> Source: [sk177207](https://support.checkpoint.com/results/sk/sk177207)

# sk177207 - WSL2 support by Endpoint Security Client Firewall blade

| Property | Value |
|----------|-------|
| Solution ID | sk177207 |
| Date Created | 2022-01-05 |
| Last Modified | 2022-01-06 |
| Technical Level | General |
| Products | Endpoint Security |
| Versions | Cloud, E89.X, E88.X |

## Symptoms

- * No network access from WSL2
* DNS does not work from WSL2
* WSL2 has no access to services on the host

## Cause

WSL2 uses Hyper-V to run Linux inside VM.  
As a network adapter, it uses Hyper-V Virtual Switch that provides internal type Hyper-V network, which is only accessible from the VM and the host.  

Windows randomly generates a subnet inside 172.16.0.0/12 or 192.168.0.0/16 for Hyper-V Virtual Switch. As a result, WSL2 has a random IP address after each reboot.  

Also, by default, WSL2 uses host as a name resolver. Therefore, port 53 should be opened on host in order to resolve domain names.

## Solution

Currently it is not possible to configure static IP for WSL2.  

In order to allow access to external network from WSL2, add the following rule to the inbound rules of Firewall policy:  

` <rule enable="true" name="Allow WSL2 Subnets" ruleID="8" comments="">`  
` <execute action="accept"/>`  
` <source>`  
` <ipsubnet address="192.168.0.0" mask="255.255.0.0" operation="maskeq"/>`  
` <ipsubnet address="172.16.0.0" mask="255.240.0.0" operation="maskeq"/>`  
` </source>`  
` </rule>`  

Example:  
![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk177207/2022-01-05_13h22_32202201051328312.png)  

This rule allows access to the network from any VM, from two private subnets: 172.16.0.0/12 and 192.168.0.0/16.  

In order to allow using a host as a name server, add the following rule to the outbound rules  
of the Firewall policy:  

` <rule enable="true" name="Allow WSL2 DNS" ruleID="9" comments="">`  
` <execute action="accept"/>`  
` <destination>`  
` <ipsubnet address="192.168.0.0" mask="255.255.0.0" operation="maskeq"/>`  
` <ipsubnet address="172.16.0.0" mask="255.240.0.0" operation="maskeq"/>`  
` </destination>`  
` <protocols>`  
` <tcpudpprotocol protocol="IP_TCP" srcport="any" dstport="53"/>`  
` <tcpudpprotocol protocol="IP_UDP" srcport="any" dstport="53"/>`  
` </protocols>`  
` </rule>`  

Example:  
![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk177207/2022-01-05_13h36_06202201051337443.png)  

This rule opens port number 53 on the host for any VM in two private subnets. Similar rules are required for WSL2 to access other host services, like FTP, HTTP, etc.  

Example from web console for both rules:  
![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk177207/2022-01-06_18h28_43_75202201061836191.png)  

Another solution for resolving a DNS issue is to configure WSL2 for using a third-party DNS server. Instructions for this depend on used Linux distribution. For Ubuntu and Debian, refer to [Fix WSL2 DNS resolution](https://gist.github.com/coltenkrauter/608cfe02319ce60facd76373249b8ca6 "Fix WSL2 DNS resolution").

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content