[{"data":1,"prerenderedAt":2322},["ShallowReactive",2],{"blog-\u002Fblog\u002Fwsl2-clash-huorong-troubleshooting":3,"blog-siblings-\u002Fblog\u002Fwsl2-clash-huorong-troubleshooting":2313},{"id":4,"title":5,"body":6,"category":2296,"date":2297,"description":2298,"draft":2299,"extension":2300,"meta":2301,"navigation":179,"path":2302,"seo":2303,"source":2304,"stem":2305,"tags":2306,"__hash__":2312},"blog\u002Fblog\u002Fwsl2-clash-huorong-troubleshooting.md","WSL2 + Clash + 火绒 踩坑排查记录",{"type":7,"value":8,"toc":2265},"minimark",[9,14,26,30,98,101,104,107,218,224,226,230,235,246,249,277,283,287,294,326,332,340,350,407,413,417,424,438,443,506,509,544,550,554,561,567,580,596,613,623,629,635,641,645,656,668,671,682,685,691,697,700,709,712,741,751,755,766,795,812,819,823,826,892,902,905,914,917,923,929,933,939,946,949,981,987,990,996,999,1006,1009,1013,1019,1080,1086,1092,1095,1286,1291,1312,1330,1332,1336,1343,1408,1418,1425,1428,1448,1450,1453,1457,1473,1477,1516,1522,1532,1544,1556,1560,1571,1573,1576,1582,1588,1591,1596,1610,1615,1640,1656,1661,1670,1673,1711,1716,1754,1756,1759,1763,1869,1873,2023,2025,2029,2130,2132,2135,2220,2222,2225,2228,2244,2254,2261],[10,11,13],"h1",{"id":12},"wsl2-clash-tun-火绒一次-dns-故障牵出的网络断网踩坑记录","WSL2 + Clash TUN + 火绒：一次 DNS 故障牵出的网络断网踩坑记录",[15,16,17],"blockquote",{},[18,19,20,21,25],"p",{},"起因只是 WSL 内 DNS 解析失败，结果一路改配置改到彻底断网，最后发现真凶是火绒安全的 ",[22,23,24],"strong",{},"ARP 防护","误伤了 Hyper-V 虚拟网卡。\n本文完整记录排查过程、走过的弯路和最终方案，给同样环境的朋友参考。",[27,28,29],"h2",{"id":29},"环境信息",[31,32,33,46],"table",{},[34,35,36],"thead",{},[37,38,39,43],"tr",{},[40,41,42],"th",{},"项目",[40,44,45],{},"版本\u002F配置",[47,48,49,58,66,74,82,90],"tbody",{},[37,50,51,55],{},[52,53,54],"td",{},"操作系统",[52,56,57],{},"Windows 11 Pro 26200",[37,59,60,63],{},[52,61,62],{},"WSL 版本",[52,64,65],{},"2.7.3.0（内核 6.6.114.1-1）",[37,67,68,71],{},[52,69,70],{},"WSL 发行版",[52,72,73],{},"Ubuntu",[37,75,76,79],{},[52,77,78],{},"代理工具",[52,80,81],{},"Mihomo Party（Clash 系列），TUN 模式",[37,83,84,87],{},[52,85,86],{},"安全软件",[52,88,89],{},"火绒安全",[37,91,92,95],{},[52,93,94],{},"其他虚拟化",[52,96,97],{},"VMware Workstation、Hyper-V",[99,100],"hr",{},[27,102,103],{"id":103},"初始症状",[18,105,106],{},"Windows 上 Clash TUN 模式工作正常，浏览器、终端访问外网都没问题。但 WSL 内表现异常：",[108,109,114],"pre",{"className":110,"code":111,"language":112,"meta":113,"style":113},"language-bash shiki shiki-themes github-light github-dark","peanut@Snow:~$ ping 8.8.8.8\n64 bytes from 8.8.8.8: icmp_seq=1 ttl=106 time=175 ms     # IP 可达\n\npeanut@Snow:~$ ping baidu.com\nping: baidu.com: Temporary failure in name resolution    # 域名解析失败\n","bash","",[115,116,117,134,174,181,191],"code",{"__ignoreMap":113},[118,119,122,126,130],"span",{"class":120,"line":121},"line",1,[118,123,125],{"class":124},"sScJk","peanut@Snow:~$",[118,127,129],{"class":128},"sZZnC"," ping",[118,131,133],{"class":132},"sj4cs"," 8.8.8.8\n",[118,135,137,140,143,146,149,152,155,158,161,164,167,170],{"class":120,"line":136},2,[118,138,139],{"class":124},"64",[118,141,142],{"class":128}," bytes",[118,144,145],{"class":128}," from",[118,147,148],{"class":128}," 