Skip to content
WSLFix Published Updated 3 min readViews unavailable

Fixing a WSL Service That Windows Cannot Reach on localhost

An evidence-first WSL localhost repair path covering Linux listeners, address families, NAT versus mirrored mode, forwarding, firewalls, proxies, and persistence.

If a service works inside WSL but Windows cannot reach localhost:PORT, do not immediately add portproxy rules or disable firewalls. The failure belongs to one of four layers: the Linux process is not listening as expected, its address family/bind scope is wrong, WSL’s networking/forwarding state is stale or disabled, or Windows policy/proxy intercepts the connection.

Prove the Linux endpoint

Inside the correct distribution:

wsl.exe -l -v 2>/dev/null || true
ss -lntp
curl -v http://127.0.0.1:8000/
curl -g -v 'http://[::1]:8000/'

The first line is optional interop context; run wsl --list --verbose from Windows if interop is disabled. Confirm the expected PID, port, IPv4/IPv6 address, and application response. 127.0.0.1:8000, 0.0.0.0:8000, [::1]:8000, and [::]:8000 are different listeners.

If nothing listens, inspect the service manager/log and configuration. A dev server may default to a random port or loopback. Binding to 0.0.0.0 can make NAT forwarding easier but also broadens exposure inside guest networks; choose it only after reviewing firewall/authentication. Do not bind an unauthenticated debugger to all interfaces.

Compare Windows by address family

In PowerShell:

wsl --version
wsl --status
wsl --list --running
Test-NetConnection 127.0.0.1 -Port 8000
curl.exe -v http://127.0.0.1:8000/
curl.exe -g -v http://[::1]:8000/

If 127.0.0.1 works and localhost fails, inspect hosts/DNS and which family the client tries. If TCP connects but HTTP fails, inspect the server’s Host-header, TLS, authentication, proxy, and logs. Do not classify an HTTP 403 as a network refusal.

Record WSL networking mode in %UserProfile%\.wslconfig. In NAT mode, localhostForwarding=false disables the supported Windows-to-guest localhost behavior. Mirrored mode follows different documented connectivity/firewall rules and requires supported Windows/WSL versions.

After correcting .wslconfig, save work and run:

wsl --shutdown

Then restart the distribution/service and retest. Shutdown terminates all distros and processes, so it is an operational action, not a harmless refresh.

Inspect policy before creating new listeners

Review Windows Defender Firewall and Hyper-V firewall events/rules for WSL, plus endpoint-security and VPN policy. Compare an approved test with VPN disconnected if organizational rules allow. Never solve it by leaving all profiles disabled. In mirrored mode, configure the documented Hyper-V/Windows firewall scope for the exact service.

Proxy variables and WinHTTP/browser proxy settings can redirect HTTP requests even when raw TCP works. Ensure loopback addresses are in approved bypass lists and use Test-NetConnection to separate transport from proxy behavior.

Remove stale manual netsh interface portproxy rules created by earlier work only after inventorying them and confirming ownership. A rule targeting yesterday’s WSL NAT IP can confuse diagnosis and expose a Windows listening address to the LAN. netstat -ano/Get-NetTCPConnection can identify the Windows-side listener and process.

Verify restart and exposure

Retest after service restart, wsl --shutdown, Windows reboot, VPN connect, and WSL update. From a second LAN host, confirm the port is closed if localhost-only was intended. Check that the application’s real protocol works and that authentication is enforced.

Automate a small smoke test that records distribution name, WSL version/networking mode, listener address, Windows address family, response status, and elapsed time without logging credentials. Run it after host and WSL servicing. That turns a future recurrence into a comparable layer-by-layer result and catches the case where the port accepts connections but a different process or stale development server owns it.

The fix should be one documented correction—listener, address family, WSL setting/version, firewall, or proxy—with an acceptance matrix. Adding layers of proxies until one path works leaves both reliability and exposure unknown.

Related:

Sources:

Comments