WSL2 does not work with GlobalProtect on localhost

[JamesDaltonGEDigital]

ssue:
We’re facing an issue with WSL2 where traffic from WSL is unable to route to Prisma when GlobalProtect (GP) is running on the host Windows machine with an Explicit Proxy enabled on Localhost 127.0.0.1:9999.

Environment Setup:
GlobalProtect VPN enabled with Explicit Proxy
Proxy PAC listening on 127.0.0.1:9999
WSL2 traffic appears to use the Windows Hyper-V loopback interface

Question :
How can we configure WSL2 traffic to route through the GlobalProtect Explicit Proxy running on the Windows host at 127.0.0.1:9999?
Specifically, we need to ensure that traffic originating from WSL2 is correctly forwarded to the proxy service bound to the Windows loopback interface, while GlobalProtect Explicit Proxy remains enabled on the host.

[github-actions]

Logs are required for review from WSL team

If this a feature request, please reply with '/feature'. If this is a question, reply with '/question'.
Otherwise, please attach logs by following the instructions below, your issue will not be reviewed unless they are added. These logs will help us understand what is going on in your machine.

How to collect WSL logs

Download and execute collect-wsl-logs.ps1 in an administrative powershell prompt:

Invoke-WebRequest -UseBasicParsing "https://raw.githubusercontent.com/microsoft/WSL/master/diagnostics/collect-wsl-logs.ps1" -OutFile collect-wsl-logs.ps1
Set-ExecutionPolicy Bypass -Scope Process -Force
.\collect-wsl-logs.ps1

The script will output the path of the log file once done.

If this is a networking issue, please use .\collect-wsl-logs.ps1 -LogProfile networking instead, following the instructions in Collect WSL logs for networking issues

Once completed please upload the output files to this GitHub issue.

See Collect WSL logs (recommended method).

If you choose to email these logs instead of attaching them to the bug, please send them to wsl-gh-logs@microsoft.com with the GitHub issue number in the subject, and include a link to your GitHub issue comment in the message body, and reply with '/emailed-logs'.

[JamesDaltonGEDigital]

/question

[github-actions]

Diagnostic information

Found '/question', adding tag 'question'

[JamesDaltonGEDigital]

/emailed-logs

[github-actions]

Diagnostic information

Found '/emailed-logs', adding tag 'emailed-logs'

[JamesDaltonGEDigital]

I had to recompress the file using 7z to get it small enough our e-mail server would allow me to send it.

[keith-horton]

WSL will set the following environment variables in the Linux container to be used by apps that are proxy aware. WSL populates these from the Windows proxy settings configured on the host. If the Windows host proxy configuration is not aware of this loopback port, you'll need to set these environment variables yourself.

To access the loopback address, you'll need to run with mirrored mode.

[JamesDaltonGEDigital]

I tried mirrored mode, I lost DNS when I did that. I have also tried explicitly setting proxies in WSL to http://localhost:9999 which when using NAT mode. This is what Windows has and I get connection refused.

[keith-horton]

OK. did you set dnsTunneling=true?
are you running a separate Linux solution that also wants to manage network settings? that has shown to be problematic when too many components each want to manage network settings.

[JamesDaltonGEDigital]

I tried it both ways and I get "could not resolve host:" both ways.

I can reproduce the problem running just one WSL2 instance and no VMs.