01

Decide on the networking mode first

WSL2 uses NAT by default, and the distribution does not share the Windows loopback address. Pointing a WSL shell at 127.0.0.1 will therefore never reach the client. This single detail accounts for most failed attempts.

Recent Windows 11 builds support mirrored networking: add networkingMode=mirrored under the wsl2 section of .wslconfig in your user folder, restart WSL, and 127.0.0.1 works directly. That is by far the least painful route. If you stay on NAT you need the Windows host address inside the WSL subnet, and you must turn on allow LAN, otherwise the core listens on loopback only and nothing outside can reach it.

Suspect the firewall first
Enabling LAN access triggers one Windows firewall prompt. If it was dismissed, every later step will fail silently.

SponsoredWhere does the subscription link come from?Our partner provider gives you 1 GB of high-speed Hong Kong data at signup — import it in one click.Get high-speed nodes
02

Four steps to connect

  1. 1

    Turn on allow LAN

    Enable it in Clash settings. The first time, Windows will ask about firewall access; allow it at least for private networks.

  2. 2

    Find the host address in NAT mode

    Inside WSL run ip route show default. The third field is the Windows host address; put it in https_proxy. That address can change every time WSL restarts, so read it dynamically in .bashrc rather than hard-coding it.

  3. 3

    Docker Desktop proxy settings

    Under Resources then Proxies, set the manual proxy to http://host.docker.internal with your port. Note that this only covers image pulls and builds. Programs running inside containers are not affected by it.

  4. 4

    Inside the container

    Pass HTTPS_PROXY and HTTP_PROXY with -e on docker run, or set defaults in the proxies section of .docker/config.json in your user folder. Add localhost and any internal registry to noProxy at the same time.

03

Test both sides separately

In WSL, curl ipinfo.io/ip and check that you get a node address back. On the Docker side, run a throwaway container with curl against the same URL. WSL working does not mean containers work, so test them independently.

  • Mirrored and NAT setups are not interchangeable; the loopback address changes with the mode
  • Changes to .wslconfig need wsl --shutdown before they take effect
  • Add local registries to noProxy or nearby pulls get slower, not faster
04

Common questions

I use TUN mode. Do I still need to configure WSL?

It depends on the networking mode. Mirrored networking is usually intercepted correctly. Under NAT, WSL traffic goes through a Hyper-V virtual switch and can bypass the TUN adapter entirely, so environment variables remain the reliable option.

It worked yesterday and fails today.

Check whether the host address changed. In NAT mode it can change on every WSL restart, so a hard-coded value goes stale. Read it at shell startup instead.