network-mirrored.service.2.3.11

for2.3.11-network-mirrored.service

[Unit]
Wants=network-pre.target
Before=network-pre.target shutdown.target

[Service]
User=root
ExecStart=/bin/sh -ec '\
  [ -x /usr/bin/wslinfo ] && [ "$(/usr/bin/wslinfo --networking-mode)" = "mirrored" ] || exit 0;\
  echo 1 > /proc/sys/net/ipv4/conf/all/route_localnet;\
  nft add rule ip nat WSLPOSTROUTING "iif \"loopback0\" ip saddr 127.0.0.0/8 ip daddr != 127.0.0.0/8 counter masquerade comment mirrored"\
'
ExecStop=/bin/sh -ec '\
  [ -x /usr/bin/wslinfo ] && [ "$(/usr/bin/wslinfo --networking-mode)" = "mirrored" ] || exit 0;\
  echo 0 > /proc/sys/net/ipv4/conf/all/route_localnet;\
  for chain in "ip nat WSLPOSTROUTING";\
  do\
    handle=$(nft -a list chain $chain | sed -En "s/^.*comment \\"mirrored\\" # handle ([0-9]+)$/\\1/p");\
    for n in $handle; do echo "delete rule $chain handle $n"; done;\
  done|nft -f -\
'
RemainAfterExit=yes
[Install]
WantedBy=multi-user.target

for WSL 2.3.11 later

$ sudo systemctl stop network-mirrored
$ sudo curl -o /etc/systemd/system/network-mirrored.service https://gist.githubusercontent.com/shigenobuokamoto/b565d468541fc8be7d7d76a0434496a0/raw/04aeb41249be4a375bc838a1b5d9fe4f57b90447/network-mirrored.service
$ sudo systemctl daemon-reload
$ sudo systemctl --now enable network-mirrored

this service solves the issue of not being able to reach Docker containers via 127.0.0.1 from a Windows host.
unlike the old one, it does not use userland-proxy, but uses iptables(nftables). (This is possible from WSL 2.3.11 onwards.)

    Windows Host                  Linux WSL                 Docker
127.0.0.1 --> 127.0.0.1
                 ---------->
                            127.0.0.1 --> 127.0.0.1
                                           DNAT
                            127.0.0.1 --> 172.18.0.2
                            masquerade
                            172.18.0.1 --> 172.18.0.2
                                                 ---------->
                                                          172.18.0.1 --> 172.18.0.2
                                                          172.18.0.1 <-- 172.18.0.2
                                                 <----------
                             172.18.0.1 <-- 172.18.0.2
                             masquerade(return)
                             127.0.0.1 <-- 172.18.0.2
                                            DNAT(return)
                            127.0.0.1 <-- 127.0.0.1
                 <----------
127.0.0.1 <-- 127.0.0.1

in addition, communication is possible from 127.0.0.0/8 <--> 127.0.0.0/8, but some missing route have been added.
removed in revision 4.

this script is no longer needed.

please use Docker 27.3.0 or later.