WSL2's Networking Modes: NAT and Mirrored, Explained
WSL2's original networking design put it behind its own virtual network, invisible to the rest of your LAN by default. Mirrored networking mode, added later, takes a fundamentally different approach — and each has real tradeoffs.
WSL2 runs inside a real, lightweight virtual machine — which means, unlike WSL1, it needs an actual virtual network interface, not just direct access to the host’s own networking stack. How that virtual network is configured has changed meaningfully since WSL2’s original design.
The original design: NAT networking
WSL2’s original and longtime-default networking mode puts the WSL2 VM behind NAT (Network Address Translation) — WSL2 gets its own private IP address on a virtual network Windows manages, translated through to the host’s actual network connection, conceptually similar to how a home router puts every device on your LAN behind one public IP address.
What NAT mode actually breaks
Because WSL2 sits behind its own private, translated network under NAT mode, other devices on your actual physical LAN can’t directly reach a service running inside WSL2 by the host machine’s own LAN IP address — a web server running inside WSL2, for instance, isn’t automatically reachable from another computer on the same network the way a service running directly on Windows would be, without additional port-forwarding configuration.
Mirrored networking mode’s different approach
Mirrored networking mode, added as a newer option, instead gives the WSL2 VM the same network interfaces and IP addressing as the Windows host itself — services running inside WSL2 become directly reachable on the LAN using the host’s own IP address, without needing NAT traversal or manual port-forwarding rules.
The tradeoffs mirrored mode actually introduces
Mirrored mode’s tighter network integration comes with its own considerations — VPN compatibility behaves differently than under NAT mode, and some networking edge cases behave differently than either a purely native Linux machine or the older NAT-based WSL2 default, since the underlying implementation is still bridging a virtualized Linux network stack with the physical host’s real interfaces.
How to actually choose between them
%UserProfile%\.wslconfig
[wsl2]
networkingMode=mirroredSetting networkingMode=mirrored in the global .wslconfig file switches to mirrored networking; omitting it or setting it to nat keeps the original default behavior.
Why this choice actually matters for real workloads
Anyone running a WSL2-hosted service that needs to be reachable from other devices on their network — testing a web app from a phone on the same Wi-Fi, for instance — runs directly into NAT mode’s isolation, making mirrored mode a genuine practical improvement for that specific, common use case rather than just a networking implementation detail.
Why NAT was the reasonable original default anyway
NAT networking is a well-understood, broadly compatible pattern that isolates WSL2’s virtual network from directly participating in the host’s LAN — a reasonable, conservative default for a virtualized subsystem, even though it created real friction for the specific, common case of wanting to reach a WSL2-hosted service from elsewhere on the same network, which mirrored mode was introduced specifically to address.