WSL alone cannot resolve names while a VPN is connected

Troubleshooting guideSources checked: 2026-09-05FaultNote editorial team

What to do first

WSL alone cannot resolve names while a VPN is connected. VPN NRPT rules, enterprise firewall policy, or an older NAT DNS proxy configuration may conflict with WSL DNS requests. Record the current state before changing it, use only the supported Windows path described below, and verify the same operation again after any required restart.

This is a general troubleshooting guide, not an announcement of a current outage.

Affected products and symptoms

Product: WSL 2
Versions and conditions: Windows 11 (confirm the edition and hardware requirements for the feature)
Error codes and identifiers: DNS

Symptoms

WSL alone cannot resolve names while a VPN is connected.
The same condition can persist after a retry or restart.

Causes and conditions

VPN NRPT rules, enterprise firewall policy, or an older NAT DNS proxy configuration may conflict with WSL DNS requests.

Before you start

Save open documents and allow time for a Windows restart if required.
Run administrative actions only on a personally managed PC or with administrator approval.
Save the diagnostic command output so the before and after states can be compared.

Precautions

Do not bulk-delete registry entries, system folders, credentials, or storage metadata.
Do not run unofficial scripts or unknown drivers with administrator rights.

WSL 2 troubleshooting sequence: Compare Windows and Linux name resolution; Check the state with wsl; Repair through the supported path; Apply the .wslconfig DNS setting; Verify under the same conditions — Procedure overview created by FaultNote. Read the precautions and full instructions before changing settings. Read the full steps

Step-by-step instructions

01
Compare Windows and Linux name resolution
#
Check whether Windows can open the target site and run getent hosts microsoft.com inside WSL. If only an internal hostname fails, include it in the report to your administrator. Compare without the VPN only when your organization permits it.
02
Check the state with wsl
#
Update the Store-delivered WSL package and, on Windows 11 22H2 or later, determine whether DNS tunneling is available.
Command or path
```
wsl --version
```
03
Repair through the supported path
#
Check and save work in every running WSL distribution. Because wsl --shutdown stops all distributions and the WSL 2 VM, run it only when other WSL work and containers may also stop.
04
Apply the .wslconfig DNS setting
#
Confirm that you use a compatible WSL release on Windows 11 22H2 or later. Open %UserProfile% in File Explorer and back up an existing .wslconfig. Set dnsTunneling=true under [wsl2], without creating a duplicate section. Save your Linux work, run wsl --shutdown in Windows, and reopen the distribution.
If /etc/wsl.conf inside Linux contains generateResolvConf=false, DNS tunneling may not work. Back up previously changed configuration, review it with the administrator, and do not combine DNS tunneling with a custom fixed-DNS setup.
05
Verify under the same conditions
#
Run getent hosts microsoft.com and repeat the original operation once under the same conditions. If it succeeds, verify again after a restart and record the setting that changed.
Check that no new critical event with the same timestamp and component appears in Event Viewer.
Command or path
```
getent hosts microsoft.com
```

Check the result

The feature starts, connects, or completes without the original error.
The verification command reports the expected enabled, healthy, or connected state.
The result remains correct after a Windows restart and no new matching critical event appears.

If the problem continues

If the same code persists, provide the full message, Windows build, command output, and occurrence time to the PC administrator or Microsoft Support.
If hardware requirements, organization policy, or server settings are responsible, ask the owner to make the change instead of bypassing it on the client.

Scope of this guide

Troubleshooting guide — Restore the feature so it starts, connects, or completes normally and passes the same verification after a Windows restart.

Frequently asked questions

Should I hard-code a DNS server in resolv.conf?

A corporate VPN can change DNS servers and search suffixes, so a fixed value is brittle. Prefer DNS tunneling and follow VPN administrator policy.

Why does old DNS state remain after the change?

Run `wsl --shutdown` to stop every distribution, restart WSL, and test with `getent hosts`.

Official sources and dates

Source publication or resolution date: Not specified. Sources checked: 2026-09-05. The check date is not the date the problem first occurred. Interface labels can vary between versions and display languages.

Related troubleshooting guides

← Search English guides