WSL2 mirrored networking mode: diagnosing localhost port conflicts and VPN incompatibility

Answer

To verify that mirrored mode is safe for an application that shares localhost ports with Windows services, compare the interface state on both sides and run bidirectional listener tests. If any test fails while the corporate VPN is active, the VPN is likely interfering with mirrored mode and you may need to fall back to NAT mode or adjust split‑tunneling.

Confirmed facts (steps to run)

1. Confirm mirrored mode is active:
   ipconfig on Windows → note the IPv4 address of vEthernet (WSL).
   Inside WSL: ip addr show eth0 → the address must match exactly.
2. List existing listeners:
   Windows: netstat -ano | findstr :<port>.
   WSL: ss -tlnp | grep :<port>.
   Record the PID and bound address (127.0.0.1 or [::1]) for each side.
3. Bind test for conflict:
   Start a temporary listener on Windows localhost (e.g., nc -l -p <port>).
   From WSL, try to bind the same port (e.g., nc -l -p <port>).
   If the second bind fails with EADDRINUSE, the port is already occupied → mirrored mode unsafe for that port.
4. Bidirectional connectivity:
   With the Windows listener running, from WSL: curl -v http://localhost:<port> should succeed.
   With the WSL listener running, from Windows: curl -v http://localhost:<port> should succeed.
   Success in both directions indicates no routing interference.
5. Repeat with VPN active:
   Connect the corporate VPN, then repeat steps 1‑4.
   Observe any new virtual adapters, changes to the host routing table (route print), and whether any bind or curl test fails or times out.

Interpreting conflicting results

• Port conflict (EADDRINUSE) appears only when VPN is connected: The VPN likely added a virtual adapter that is not mirrored, causing split‑tunneling where the WSL stack sees a different interface. In this case, mirrored mode cannot safely share that port; revert to NAT mode or configure the VPN to exclude the WSL subnet.
• Bind succeeds but bidirectional curl fails or times out with VPN: The VPN altered routing or firewall rules blocking traffic to/from the vEthernet (WSL) adapter. Mirrored mode is still technically safe for localhost sharing, but external access (including VPN‑routed traffic) is broken. Adjust VPN split‑tunneling or host‑side firewall rules to allow traffic on the WSL adapter.
• All tests pass with VPN: Mirrored mode is compatible with your VPN configuration; you can keep it enabled.

Missing diagnostic detail that would change the recommendation

If you are unsure whether the VPN creates a virtual adapter that mirrors the WSL interface, please provide the name/subnet of the VPN‑assigned adapter (as shown by ipconfig while connected). This determines whether split‑tunneling is the root cause and whether NAT mode is required.