8.8.8.8:",[118,150,151],{"class":128}," icmp_seq=",[118,153,154],{"class":132},"1",[118,156,157],{"class":128}," ttl=",[118,159,160],{"class":132},"106",[118,162,163],{"class":128}," time=",[118,165,166],{"class":132},"175",[118,168,169],{"class":128}," ms",[118,171,173],{"class":172},"sJ8bj","     # IP 可达\n",[118,175,177],{"class":120,"line":176},3,[118,178,180],{"emptyLinePlaceholder":179},true,"\n",[118,182,184,186,188],{"class":120,"line":183},4,[118,185,125],{"class":124},[118,187,129],{"class":128},[118,189,190],{"class":128}," baidu.com\n",[118,192,194,197,200,203,206,209,212,215],{"class":120,"line":193},5,[118,195,196],{"class":124},"ping:",[118,198,199],{"class":128}," baidu.com:",[118,201,202],{"class":128}," Temporary",[118,204,205],{"class":128}," failure",[118,207,208],{"class":128}," in",[118,210,211],{"class":128}," name",[118,213,214],{"class":128}," resolution",[118,216,217],{"class":172},"    # 域名解析失败\n",[18,219,220,223],{},[22,221,222],{},"典型症状","：IP 层通，DNS 层不通。第一直觉是 DNS 配置问题。",[99,225],{},[27,227,229],{"id":228},"排查过程按时间顺序","排查过程（按时间顺序）",[231,232,234],"h3",{"id":233},"第一阶段怀疑-dns方向错误","第一阶段：怀疑 DNS（方向错误）",[18,236,237,238,241,242,245],{},"第一反应是检查 ",[115,239,240],{},"\u002Fetc\u002Fresolv.conf","，WSL 默认自动生成的 DNS 指向 Windows 主机网关（",[115,243,244],{},"172.28.32.1","），但 Clash TUN 接管全局后，这个网关的 DNS 转发可能被破坏。",[18,247,248],{},"最初尝试的方案有三个：",[250,251,252,263,270],"ol",{},[253,254,255,256,258,259,262],"li",{},"手动覆盖 ",[115,257,240],{}," 写入 ",[115,260,261],{},"223.5.5.5","（最快，治标）",[253,264,265,266,269],{},"调整 Clash DNS 配置（",[115,267,268],{},"dns-hijack: ['any:53']","）（治本）",[253,271,272,273,276],{},"启用 WSL2 ",[22,274,275],{},"镜像网络模式","（最优雅，复用 Windows 网络栈）",[18,278,279,282],{},[22,280,281],{},"选了方案 3","，准备一劳永逸。结果，灾难开始。",[231,284,286],{"id":285},"第二阶段镜像模式失败全面断网","第二阶段：镜像模式失败，全面断网",[18,288,289,290,293],{},"修改 ",[115,291,292],{},"C:\\Users\\\u003C用户>\\.wslconfig","：",[108,295,299],{"className":296,"code":297,"language":298,"meta":113,"style":113},"language-ini shiki shiki-themes github-light github-dark","[wsl2]\nnetworkingMode=mirrored\ndnsTunneling=true\nfirewall=true\nautoProxy=true\n","ini",[115,300,301,306,311,316,321],{"__ignoreMap":113},[118,302,303],{"class":120,"line":121},[118,304,305],{},"[wsl2]\n",[118,307,308],{"class":120,"line":136},[118,309,310],{},"networkingMode=mirrored\n",[118,312,313],{"class":120,"line":176},[118,314,315],{},"dnsTunneling=true\n",[118,317,318],{"class":120,"line":183},[118,319,320],{},"firewall=true\n",[118,322,323],{"class":120,"line":193},[118,324,325],{},"autoProxy=true\n",[18,327,328,331],{},[115,329,330],{},"wsl --shutdown"," 后重启 WSL，报错：",[108,333,338],{"className":334,"code":336,"language":337},[335],"language-text","wsl: 出现了内部错误。\n错误代码: CreateInstance\u002FCreateVm\u002FConfigureNetworking\u002F0x8007054f\nwsl: 无法配置网络 (networkingMode Mirrored)，回退到 networkingMode None。\n","text",[115,339,336],{"__ignoreMap":113},[18,341,342,345,346,349],{},[22,343,344],{},"关键陷阱","：WSL 没有回退到 NAT，而是回退到 ",[22,347,348],{},"None 模式","（完全无网络）。",[108,351,353],{"className":110,"code":352,"language":112,"meta":113,"style":113},"peanut@Snow:~$ ip a\n1: lo: \u003CLOOPBACK,UP,LOWER_UP> ...                # 只剩回环\npeanut@Snow:~$ ip route\n                                                  # 空\n",[115,354,355,365,393,402],{"__ignoreMap":113},[118,356,357,359,362],{"class":120,"line":121},[118,358,125],{"class":124},[118,360,361],{"class":128}," ip",[118,363,364],{"class":128}," a\n",[118,366,367,370,373,377,380,384,387,390],{"class":120,"line":136},[118,368,369],{"class":124},"1:",[118,371,372],{"class":128}," lo:",[118,374,376],{"class":375},"szBVR"," \u003C",[118,378,379],{"class":128},"LOOPBACK,UP,LOWER_U",[118,381,383],{"class":382},"sVt8B","P",[118,385,386],{"class":375},">",[118,388,389],{"class":128}," ...",[118,391,392],{"class":172},"                # 只剩回环\n",[118,394,395,397,399],{"class":120,"line":176},[118,396,125],{"class":124},[118,398,361],{"class":128},[118,400,401],{"class":128}," route\n",[118,403,404],{"class":120,"line":183},[118,405,406],{"class":172},"                                                  # 空\n",[18,408,409,412],{},[115,410,411],{},"0x8007054f"," 是 ERROR_INTERNAL_ERROR，Hyper-V 网络初始化失败。后来怀疑跟 VMware\u002FDocker\u002F其他 Hyper-V 配置冲突有关，但当时没深究。",[231,414,416],{"id":415},"第三阶段回退到-nat仍然不通","第三阶段：回退到 NAT，仍然不通",[18,418,419,420,423],{},"把 ",[115,421,422],{},".wslconfig"," 简化：",[108,425,427],{"className":296,"code":426,"language":298,"meta":113,"style":113},"[wsl2]\nnetworkingMode=NAT\n",[115,428,429,433],{"__ignoreMap":113},[118,430,431],{"class":120,"line":121},[118,432,305],{},[118,434,435],{"class":120,"line":136},[118,436,437],{},"networkingMode=NAT\n",[18,439,440,442],{},[115,441,330],{}," 后重启，eth0 终于回来了：",[108,444,446],{"className":110,"code":445,"language":112,"meta":113,"style":113},"peanut@Snow:~$ ip a\n2: eth0: ... inet 172.28.46.118\u002F20 ...\npeanut@Snow:~$ ip route\ndefault via 172.28.32.1 dev eth0 proto kernel\n",[115,447,448,456,475,483],{"__ignoreMap":113},[118,449,450,452,454],{"class":120,"line":121},[118,451,125],{"class":124},[118,453,361],{"class":128},[118,455,364],{"class":128},[118,457,458,461,464,466,469,472],{"class":120,"line":136},[118,459,460],{"class":124},"2:",[118,462,463],{"class":128}," eth0:",[118,465,389],{"class":128},[118,467,468],{"class":128}," inet",[118,470,471],{"class":128}," 172.28.46.118\u002F20",[118,473,474],{"class":128}," ...\n",[118,476,477,479,481],{"class":120,"line":176},[118,478,125],{"class":124},[118,480,361],{"class":128},[118,482,401],{"class":128},[118,484,485,488,491,494,497,500,503],{"class":120,"line":183},[118,486,487],{"class":124},"default",[118,489,490],{"class":128}," via",[118,492,493],{"class":132}," 172.28.32.1",[118,495,496],{"class":128}," dev",[118,498,499],{"class":128}," eth0",[118,501,502],{"class":128}," proto",[118,504,505],{"class":128}," kernel\n",[18,507,508],{},"但 ping 不通网关：",[108,510,512],{"className":110,"code":511,"language":112,"meta":113,"style":113},"peanut@Snow:~$ ping 172.28.32.1\nFrom 172.28.46.118 icmp_seq=1 Destination Host Unreachable\n",[115,513,514,523],{"__ignoreMap":113},[118,515,516,518,520],{"class":120,"line":121},[118,517,125],{"class":124},[118,519,129],{"class":128},[118,521,522],{"class":132}," 172.28.32.1\n",[118,524,525,528,531,533,535,538,541],{"class":120,"line":136},[118,526,527],{"class":124},"From",[118,529,530],{"class":132}," 