Scott Hanselman

How to SSH into WSL2 on Windows 10 from an external machine

July 30, '20 Comments [3] Posted in Linux | Win10
Sponsored By

LinuxCool blog post eh? Good title, right?


until you have read the FOLLOW UP THE EASY WAY how to SSH into Bash and WSL2 on Windows 10 from an external machine and made the right decision for YOU!

OpenSSH has shipped in Windows for 5 years now, so that's cool. You can do lots of things!

But often folks want to SSH not into their Windows 10 machine, but rather, into WSL2 running within/behind their Windows 10 machine. While WSL2 can forward ports from the inside out (for example, localhost:8000 within a WSL2 instance being made available from the local Windows 10 machine) if you want to build a path to a WSL2 port from completely outside a machine, you'll need to be a lot more explicit.

Install OpenSSH-Server in WSL

First, install OpenSSH server inside your Linux Distro:

scott@IRONHEART:~$ sudo apt install openssh-server
[sudo] password for scott:
Reading package lists... Done
Building dependency tree
Reading state information... Done
openssh-server is already the newest version (1:7.6p1-4ubuntu0.3).
0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.

Decide on your SSH port number

Next, in WSL2, edit /etc/ssh/sshd_config and uncomment out the Port line.

I edited it with sudo nano /etc/ssh/sshd_config, no shame!

SSH is usually 22, but I like to use something like 2222 so it's less obvious but still easy to remember AND is different from your Window's machine's 22. Note that I told it to listen on, so, any adapter. You can also set PasswordAuthentication to "no" if you want to use SSH keys rather than passwords for authentication. Set it to "yes" if you know what you're doing and don't know how to use ssh keys.


Port 2222
#AddressFamily any
#ListenAddress ::


From within WSL2 get your IP address using "ifconfig." Mine is, yours will likely be 172.SOMETHINGELSE and it will change when WSL2 starts up cold.

You may want to ensure it's running, considering WSL2 has no systemd.

service ssh start

Forward Ports into WSL2

Now, from an Administrator Windows prompt - that can be cmd.exe or powershell.exe, it doesn't matter, use the net shell "netsh" to add a portproxy rule. Again, change connectaddress to YOUR WSL2 ipaddress, which is an internal address to your machine.

netsh interface portproxy add v4tov4 listenaddress= listenport=2222 connectaddress= connectport=2222

Open the Firewall

Next, from the same Administrator Windows prompt, open an incoming Firewall Port. You can do it from the Advanced Firewall Settings, but even easier you can use netsh again!

netsh advfirewall firewall add rule name=”Open Port 2222 for WSL2” dir=in action=allow protocol=TCP localport=2222

You can list all your portproxy rules like this if you're concerned:

netsh interface portproxy show v4tov4

You can remove them all if you want with

netsh int portproxy reset all

A scripted solution?

GitHub user and community member Daehahn is working on a PowerShell Script to automate this process. The comment thread starts here and the gist for the PowerShell script for wsl2-network.ps1 is here. It resets firewall and portproxies, finds your default distro's new IP, and sets you up again. Save this .ps1 somewhere, read it, and run "unblock-file wsl2-network.ps1" on it so you can set up your system quickly for Shushing into your WSL2 instance!

Note the $Ports variable that likely opens up more than you want or need, remembering that WSL and VS Code will automatically forward ports to localhost when needed for development.

Hope this helps! It would be nice if WSL2 didn't change it's internal IP address every time it starts up so that this could be made even easier and more automated.

To conclude and sum up:

  • This blog post - the one you are reading now, has Windows only forwarding ports, and uses WSL2's Linux OpenSSH and authenticates against Linux. Windows is only involved peripherally. The WSL2 IP address changes on reboot and you'll need to maintain your portproxy rules and firewall rules with the script listened at the end of that post.
  • This other blog post - over here - uses Windows' OpenSSH and authenticates with Windows and then runs WSL2. WSL2 starts up, uses bash, and Windows handles the TCP traffic.

Understand what you want and use the right one for you.

Other cool links:

Hope this helps! Also, please do subscribe to my YouTube channel!

Sponsor: Never miss a bug — send alerts to Slack or email, and find problems before your customers do, using Seq 2020.1.

About Scott

Scott Hanselman is a former professor, former Chief Architect in finance, now speaker, consultant, father, diabetic, and Microsoft employee. He is a failed stand-up comic, a cornrower, and a book author.

facebook twitter subscribe
About   Newsletter
Sponsored By
Hosting By
Dedicated Windows Server Hosting by SherWeb
Tuesday, August 04, 2020 5:08:26 AM UTC
I am drolling over this... OMG this is so sweet...who says we can't have the best of both worlds... right?
Tuesday, August 04, 2020 5:34:58 AM UTC
Scott Hanselman
Monday, August 10, 2020 9:31:07 AM UTC
check out here best monitors
Comments are closed.

Disclaimer: The opinions expressed herein are my own personal opinions and do not represent my employer's view in any way.