Fix mirrored networking loopback endpoint creation failure #14081

benm-dev · 2026-01-18T11:08:40Z

Summary of the Pull Request

Fix loopback endpoint creation failure in mirrored networking mode after KB5074109.

PR Checklist

Closes: WSL mirror network mode is broken in the latest stable windows update #14080
Communication: Issue documented and investigated
Tests: Manual validation performed (see below)
Localization: No user-facing strings
Dev docs: N/A
Documentation updated: N/A

Detailed Description

After KB5074109, HNS loopback networks reject firewall policies when creating endpoints, returning error 0x803B001B. This fix detects loopback networks via IsLoopback property and uses simplified endpoint settings without policies.

Validation Steps Performed

Direct HCN API testing confirmed:
- Endpoint WITH firewall policy → 0x803B001B (FAIL)
- Endpoint with HostComputeNetwork only → 0x00000000 (SUCCESS)
WSL localhost TCP connectivity verified working with correct endpoint settings
Tested on Windows Build 26220.7535

## Problem After installing KB5074109 (January 2026), WSL mirrored networking fails to create the loopback endpoint, causing localhost (127.0.0.1) TCP/UDP connections to fail. Users see the loopback0 interface in state DOWN with NO-CARRIER. ## Root Cause Analysis HNS loopback networks no longer accept firewall policies when creating endpoints. Direct HCN API testing confirms: - Test 1: Endpoint WITH firewall policy -> 0x803B001B (FAIL) Error: 'Invalid JSON document string. {{Policies.VmCreatorId,UnknownField}}' - Test 2: Endpoint with VirtualNetwork field -> 0x803B001B (FAIL) Error: 'Invalid JSON document string. {{VirtualNetwork,UnknownField}}' - Test 3: Endpoint with HostComputeNetwork only -> 0x00000000 (SUCCESS) The current code in MirroredNetworking::AddNetworkEndpoint() creates all endpoints with firewall policies when m_config.FirewallConfig.Enabled() is true (the default), causing loopback endpoint creation to fail silently. ## Solution - Add IsLoopback field to HNSNetwork struct to detect loopback networks - Skip firewall policies when creating endpoints on loopback networks - Use HostComputeNetwork instead of VirtualNetwork for loopback endpoints ## Testing Verified on Windows Build 26220.7535: 1. HCN API tests confirm endpoint creation succeeds without firewall policies 2. WSL localhost TCP connectivity works when loopback0 is properly configured Fixes microsoft#14080 Related: microsoft#14063

benm-dev · 2026-01-18T11:09:43Z

@microsoft-github-policy-service agree

Copilot

Pull request overview

This PR fixes a critical bug in mirrored networking mode where loopback endpoint creation fails after Windows update KB5074109. The fix detects loopback networks and uses simplified endpoint settings without firewall policies to avoid HCN error 0x803B001B.

Changes:

Added loopback network detection logic to skip firewall policy application
Created separate endpoint configuration path for loopback networks using HostComputeNetwork
Extended HNSNetwork schema to include IsLoopback property for network type detection

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
src/windows/service/exe/MirroredNetworking.cpp	Added conditional logic to detect loopback networks and configure endpoints without firewall policies, using HostComputeNetwork instead of VirtualNetwork
src/shared/inc/hns_schema.h	Added IsLoopback boolean field to HNSNetwork struct with JSON serialization support

offsechq · 2026-01-18T13:51:24Z

lgtm

ikifar2012 · 2026-01-18T20:34:13Z

Is this the same as issue #13454

offsechq · 2026-01-18T22:27:17Z

Doesn't look like it, that is more generic and solvable by resetting the adapter as the reply here

benhillis · 2026-01-20T16:19:08Z

@keith-horton - does this look reasonable to you? Do you have any context on the Windows change that recently broke this?

keith-horton · 2026-01-24T01:31:07Z

@keith-horton - does this look reasonable to you? Do you have any context on the Windows change that recently broke this?

The fix referred to in that KB article was not in WSL - it was in other parts of the TCPIP / vswitch stack - where we addressed a perf issue, but the NBL (kernel structure representing one or more packets) could have fields that some VPN vendors did not expect (though was perfectly legal) -- which was exercised in the WSL path. So we had to revert that and fix it in a way that did not break some VPNs.

So I don't know what would have changed that would have affected the above.

The author of this PR is correct: Hyper-V Firewall rules do not affect the loopback path.

keith-horton

Thank you for doing this investigation and testing.

WSL supports older versions of Windows that does not support Hyper-V Firewall. This looks correct to me - minus the change I noted below.

keith-horton · 2026-01-24T01:33:09Z

src/windows/service/exe/MirroredNetworking.cpp

            hnsEndpoint.Policies.emplace_back(std::move(endpointFirewallPolicy));
            endpointSettings = ToJsonW(hnsEndpoint);
        }
+        else if (isLoopbackNetwork)


can you make this to be:

else if (m_config.FirewallConfig.Enabled() && isLoopbackNetwork)
?

