This article explains how to install Windows Subsystem for Linux (WSL) and deploy a CloudConnexa Network Connector on Windows.

Prerequisites

• Windows 11 or later.

• Administrator access to Windows PowerShell.

• A CloudConnexa Network, or permission to create one.

Install WSL

1. Open Windows PowerShell as an administrator.
   (Press Win + Q, search for Windows PowerShell, right-click it, and select Run as administrator.)

2. Run the following command:

   wsl --install

3. Restart Windows.

In some instances, you may need to run wsl --install again after rebooting to complete the installation.

Verify the installed Linux distribution

By default, WSL installs Ubuntu. To verify the installed distribution, run:

wsl --list

Keep WSL running

By default, WSL2 shuts down its virtual machine after you close all terminal windows, which stops the Connector service.

To keep WSL and the Connector running in the background:

1. Create a file named wslstart.cmd in %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup.

2. Add the following content:

   @start /b wsl --exec dbus-launch true

Deploy the Connector

Either a Host Connector or a Network Connector works in WSL. This article uses a Network Connector as an example.

Create a Network

1. Sign in to the CloudConnexa Administration Portal.

2. Go to Networks > Networks.

3. Select Add Network > Skip Wizard.

4. Enter a descriptive Network name.

5. Enter a name for the Connector.

6. Select the CloudConnexa region closest to your device.

7. Add an IP Service for the subnet or subnets that you reach through the WSL Connector.

8. Select Finish.

Deploy the Network Connector

1. Open the Network you created and select the Connectors tab.

2. Select Deploy > Deploy Connector.

3. In the distribution list, select the Linux distribution running in WSL. The deployment dialog may default to Ubuntu 24.04. Confirm the running distribution in the WSL terminal:

   hostnamectl

4. Copy the installation script and run it in the WSL terminal.

5. When prompted, paste the token shown under Generate Token.

6. Select Next.

7. Confirm that the Connector status is Connected.

Troubleshooting

The installation script automatically configures IP forwarding and NAT. If the Connector doesn't pass traffic, verify the following:

Verify IP forwarding

Run:

sudo grep 'net.ipv4.ip_forward' /etc/sysctl.conf

The output should include:

net.ipv4.ip_forward=1

If IP forwarding isn't enabled, run:

sudo sed -i 's/#net.ipv4.ip_forward=1/net.ipv4.ip_forward=1/g' /etc/sysctl.conf 
sudo sed -i 's/#net.ipv6.conf.all.forwarding=1/net.ipv6.conf.all.forwarding=1/g' /etc/sysctl.conf 
sudo sysctl -p

Verify NAT

Run:

sudo iptables -t nat -L -n -v

The expected output includes a MASQUERADE rule in the POSTROUTING chain. The outbound interface may differ from the example below:

Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target      prot opt in  out   source        destination
    0     0 MASQUERADE  all  --  *   eth0  0.0.0.0/0     0.0.0.0/0

If the rule is missing, run:

IF=$(ip route | grep -m 1 default | awk '{print $5}')
sudo iptables -t nat -A POSTROUTING -o $IF -j MASQUERADE
sudo ip6tables -t nat -A POSTROUTING -o $IF -j MASQUERADE
sudo DEBIAN_FRONTEND=noninteractive
apt install -y iptables-persistent
sudo netfilter-persistent save

Allow forwarded traffic in Windows Firewall

Windows blocks forwarded traffic by default, even when IP forwarding is enabled at the operating system level. Add Windows Firewall rules to allow this traffic.

Use one of these options.

Option 1: Allow forwarded inbound and outbound traffic

1. Open PowerShell as an administrator.

2. Run:

   netsh advfirewall firewall add rule name="Allow Forwarded Inbound" dir=in action=allow enable=yes
   netsh advfirewall firewall add rule name="Allow Forwarded Outbound" dir=out action=allow enable=yes

Option 2: Restrict the rules to the WPC subnet (100.96.0.0/11)

1. Open PowerShell as an administrator.

2. Run:

   netsh advfirewall firewall add rule name="Allow WPC Inbound" dir=in action=allow remoteip=100.96.0.0/11 enable=yes
   netsh advfirewall firewall add rule name="Allow WPC Outbound" dir=out action=allow remoteip=100.96.0.0/11 enable=yes

   Note: The default WPC subnet is 100.96.0.0/11. Verify this in the CloudConnexa Admin portal under Settings → WPC before applying these rules.