WSL 2 resolv.conf: DNS Dies When the VPN Connects

Browsing inside the distribution works, and the first internal hostname fails the moment the tunnel comes up. The reflex is to add a public resolver, which restores the internet and makes the corporate name unreachable for the rest of the day. On WSL 2, /etc/resolv.conf is generated output rather than configuration, and that is the mechanism worth understanding. The fix is not a better resolver, it is ownership of the file.

The file is generated, not configured

WSL 2 writes the file at start-up from the Windows adapters it can see at that moment, and it prints a comment at the top saying so. When a VPN client adds or rewrites an adapter afterwards, the distribution does not necessarily regenerate anything, and the file keeps describing a network that no longer exists.

A second failure mode is quieter: WSL may copy servers from only some adapters. If the physical adapter already has an IPv6 resolver, the IPv4 servers that the VPN adapter supplies can be dropped instead of appended, and the file looks complete while omitting exactly the one that answers internal names.

Compare the Windows view with the Linux view

Read both sides before editing. Inside the distribution, look at what the file contains and whether it is a regular file or a link. On Windows, list the resolver for each adapter, including the one the VPN created:

ls -l /etc/resolv.conf
cat /etc/resolv.conf

Get-DnsClientServerAddress -AddressFamily IPv4
Get-NetAdapter | Where-Object Status -eq 'Up'

When the VPN adapter shows the corporate servers and Linux shows something else, the disagreement is in generation rather than reachability. Compare the adapter list as well as the addresses, because a missing adapter explains a missing server. That distinction decides whether you are fixing WSL or fixing a firewall, and the two have nothing in common.

Disable generation and write your own

One documented setting stops WSL from rewriting the file, and it lives in /etc/wsl.conf. Add a network section to that file:

[network]
generateResolvConf = false

Then terminate the distribution from Windows with wsl --shutdown and start it again. If the path is a symlink rather than a regular file, remove the link before writing your own content, because writing through the link can recreate the generated target on the next start. From that point the file is yours and nothing rewrites it.

nameserver 172.28.4.10
nameserver 172.28.4.11
search site.corp.example
options timeout:1 attempts:2 rotate

Without a search domain, an unqualified hostname is completed with the public root and comes back as no such domain. timeout stops a dead first server from stalling every lookup, attempts caps how many tries a lookup spends, and rotate spreads retries instead of always starting at the top. The trade is that the file no longer follows a VPN whose resolver address changes between sessions.

Handle a resolver that moves, then verify

Some clients hand out a session-specific resolver, so a static file breaks on the next connection. Two approaches are defensible. Write the file from a small script whenever the address changes, or leave generation enabled and make sure the adapter WSL copies from carries the corporate server. The second needs no hook and fails whenever generation skips the VPN adapter; both still require the IPv6 conflict to be resolved first.

Windows also applies its own name policies, such as a suffix search list or a resolution policy for specific domains, and copying adapter addresses does not reproduce those rules. If a name resolves on Windows and not in the distribution with the same server, compare the suffix handling before blaming the tunnel.

Test with a name rather than a packet: getent hosts sensor-access0.corp.example goes through the resolver stack, while a ping may succeed against a cached or literal address. Then repeat after a disconnect and reconnect, since a setting that works once and is regenerated on resume was never fixed. Save the previous contents and note which component owns the path on that machine, so the next change begins with evidence.