Understanding the Firewall Rule Structure
The Windows Firewall creates dynamic rules for Hyper-V virtual switches and WSL2 interfaces. These rules often include an Action=Block or Action=Allow directive along with specific profile restrictions (Domain, Private, Public). When an "Access Denied" error occurs, it is typically because a block rule takes precedence over an allow rule, or a rule was created incorrectly during a network configuration change.
Unlike standard firewall rules that have simple names like "File and Printer Sharing," Hyper-V and WSL2 rules are often named generically or contain GUIDs. You cannot reliably remove them by name alone without risking the deletion of critical system rules. Therefore, listing all rules with their properties is the first necessary step.
Identifying the Specific Rule
Open PowerShell as an Administrator. This elevation is required because modifying firewall rules affects system-wide network security settings. Run the following command to list all inbound rules related to Hyper-V or WSL2:
Get-NetFirewallRule -DisplayName "*Hyper-V*" | Select-Object Name, DisplayName, Action, Enabled, Profile
Get-NetFirewallRule -DisplayName "*WSL*" | Select-Object Name, DisplayName, Action, Enabled, ProfileIf the specific rule causing the access denied issue is not immediately visible by name, you may need to look at the actual interface index. WSL2 uses a virtual ethernet adapter. Identify this adapter's name using:
Get-NetAdapter | Where-Object {$_.InterfaceDescription -like "*WSL*"} | Select-Object Name, InterfaceIndexOnce you have the interface index or a distinctive part of the display name, filter your search further. For example, if you suspect a rule blocking port 80 or 443, you can inspect the associated filters:
Get-NetFirewallRule -Name "*WSL*" | Get-NetFirewallAddressFilter | Select-Object LocalAddress, RemoteAddressTake note of the Name property of the rule you wish to remove. It usually looks like a string such as {GUID}-Inbound-HyperV. Do not copy the entire output; only the value in the Name column is needed for the removal command.
Removing the Rule via PowerShell
With the exact rule name identified, use the Remove-NetFirewallRule cmdlet. Replace <RuleName> with the actual name you copied earlier.
Remove-NetFirewallRule -Name "<RuleName>"If the rule is stubborn or part of a group, you might need to specify the direction explicitly, though Remove-NetFirewallRule generally targets all directions for that rule ID. If you want to disable the rule instead of deleting it permanently, use:
Set-NetFirewallRule -Name "<RuleName>" -Enabled FalseThis approach is safer for troubleshooting because you can re-enable it later if the deletion causes other connectivity issues. After running the command, verify the rule no longer exists by running the initial Get-NetFirewallRule query again.
Verifying Connectivity
After removing or disabling the problematic rule, test the connection from your WSL2 instance to the target resource. Open your Linux terminal and try pinging the host IP or accessing the web server endpoint that previously returned an access denied error.
If you are still experiencing issues, check if there are multiple rules affecting the same traffic flow. Sometimes, a newly created rule overrides the one you removed. In such cases, you may need to adjust the Priority of remaining rules or ensure that the correct allow rule is present and enabled. For more information on managing virtualization software impacts, see What's the Least Impacting Virtualization Software for Running Windows 11?.
Preventing Future Issues
To avoid creating these restrictive rules inadvertently, ensure that your Hyper-V virtual switch settings are configured correctly. Avoid manually editing firewall rules unless absolutely necessary. Instead, use the Hyper-V Manager to configure NAT or External switches, which automatically generates appropriate firewall exceptions. If you need to access Hyper-V VMs through WSL2 web servers, refer to Accessing Hyper-V Virtual Machines through WSL2 Web Server for best practices on network isolation and exposure.
Frequently Asked Questions
Can I restore the deleted rule if something breaks?
No, once a rule is deleted using Remove-NetFirewallRule, it is permanently removed from the registry. You would need to recreate it manually or reboot the system to reset Hyper-V network configurations to their defaults, which will regenerate the original rules.
Why does my WSL2 instance lose internet access after removing a rule?
You may have deleted a critical outbound allow rule that permits DNS queries or general traffic. Check if any rules with Action=Allow and Direction=Outbound were affected. Re-enabling the default Hyper-V outbound rules usually restores connectivity.
Is it safe to disable all Hyper-V firewall rules?
It is not recommended. Disabling all rules exposes your host machine to potential attacks from the virtual network segment. Always target specific rules by their unique name rather than bulk-disabling categories of rules.
How do I find the rule if I don't know its name?
Use Get-NetFirewallRule with wildcards matching the interface description or application path. You can also check the Windows Event Viewer under "Windows Logs" -> "System" for events related to "FirewallEvent" which often log the rule name when blocks occur.
Does this method work for Windows 10 as well?
Yes, the PowerShell cmdlets Get-NetFirewallRule and Remove-NetFirewallRule are available in Windows 10 and Windows 11. The behavior of WSL2 networking is consistent across both modern versions of Windows.