Skip to content

Instantly share code, notes, and snippets.

@shigenobuokamoto

shigenobuokamoto/for2.3.11-network-mirrored.service

Last active September 27, 2024 13:53
Show Gist options
  • Save shigenobuokamoto/540c5f09a03eb07149501e99a6c8d82b to your computer and use it in GitHub Desktop.
Save shigenobuokamoto/540c5f09a03eb07149501e99a6c8d82b to your computer and use it in GitHub Desktop.
Download ZIP
network-mirrored.service.2.3.11
Raw
for2.3.11-network-mirrored.service
[Unit]
Wants=network-pre.target
Before=network-pre.target shutdown.target
[Service]
User=root
ExecStart=/bin/sh -ec '\
[ -x /usr/bin/wslinfo ] && [ "$(/usr/bin/wslinfo --networking-mode)" = "mirrored" ] || exit 0;\
echo 1 > /proc/sys/net/ipv4/conf/all/route_localnet;\
nft add rule ip nat WSLPOSTROUTING "iif \"loopback0\" ip saddr 127.0.0.0/8 ip daddr != 127.0.0.0/8 counter masquerade comment mirrored"\
'
ExecStop=/bin/sh -ec '\
[ -x /usr/bin/wslinfo ] && [ "$(/usr/bin/wslinfo --networking-mode)" = "mirrored" ] || exit 0;\
echo 0 > /proc/sys/net/ipv4/conf/all/route_localnet;\
for chain in "ip nat WSLPOSTROUTING";\
do\
handle=$(nft -a list chain $chain | sed -En "s/^.*comment \\"mirrored\\" # handle ([0-9]+)$/\\1/p");\
for n in $handle; do echo "delete rule $chain handle $n"; done;\
done|nft -f -\
'
RemainAfterExit=yes
[Install]
WantedBy=multi-user.target
@shigenobuokamoto
Copy link
Author

shigenobuokamoto commented Jul 22, 2024 •
edited
Loading

for WSL 2.3.11 later

$ sudo systemctl stop network-mirrored
$ sudo curl -o /etc/systemd/system/network-mirrored.service https://gist.githubusercontent.com/shigenobuokamoto/b565d468541fc8be7d7d76a0434496a0/raw/04aeb41249be4a375bc838a1b5d9fe4f57b90447/network-mirrored.service
$ sudo systemctl daemon-reload
$ sudo systemctl --now enable network-mirrored

this service solves the issue of not being able to reach Docker containers via 127.0.0.1 from a Windows host.
unlike the old one, it does not use userland-proxy, but uses iptables(nftables). (This is possible from WSL 2.3.11 onwards.)

    Windows Host                  Linux WSL                 Docker
127.0.0.1 --> 127.0.0.1
                 ---------->
                            127.0.0.1 --> 127.0.0.1
                                           DNAT
                            127.0.0.1 --> 172.18.0.2
                            masquerade
                            172.18.0.1 --> 172.18.0.2
                                                 ---------->
                                                          172.18.0.1 --> 172.18.0.2
                                                          172.18.0.1 <-- 172.18.0.2
                                                 <----------
                             172.18.0.1 <-- 172.18.0.2
                             masquerade(return)
                             127.0.0.1 <-- 172.18.0.2
                                            DNAT(return)
                            127.0.0.1 <-- 127.0.0.1
                 <----------
127.0.0.1 <-- 127.0.0.1

in addition, communication is possible from 127.0.0.0/8 <--> 127.0.0.0/8, but some missing route have been added.
removed in revision 4.

@shigenobuokamoto
Copy link
Author

this script is no longer needed.

please use Docker 27.3.0 or later.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment