# WSL: host and guest

Keep Windows and Linux evidence separate.

Updated: 2026-11-05
Canonical: https://shortant.ai/en/guides/platform-wsl/

Adapted from Public Network Protection Guide 3.0.1. Read-only review first; no universal executable configuration is supplied.

## Inspect both sides

Record WSL version, distribution, NAT/mirrored mode, proxy location and host/guest users. Host loopback access and address-family support depend on mode and version. Do not expose a listener on every interface for convenience.

DNS tunneling and automatic proxy import may delegate behavior to the host. A guest resolver file or guest packet deny alone does not prove the host path.

## Host delegates and change scope

A guest may invoke a Windows process under a different enforcement identity. Clearing PATH does not prevent absolute-path execution. Review mounts, sockets and privileged helpers.

Follow both Windows and Linux acceptance plans. Global settings and restart commands can affect other distributions; do not stop all WSL or restart the host just to complete a check.

## Sources and scope

- [Microsoft WSL networking](https://learn.microsoft.com/en-us/windows/wsl/networking)
- [Microsoft WSL configuration scope](https://learn.microsoft.com/en-us/windows/wsl/wsl-config)

Independent educational adaptation; vendor documents retain their owners’ rights. Check the installed version and applicability. Browser scores do not verify local isolation, account access or ban risk.