Cannot filter outgoing flows with Windows Defender Firewall

[Stef-Alb]

Windows Build Number

Microsoft Windows [version 10.0.18363.1533] + Microsoft Windows [version 10.0.21376.1]

WSL Version

• WSL 2
• WSL 1

Kernel Version

5.4.72 + 5.10.16

Distro Version

Debian (TheDebianProject.DebianGNULinux_76v4gfsz19hv4)

Other Software

No response

Repro Steps

Windows context :

• Only one physical network adapter (Wi-Fi), configured in IPv4 only (IPv6 disabled)
• Wi-Fi adapter connected to my local network (192.168.1.1/24), with "private" profile
• Windows Firewall enabled on all profiles, with "Block" action for both Inbound and Outbound
• Explicit rule created to block outgoing flows on Wi-Fi adapter :
  New-NetFirewallRule -Direction Outbound -InterfaceAlias "Wi-Fi" -Action Block -Enabled True -DisplayName "Test1"
• Explicit rule created to block ingoing flows on vEthernet adapter :
  New-NetFirewallRule -Direction Inbound -InterfaceAlias "vEthernet (WSL)" -Action Block -Enabled True -DisplayName "Test2"

Linux command : lynx http://212.27.63.127

Expected Behavior

The WSL2 VM should not be able to contact the remote server (host unreachable)

Objective
I want to filter outgoing flows from WSL (used in "desktop" mode) with Windows Defender Firewall. Just like for Windows apps. For security purpose, I need to block these flows by default and allow only specific remote IP addresses.

Remarks
With default configuration, I can see in Wireshark the flow going in the vEthernet adapter and out the Wi-Fi adapter.
Filtering in the WSL VM is not an option as user has full control on it

Actual Behavior

The WSL2 VM is able to contact the remote server (returns HTTP/404)

Diagnostic Logs

No response

[therealkenc]

Was able to reproduce locally on 21370, but the steps presented do not block access to remotes (for me at least) in Windows either. What is the result of curl.exe http://212.27.63.127 after your Net-NetFirewallRule -Direction Outbound step?

[Stef-Alb]

Thank you for your response. I tested the command on Windows side (builds 18363 and 21376) and connection is blocked:

Same result in Edge (ERR_NETWORK_ACCESS_DENIED)

NB: I also set the default action for outgoing connections to "Block", on all profiles. But even with "Allow" default action, the Outbound firewall rule is sufficient to block the outgoing flows on Windows side.

[microsoft-github-policy-service]

This issue has been automatically closed since it has not had any activity for the past year. If you're still experiencing this issue please re-file this as a new issue or feature request.

Thank you!