172.28.46.118",[118,532,151],{"class":128},[118,534,154],{"class":132},[118,536,537],{"class":128}," Destination",[118,539,540],{"class":128}," Host",[118,542,543],{"class":128}," Unreachable\n",[18,545,546,549],{},[115,547,548],{},"Destination Host Unreachable"," 来自 WSL 自己，说明包根本送不到主机。",[231,551,553],{"id":552},"第四阶段怀疑-clash-tun-排除网段","第四阶段：怀疑 Clash TUN 排除网段",[18,555,556,557,560],{},"打开 Mihomo Party 的 TUN 设置（",[22,558,559],{},"虚拟网卡模式","），看到：\"排除自定义网段\"里有：",[108,562,565],{"className":563,"code":564,"language":337},[335],"172.16.0.0\u002F12\n192.168.0.0\u002F16\n10.0.0.0\u002F8\n",[115,566,564],{"__ignoreMap":113},[18,568,569,293,572,575,576,579],{},[22,570,571],{},"问题来了",[115,573,574],{},"172.16.0.0\u002F12"," 包含了 WSL2 的 ",[115,577,578],{},"172.28.0.0\u002F20"," 网段！这意味着：",[581,582,583,586,593],"ul",{},[253,584,585],{},"Windows 路由被 Clash TUN 全局接管",[253,587,588,589,592],{},"但 Clash TUN 又把 WSL 网段",[22,590,591],{},"排除","了",[253,594,595],{},"结果：WSL 流量既不走原路由、也不被 Clash 接管 → 死循环",[18,597,598,601,602,604,605,608,609,612],{},[22,599,600],{},"修复","：把 ",[115,603,574],{}," 从排除列表删除，只保留 ",[115,606,607],{},"192.168.0.0\u002F16"," 和 ",[115,610,611],{},"10.0.0.0\u002F8","。",[18,614,615,616,619,620,622],{},"Clash DNS 配置同时保持默认（fake-ip 模式、监听 ",[115,617,618],{},"0.0.0.0:53","、",[115,621,268],{},"），这部分本身没问题。",[108,624,627],{"className":625,"code":626,"language":337},[335],"TUN 模式堆栈      : System\n虚拟网卡名称      : Mihomo\n自动设置全局路由  : 开\nDNS 劫持         : any:53\n排除自定义网段    : 192.168.0.0\u002F16, 10.0.0.0\u002F8   ← 已删除 172.16.0.0\u002F12\n",[115,628,626],{"__ignoreMap":113},[108,630,633],{"className":631,"code":632,"language":337},[335],"DNS 监听地址 : 0.0.0.0:53\n增强模式     : fake-ip\nFake IP 范围 : 198.18.0.1\u002F16\n",[115,634,632],{"__ignoreMap":113},[18,636,637,640],{},[22,638,639],{},"但还是 ping 不通","。继续深挖。",[231,642,644],{"id":643},"第五阶段网卡被禁用自己挖的坑","第五阶段：网卡被禁用（自己挖的坑）",[18,646,647,648,651,652,655],{},"排查过程中我执行过 ",[115,649,650],{},"Disable-NetAdapter","，但配套的 ",[115,653,654],{},"Enable-NetAdapter -Confirm:$false"," 因为 PowerShell 多行语法被分成两条命令执行，启用失败了。",[15,657,658],{},[18,659,660,663,664,667],{},[22,661,662],{},"PowerShell 坑","：跨行命令需要用反引号 ",[115,665,666],{},"`"," 续行，或者直接写成一行。bash 用户容易踩这个坑。",[18,669,670],{},"检查所有网卡状态：",[108,672,676],{"className":673,"code":674,"language":675,"meta":113,"style":113},"language-powershell shiki shiki-themes github-light github-dark","Get-NetAdapter -IncludeHidden | Format-Table Name,Status,InterfaceDescription -AutoSize\n","powershell",[115,677,678],{"__ignoreMap":113},[118,679,680],{"class":120,"line":121},[118,681,674],{},[18,683,684],{},"输出关键行：",[108,686,689],{"className":687,"code":688,"language":337},[335],"vEthernet (WSL (Hyper-V firewall))    Disabled    Hyper-V Virtual Ethernet Adapter #2\n",[115,690,688],{"__ignoreMap":113},[18,692,693,696],{},[22,694,695],{},"网卡是 Disabled 状态","！