The else block exists when !m_config.FirewallConfig -- i.e., versions of Windows that does not have support for Hyper-V Firewall.

Sorry, I don't see how this is resolved.

…licy

ptrivedi · 2026-01-28T15:54:26Z

src/windows/service/exe/MirroredNetworking.cpp

+            // Loopback networks require HostComputeNetwork (not VirtualNetwork) and don't support policies
+            hns::HostComputeEndpoint hnsEndpoint{};
+            hnsEndpoint.HostComputeNetwork = NetworkId;
+            hnsEndpoint.SchemaVersion.Major = 2;


nit: assuming these version numbers are hardcoded elsewhere too. Would be good to declare named constant that can be repeatedly used

yeah I worry a little bit about this schema version, do we know everywhere that supports mirrored networking supports 2.16?

keith-horton · 2026-01-28T17:07:43Z

src/windows/service/exe/MirroredNetworking.cpp

            hnsEndpoint.Policies.emplace_back(std::move(endpointFirewallPolicy));
            endpointSettings = ToJsonW(hnsEndpoint);
        }
+        else if (isLoopbackNetwork)


Sorry, I don't see how this is resolved.

benm-dev · 2026-01-28T23:42:24Z

Hi @keith-horton , I updated this in commit c61ba69 - the condition now reads:

else if (m_config.FirewallConfig.Enabled() && isLoopbackNetwork)

The diff you're viewing is marked "Outdated" which shows the old code. Let me know if there's anything else needed!

keith-horton

Great. Thanks for doing this!

…licy

benhillis · 2026-02-02T21:36:34Z

src/windows/service/exe/MirroredNetworking.cpp

+        // HostComputeNetwork instead of VirtualNetwork in the endpoint settings.
+        // See: https://github.com/microsoft/WSL/issues/14080
+        const bool isLoopbackNetwork = properties.IsLoopback;
+        if (isLoopbackNetwork)


@benm-dev - should this be moved into the else if below?

benm-dev requested a review from a team as a code owner January 18, 2026 11:08

benm-dev requested review from Brian-Perkins, OneBlue, benhillis, Copilot and craigloewen-msft January 18, 2026 11:08

Copilot started reviewing on behalf of benm-dev January 18, 2026 11:09 View session

Copilot AI reviewed Jan 18, 2026

View reviewed changes

benhillis added the network label Jan 20, 2026

benhillis requested a review from keith-horton January 20, 2026 16:18

benhillis assigned keith-horton Jan 20, 2026

keith-horton requested changes Jan 24, 2026

View reviewed changes

benm-dev added 2 commits January 27, 2026 15:41

Merge branch 'master' into fix/mirrored-loopback-endpoint-firewall-po…

9b98050

…licy

update loopback network endpoint firewall policy check

c61ba69

benm-dev requested a review from keith-horton January 27, 2026 05:13

ptrivedi reviewed Jan 28, 2026

View reviewed changes

keith-horton requested changes Jan 28, 2026

View reviewed changes

benm-dev requested a review from keith-horton January 28, 2026 23:46

keith-horton approved these changes Jan 29, 2026

View reviewed changes

Merge branch 'master' into fix/mirrored-loopback-endpoint-firewall-po…

65c96d9

…licy

benhillis reviewed Feb 2, 2026

View reviewed changes

offsechq mentioned this pull request Feb 5, 2026

WSL mirror network mode is broken in the latest stable windows update #14080

Open

2 tasks

Fix mirrored networking loopback endpoint creation failure #14081

Are you sure you want to change the base?

Fix mirrored networking loopback endpoint creation failure #14081

Conversation

benm-dev commented Jan 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary of the Pull Request

PR Checklist

Detailed Description

Validation Steps Performed

Uh oh!

benm-dev commented Jan 18, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

offsechq commented Jan 18, 2026

Uh oh!

ikifar2012 commented Jan 18, 2026

Uh oh!

offsechq commented Jan 18, 2026

Uh oh!

benhillis commented Jan 20, 2026

Uh oh!

keith-horton commented Jan 24, 2026

Uh oh!

keith-horton left a comment

Choose a reason for hiding this comment

Uh oh!

keith-horton Jan 24, 2026

Choose a reason for hiding this comment

Uh oh!

keith-horton Jan 28, 2026

Choose a reason for hiding this comment

Uh oh!

ptrivedi Jan 28, 2026

Choose a reason for hiding this comment

Uh oh!

benhillis Feb 2, 2026

Choose a reason for hiding this comment

Uh oh!

keith-horton Jan 28, 2026

Choose a reason for hiding this comment

Uh oh!

benm-dev commented Jan 28, 2026

Uh oh!

keith-horton left a comment

Choose a reason for hiding this comment

Uh oh!

benhillis Feb 2, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

benm-dev commented Jan 18, 2026 •

edited

Loading