Re:Linux under WSL2 can be leaking
by ani-ani on Wednesday September 30, 2020 @07:19PM
(#24645253)
This is due to Hyper-V, which is being rolled out on Windows 10 and required for WSL2. The OS is now running as a VM, and virtualized programs like WSL2 are running alongside - these VMs can't control each other's traffic. It's interesting that a feature meant to improve sandboxing actually makes firewalling and VPN more difficult, in its current state. I think the the proper fix is at the Hyper-V level, which might need to explicitly manage firewall and VPN features.
[ Parent
| on HN ]
Windows 10 can control the Linux VMs traffic because it can control Hyper-V.
Nope, it can request Hyper-V to do stuff, just like any other guest.
We're using vague terms, but the point is that controlling the VM is not the same thing as controlling the VM's traffic, especially in the model where your OS is not actually hosting the VM (since Hyper-V is a type 1 hypervisor).
I believe my statement holds true for any practical purpose being discussed, and it's particularly aimed at type 1 hypervisors. In a Xen setup you wouldn't say "dom0 doesn't control the vm traffic". It controls the hypervisor. The root partition is the same way in hyper-v:
Root Partition – Manages machine-level functions such as device drivers, power management, and device hot addition/removal. The root (or parent) partition is the only partition that has direct access to physical memory and devices.
It may not automatically send traffic through the windows FW because the networking setup now has traffic on a virtual switch/bridge, but the VPN creators have all the access they would ever need to control the networking from the root partition..