主机侧的虚拟网卡都没启用，WSL 当然 ping 不到网关。",[18,698,699],{},"启用它：",[108,701,703],{"className":673,"code":702,"language":675,"meta":113,"style":113},"Enable-NetAdapter -Name \"vEthernet (WSL (Hyper-V firewall))\" -Confirm:$false\n",[115,704,705],{"__ignoreMap":113},[118,706,707],{"class":120,"line":121},[118,708,702],{},[18,710,711],{},"验证：",[108,713,715],{"className":673,"code":714,"language":675,"meta":113,"style":113},"Get-NetIPAddress -InterfaceAlias \"vEthernet (WSL (Hyper-V firewall))\" -AddressFamily IPv4 | Format-Table IPAddress,InterfaceAlias\n\nIPAddress   InterfaceAlias\n---------   --------------\n172.28.32.1 vEthernet (WSL (Hyper-V firewall))\n",[115,716,717,722,726,731,736],{"__ignoreMap":113},[118,718,719],{"class":120,"line":121},[118,720,721],{},"Get-NetIPAddress -InterfaceAlias \"vEthernet (WSL (Hyper-V firewall))\" -AddressFamily IPv4 | Format-Table IPAddress,InterfaceAlias\n",[118,723,724],{"class":120,"line":136},[118,725,180],{"emptyLinePlaceholder":179},[118,727,728],{"class":120,"line":176},[118,729,730],{},"IPAddress   InterfaceAlias\n",[118,732,733],{"class":120,"line":183},[118,734,735],{},"---------   --------------\n",[118,737,738],{"class":120,"line":193},[118,739,740],{},"172.28.32.1 vEthernet (WSL (Hyper-V firewall))\n",[18,742,743,744,747,748,612],{},"IP 出来了。但 WSL 内 ",[115,745,746],{},"ping 172.28.32.1"," —— ",[22,749,750],{},"还是 Destination Host Unreachable",[231,752,754],{"id":753},"第六阶段怀疑-hyper-v-防火墙错误方向","第六阶段：怀疑 Hyper-V 防火墙（错误方向）",[18,756,757,758,761,762,765],{},"新版 Windows 11 引入了 ",[22,759,760],{},"Hyper-V 虚拟机防火墙","。网卡名带着 ",[115,763,764],{},"(Hyper-V firewall)"," 不是巧合。",[108,767,769],{"className":673,"code":768,"language":675,"meta":113,"style":113},"Get-NetFirewallHyperVProfile | Format-Table Name,Enabled,DefaultInboundAction,DefaultOutboundAction\n\nName                                   Enabled         DefaultInboundAction\n----                                   -------         --------------------\n{40E0AC32-46A5-438A-A0B2-2B479E8F2E90} NotConfigured   Allow\n",[115,770,771,776,780,785,790],{"__ignoreMap":113},[118,772,773],{"class":120,"line":121},[118,774,775],{},"Get-NetFirewallHyperVProfile | Format-Table Name,Enabled,DefaultInboundAction,DefaultOutboundAction\n",[118,777,778],{"class":120,"line":136},[118,779,180],{"emptyLinePlaceholder":179},[118,781,782],{"class":120,"line":176},[118,783,784],{},"Name                                   Enabled         DefaultInboundAction\n",[118,786,787],{"class":120,"line":183},[118,788,789],{},"----                                   -------         --------------------\n",[118,791,792],{"class":120,"line":193},[118,793,794],{},"{40E0AC32-46A5-438A-A0B2-2B479E8F2E90} NotConfigured   Allow\n",[18,796,797,800,801,804,805,808,809,811],{},[115,798,799],{},"Enabled = NotConfigured"," + ",[115,802,803],{},"DefaultInboundAction = Allow"," → Hyper-V 防火墙",[22,806,807],{},"没启用","，",[22,810,591],{},"这个嫌疑。",[18,813,814,815,818],{},"新版 PowerShell 也不支持传统的 ",[115,816,817],{},"Set-NetFirewallHyperVProfile -Name Public,Private,Domain"," 写法了（会报 No MSFT_NetFirewallHyperVProfile objects found），新模型用的是 VMCreatorId GUID。",[231,820,822],{"id":821},"第七阶段检查网卡绑定-找到真凶","第七阶段：检查网卡绑定 —— 找到真凶",[18,824,825],{},"ARP 状态显示：",[108,827,829],{"className":110,"code":828,"language":112,"meta":113,"style":113},"peanut@Snow:~$ ip neigh show\n172.28.32.1 dev eth0 FAILED\n\npeanut@Snow:~$ arp -an\n? (172.28.32.1) at \u003Cincomplete> on