amnezia-vpn/amnezia-client

Fork 0

mirror of https://github.com/amnezia-vpn/amnezia-client.git synced 2026-10-14 21:34:26 +00:00

[GH-ISSUE #2026] AmneziaWG protocol not work in WSL2 #882

New issue

Open

opened 2026-10-13 20:30:30 +00:00 by bsakaguchi · 3 comments

bsakaguchi commented

2026-10-13 20:30:30 +00:00

Owner

Originally created by @gedovirhir on GitHub (Nov 28, 2025).
Original GitHub issue: https://github.com/amnezia-vpn/amnezia-client/issues/2026

When I run AmneziaVPN (via my VPS server with AmneziaWG protocol) on Windows, then I try to make any request from WSL2 (Ubuntu) and it doesn't go. If I use OpenVPN protocol, everything is fine, so I think this behavior can be fixed AmneziaWG.

Steps to reproduce the behavior:

Connect AmneziaVPN on your Windows OS
Run WSL2 Ubuntu and open it
Try to make curl -s https://api.ipify.org

Expected behavior

The request curl -s https://api.ipify.org should be executed and get the IP of your server.

Desktop:

OS: Microsoft Windows 11 Pro [Version 10.0.26100.7171] + WSL 2.6.1.0 with Ubuntu 22.04.4 LTS

Server:

OS: Ubuntu 22.04.5 LTS

Originally created by @gedovirhir on GitHub (Nov 28, 2025). Original GitHub issue: https://github.com/amnezia-vpn/amnezia-client/issues/2026 When I run AmneziaVPN (via my VPS server with AmneziaWG protocol) on Windows, then I try to make any request from WSL2 (Ubuntu) and it doesn't go. If I use OpenVPN protocol, everything is fine, so I think this behavior can be fixed AmneziaWG. **Steps to reproduce the behavior:** 1. Connect AmneziaVPN on your Windows OS 2. Run WSL2 Ubuntu and open it 3. Try to make `curl -s https://api.ipify.org` **Expected behavior** The request `curl -s https://api.ipify.org` should be executed and get the IP of your server. **Desktop:** - OS: Microsoft Windows 11 Pro [Version 10.0.26100.7171] + WSL 2.6.1.0 with Ubuntu 22.04.4 LTS **Server:** - OS: Ubuntu 22.04.5 LTS

bsakaguchi commented

2026-10-13 20:30:32 +00:00

Author

Owner

@ArtemB91 commented on GitHub (Dec 4, 2025):

Add 172.16.0.0/12 to split tunelling

@ArtemB91 commented on GitHub (Dec 4, 2025): Add 172.16.0.0/12 to split tunelling

bsakaguchi commented

2026-10-13 20:30:32 +00:00

Author

Owner

@wvolkov commented on GitHub (Feb 15, 2026):

👍

There is no such issue with Wireguard Windows client however. I suppose this is due creation of a separate routing table, adding to the default route to the WireGuard interface only in that table with fwmark to exempt WireGuard's own encrypted UDP packets, and critically adds a rule (suppress_prefixlength 0) that preserves all existing non-default routes from the main table. That last bit is the magic — it means the route to the WSL virtual subnet (172.23.192.0/x via vEthernet (WSL)) stays active because it's a more-specific route than the default, and it's explicitly preserved. that there is no such issue with ordinary WG client for windows.

Current workaround is to use split-tunnel or some post-amnezia-launch-in-full-tunnel powershell script something like

route add 172.23.192.0 mask 255.255.240.0 172.23.192.1 IF 61 metric 1

@wvolkov commented on GitHub (Feb 15, 2026): 👍 There is no such issue with Wireguard Windows client however. I suppose this is due creation of a separate routing table, adding to the default route to the WireGuard interface only in that table with `fwmark` to exempt WireGuard's own encrypted UDP packets, and critically adds a rule (`suppress_prefixlength 0`) that preserves all existing non-default routes from the main table. That last bit is the magic — it means the route to the WSL virtual subnet (172.23.192.0/x via vEthernet (WSL)) stays active because it's a more-specific route than the default, and it's explicitly preserved. that there is no such issue with ordinary WG client for windows. Current workaround is to use split-tunnel or some post-amnezia-launch-in-full-tunnel powershell script something like ```powershell route add 172.23.192.0 mask 255.255.240.0 172.23.192.1 IF 61 metric 1 ```

bsakaguchi commented

2026-10-13 20:30:32 +00:00

Author

Owner

@Mixmaybe commented on GitHub (Aug 23, 2026):

This worked for me on Windows 11 + WSL2 + AmneziaWG.

In PowerShell, run:

wsl --update
notepad.exe $env:USERPROFILE\.wslconfig

Add the following to the .wslconfig file that opens in Notepad:

[wsl2]
networkingMode=mirrored
dnsTunneling=true
autoProxy=true
firewall=true

In Ubuntu, check the DNS configuration:

grep -n generateResolvConf /etc/wsl.conf

The command will most likely return nothing, so open the file:

sudo nano /etc/wsl.conf

If it contains:

generateResolvConf=false

remove that line or change the value to true.

If there is no such setting, add the following at the end of the file:

[network]
generateResolvConf=true

Then disconnect AmneziaVPN, close WSL, and run the following commands in PowerShell:

wsl --shutdown
ipconfig /flushdns

After that, connect to AmneziaWG first and then launch WSL.

Check your IP address in Windows:

Invoke-RestMethod https://api.ipify.org

Then check it in WSL:

curl -4 --max-time 10 https://api.ipify.org

If both IP addresses match, WSL is accessing the internet through AmneziaWG.

@Mixmaybe commented on GitHub (Aug 23, 2026): This worked for me on Windows 11 + WSL2 + AmneziaWG. In PowerShell, run: ```powershell wsl --update notepad.exe $env:USERPROFILE\.wslconfig ``` Add the following to the `.wslconfig` file that opens in Notepad: ```ini [wsl2] networkingMode=mirrored dnsTunneling=true autoProxy=true firewall=true ``` In Ubuntu, check the DNS configuration: ```bash grep -n generateResolvConf /etc/wsl.conf ``` The command will most likely return nothing, so open the file: ```bash sudo nano /etc/wsl.conf ``` If it contains: ```ini generateResolvConf=false ``` remove that line or change the value to `true`. If there is no such setting, add the following at the end of the file: ```ini [network] generateResolvConf=true ``` Then disconnect AmneziaVPN, close WSL, and run the following commands in PowerShell: ```powershell wsl --shutdown ipconfig /flushdns ``` After that, connect to AmneziaWG first and then launch WSL. Check your IP address in Windows: ```powershell Invoke-RestMethod https://api.ipify.org ``` Then check it in WSL: ```bash curl -4 --max-time 10 https://api.ipify.org ``` If both IP addresses match, WSL is accessing the internet through AmneziaWG.

bsakaguchi referenced this issue

2026-10-14 21:06:47 +00:00

[PR #2877] feat(windows): native ARM64 support and OpenVPN data channel offload #2999