111.65
Description: HOST PROCESS FOR WINDOWS SERVICES
Path: C:\Windows\System32\svchost.exe
Message: Blocked Incoming UDP - Source 172.19.111.65 : (39171) Destination 172.19.96.1 : dns (53)
Matched Rule: Block all traffic

Cause

WSL2 and Docker create a virtual network adapter through which all network traffic flows. From the ENS Firewall point of view, this adapter receives incoming traffic from the WSL2/Docker instance and the default firewall rules block most of the incoming traffic on several ports.

Solution

Create firewall rules to allow incoming traffic on the required local ports so that the default firewall rules don't block the traffic from the WSL2/Docker instance. Examples are provided below, but aren't limited to these details. Create/modify the firewall rules for the environment as needed. Review the ENS FirewallEventMonitor.log file for further network connection details.

Sample firewall rules to allow traffic from WSL2/Docker instances:

Example #1:
Allow DNS traffic from container
Rule Action: Allow
Direction: In
Connection type: All types (Wired,Wireless,Virtual)
Protocol: UDP/IPv4, UDP/IPv6
Local port: 53

Example #2:
Allow inbound FTP client connections from container
Rule Action: Allow
Direction: In
Connection type: All types (Wired,Wireless,Virtual)
Protocol: TCP/IPv4, TCP/IPv6
Local port: 21

Example #3:
Allow inbound HTTP/HTTPS traffic from container
Rule Action: Allow
Direction: In
Connection type: All types (Wired,Wireless,Virtual)
Protocol: TCP/IPv4, TCP/IPv6
Local port: 80, 443

Affected Products

Languages:

This article is available in the following languages:

Knowledge Center

Endpoint Security Firewall blocks certain network traffic from WSL2/Docker instances

Environment

Problem

Cause

Solution

Affected Products

Languages:

Title

Title

Knowledge Center

Endpoint Security Firewall blocks certain network traffic from WSL2/Docker instances

Environment

Problem

Cause

Solution

Affected Products

Languages:

Choose your region

Title

Title