eth0\n",[115,830,831,843,854,858,868],{"__ignoreMap":113},[118,832,833,835,837,840],{"class":120,"line":121},[118,834,125],{"class":124},[118,836,361],{"class":128},[118,838,839],{"class":128}," neigh",[118,841,842],{"class":128}," show\n",[118,844,845,847,849,851],{"class":120,"line":136},[118,846,244],{"class":124},[118,848,496],{"class":128},[118,850,499],{"class":128},[118,852,853],{"class":128}," FAILED\n",[118,855,856],{"class":120,"line":176},[118,857,180],{"emptyLinePlaceholder":179},[118,859,860,862,865],{"class":120,"line":183},[118,861,125],{"class":124},[118,863,864],{"class":128}," arp",[118,866,867],{"class":132}," -an\n",[118,869,870,873,876,878,881,884,887,889],{"class":120,"line":193},[118,871,872],{"class":375},"?",[118,874,875],{"class":382}," (",[118,877,244],{"class":124},[118,879,880],{"class":382},") at ",[118,882,883],{"class":375},"\u003C",[118,885,886],{"class":382},"incomplete",[118,888,386],{"class":375},[118,890,891],{"class":382}," on eth0\n",[18,893,894,897,898,901],{},[22,895,896],{},"ARP 解析失败","！WSL 发出 ARP 请求查询网关 MAC，",[22,899,900],{},"没有响应回来","。ARP 是 L2 协议，虚拟交换机内部应该秒回，包被某个东西拦截了。",[18,903,904],{},"检查 vEthernet (WSL) 网卡上绑定的所有驱动：",[108,906,908],{"className":673,"code":907,"language":675,"meta":113,"style":113},"Get-NetAdapterBinding -Name \"vEthernet (WSL (Hyper-V firewall))\" | Where-Object {$_.Enabled -eq $true} | Format-Table ComponentID,DisplayName -AutoSize\n",[115,909,910],{"__ignoreMap":113},[118,911,912],{"class":120,"line":121},[118,913,907],{},[18,915,916],{},"输出里有这一行非常醒目：",[108,918,921],{"className":919,"code":920,"language":337},[335],"hrndis6   Huorong NDIS Filter Driver\n",[115,922,920],{"__ignoreMap":113},[18,924,925,928],{},[22,926,927],{},"火绒的 NDIS 过滤驱动绑定在 WSL 网卡上","！立刻去翻火绒日志。",[231,930,932],{"id":931},"第八阶段火绒-arp-防护是元凶","第八阶段：火绒 ARP 防护是元凶",[18,934,935,936,293],{},"打开火绒 ",[22,937,938],{},"ARP 防火墙 → 日志记录",[18,940,941],{},[942,943],"img",{"alt":944,"src":945},"火绒 ARP 拦截日志","\u002Fimages\u002Fa-wsl\u002F03-huorong-arp-logs.png",[18,947,948],{},"日志清清楚楚：",[581,950,951,958,964,975],{},[253,952,953,954,957],{},"大量 \"",[22,955,956],{},"对外 ARP 攻击拦截","\" 条目",[253,959,960,961,963],{},"IP 地址 ",[115,962,244],{},"（就是 WSL 网关）",[253,965,966,967,970,971,974],{},"MAC 前缀 ",[115,968,969],{},"00:15:5D:xx:xx:xx","（",[22,972,973],{},"Hyper-V 虚拟网卡固定 OUI","）",[253,976,977,978],{},"处理结果：",[22,979,980],{},"已拦截",[18,982,983,986],{},[22,984,985],{},"真相大白","：火绒把 Hyper-V 虚拟交换机发出的 ARP 响应误判为\"对外 ARP 攻击\"，把整个 WSL 的二层连通性给阻断了。",[18,988,989],{},"打开火绒 ARP 防护界面：",[18,991,992],{},[942,993],{"alt":994,"src":995},"火绒 ARP 防护设置","\u002Fimages\u002Fa-wsl\u002F04-huorong-arp-protection.png",[18,997,998],{},"火绒在\"对外 ARP 攻击拦截\"开关旁边自己挂了个提示：",[15,1000,1001],{},[18,1002,1003],{},[22,1004,1005],{},"开启时可能会影响桥接模式的虚拟机或模拟器的网络",[18,1007,1008],{},"等于官方确认这个开关与虚拟机网络不兼容。",[231,1010,1012],{"id":1011},"第九阶段修复-验证","第九阶段：修复 + 验证",[18,1014,1015,1018],{},[22,1016,1017],{},"关闭\"对外 ARP 攻击拦截\"","（保留另外两个开关）：",[31,1020,1021,1034],{},[34,1022,1023],{},[37,1024,1025,1028,1031],{},[40,1026,1027],{},"选项",[40,1029,1030],{},"作用",[40,1032,1033],{},"处理",[47,1035,1036,1051,1070],{},[37,1037,1038,1041,1048],{},[52,1039,1040],{},"ARP 攻击防御",[52,1042,1043,1044,1047],{},"防止",[22,1045,1046],{},"别人","对你做 ARP 欺骗",[52,1049,1050],{},"✅ 保留",[37,1052,1053,1057,1063],{},[52,1054,1055],{},[22,1056,956],{},[52,1058,1043,1059,1062],{},[22,1060,1061],{},"你的电脑","发出 ARP 攻击",[52,1064,1065,1066,1069],{},"❌ ",[22,1067,1068],{},"关闭","（元凶）",[37,1071,1072,1075,1078],{},[52,1073,1074],{},"IP 冲突拦截",[52,1076,1077],{},"检测 IP 冲突",[52,1079,1050],{},[18,1081,1082,1083,1085],{},"关闭后 ",[115,1084,330],{}," 重启 WSL，发现 WSL 自动重新分配了新网段：",[108,1087,1090],{"className":1088,"code":1089,"language":337},[335],"wsl: 无法创建地址范围为\"172.28.32.0\u002F20\"的虚拟网络，已创建具有以下范围的新网络:\"172.20.144.0\u002F20\"\nwsl: 无法创建地址为\"172.28.46.118\"的网络端点，已分配新地址:\"172.20.151.103\"\n",[115,1091,1089],{"__ignoreMap":113},[18,1093,1094],{},"立即验证：",[108,1096,1098],{"className":110,"code":1097,"language":112,"meta":113,"style":113},"peanut@Snow:~$ ip neigh show\n172.20.144.1 dev eth0 lladdr 00:15:5d:be:6f:4a REACHABLE   ✅ ARP 通了\n\npeanut@Snow:~$ ping 8.8.8.8\n64 bytes from 8.8.8.8: icmp_seq=1 ttl=106 time=178 ms       ✅ 外网通\n\npeanut@Snow:~$ ping baidu.com\nPING baidu.com (198.18.0.42) 56(84) bytes of data.\n64 bytes from 198.18.0.42: icmp_seq=1 ttl=62 time=0.239 ms  ✅ Clash fake-ip 工作\n\npeanut@Snow:~$ curl -I https:\u002F\u002Fwww.google.com\nHTTP\u002F2 200                                                  ✅ 代理穿透成功\n",[115,1099,1100,1110,1137,1141,1149,1180,1185,1194,1212,1252,1257,1271],{"__ignoreMap":113},[118,1101,1102,1104,1106,1108],{"class":120,"line":121},[118,1103,125],{"class":124},[118,1105,361],{"class":128},[118,1107,839],{"class":128},[118,1109,842],{"class":128},[118,1111,1112,1115,1117,1119,1122,1125,1128,1131,1134],{"class":120,"line":136},[118,1113,1114],{"class":124},"172.20.144.1",[118,1116,496],{"class":128},[118,1118,499],{"class":128},[118,1120,1121],{"class":128}," lladdr",[118,1123,1124],{"class":128}," 00:15:5d:be:6f:4a",[118,1126,1127],{"class":128}," REACHABLE",[118,1129,1130],{"class":128},"   ✅",[118,1132,1133],{"class":128}," ARP",[118,1135,1136],{"class":128}," 通了\n",[118,1138,1139],{"class":120,"line":176},[118,1140,180],{"emptyLinePlaceholder":179},[118,1142,1143,1145,1147],{"class":120,"line":183},[118,1144,125],{"class":124},[118,1146,129],{"class":128},[118,1148,133],{"class":132},[118,1150,1151,1153,1155,1157,1159,1161,1163,1165,1167,1169,1172,1174,1177],{"class":120,"line":193},[118,1152,139],{"class":124},[118,1154,142],{"class":128},[118,1156,145],{"class":128},[118,1158,148],{"class":128},[118,1160,151],{"class":128},[118,1162,154],{"class":132},[118,1164,157],{"class":128},[118,1166,160],{"class":132},[118,1168,163],{"class":128},[118,1170,1171],{"class":132},"178",[118,1173,169],{"class":128},[118,1175,1176],{"class":128},"       ✅",[118,1178,1179],{"class":128}," 外网通\n",[118,1181,1183],{"class":120,"line":1182},6,[118,1184,180],{"emptyLinePlaceholder":179},[118,1186,1188,1190,1192],{"class":120,"line":1187},7,[118,1189,125],{"class":124},[118,1191,129],{"class":128},[118,1193,190],{"class":128},[118,1195,1197,1200,1203,1206,1209],{"class":120,"line":1196},8,[118,1198,1199],{"class":124},"PING",[118,1201,1202],{"class":128}," baidu.com",[118,1204,1205],{"class":382}," (198.18.0.42) 56(",[118,1207,1208],{"class":124},"84",[118,1210,1211],{"class":382},") bytes of data.\n",[118,1213,1215,1217,1219,1221,1224,1226,1228,1230,1233,1235,1238,1240,1243,1246,1249],{"class":120,"line":1214},9,[118,1216,139],{"class":124},[118,1218,142],{"class":128},[118,1220,145],{"class":128},[118,1222,1223],{"class":128}," 198.18.0.42:",[118,1225,151],{"class":128},[118,1227,154],{"class":132},[118,1229,157],{"class":128},[118,1231,1232],{"class":132},"62",[118,1234,163],{"class":128},[118,1236,1237],{"class":132},"0.239",[118,1239,169],{"class":128},[118,1241,1242],{"class":128},"  ✅",[118,1244,1245],{"class":128}," Clash",[118,1247,1248],{"class":128}," fake-ip",[118,1250,1251],{"class":128}," 工作\n",[118,1253,1255],{"class":120,"line":1254},10,[118,1256,180],{"emptyLinePlaceholder":179},[118,1258,1260,1262,1265,1268],{"class":120,"line":1259},11,[118,1261,125],{"class":124},[118,1263,1264],{"class":128}," curl",[118,1266,1267],{"class":132}," -I",[118,1269,1270],{"class":128}," https:\u002F\u002Fwww.google.com\n",[118,1272,1274,1277,1280,1283],{"class":120,"line":1273},12,[118,1275,1276],{"class":124},"HTTP\u002F2",[118,1278,1279],{"class":132}," 200",[118,1281,1282],{"class":128},"                                                  ✅",[118,1284,1285],{"class":128}," 代理穿透成功\n",[18,1287,1288],{},[22,1289,1290],{},"网络完全恢复。",[15,1292,1293,1306,1309],{},[18,1294,1295,1296,1299,1300,1302,1303,612],{},"⚠️ ",[22,1297,1298],{},"后续补充（重要）","：这次我只做了「关掉 ARP 拦截 + ",[115,1301,330],{},"」就恢复了，但后来多次复现发现",[22,1304,1305],{},"这一步并不可靠",[18,1307,1308],{},"Clash TUN 接管过全局路由之后，Hyper-V 的宿主网络服务（HNS）里会残留脏状态——虚拟交换机的路由与端点信息不会随 WSL 关闭而重建。所以经常出现「TUN 也关了、WSL 也重启了，但网络依然不通」的情况，让人误以为是别的问题。",[18,1310,1311],{},"可靠的做法是把 Hyper-V 网络服务一起重启，见下文《故障恢复的完整步骤》。",[15,1313,1314],{},[18,1315,1316,1317,1320,1321,1323,1324,612],{},"⚠️ 注意：新网段 ",[115,1318,1319],{},"172.20.144.0\u002F20"," 仍然在 ",[115,1322,574],{}," 范围内，所以 Clash TUN 排除网段中",[22,1325,1326,1327,1329],{},"移除 ",[115,1328,574],{}," 的修改必须保留",[99,1331],{},[27,1333,1335],{"id":1334},"关于-ping-网关不通","关于 ping 网关不通",[18,1337,1338,1339,1342],{},"完成后还有一个小现象：",[115,1340,1341],{},"ping 172.20.144.1"," 不通，但 ARP REACHABLE、其他流量全通。",[108,1344,1346],{"className":110,"code":1345,"language":112,"meta":113,"style":113},"peanut@Snow:~$ ping 172.20.144.1\n11 packets transmitted, 0 received, 100% packet loss\npeanut@Snow:~$ ip neigh show\n172.20.144.1 dev eth0 lladdr 00:15:5d:be:6f:4a REACHABLE\n",[115,1347,1348,1357,1383,1393],{"__ignoreMap":113},[118,1349,1350,1352,1354],{"class":120,"line":121},[118,1351,125],{"class":124},[118,1353,129],{"class":128},[118,1355,1356],{"class":132}," 172.20.144.1\n",[118,1358,1359,1362,1365,1368,1371,1374,1377,1380],{"class":120,"line":136},[118,1360,1361],{"class":124},"11",[118,1363,1364],{"class":128}," packets",[118,1366,1367],{"class":128}," transmitted,",[118,1369,1370],{"class":132}," 0",[118,1372,1373],{"class":128}," received,",[118,1375,1376],{"class":128}," 100%",[118,1378,1379],{"class":128}," packet",[118,1381,1382],{"class":128}," loss\n",[118,1384,1385,1387,1389,1391],{"class":120,"line":176},[118,1386,125],{"class":124},[118,1388,361],{"class":128},[118,1390,839],{"class":128},[118,1392,842],{"class":128},[118,1394,1395,1397,1399,1401,1403,1405],{"class":120,"line":183},[118,1396,1114],{"class":124},[118,1398,496],{"class":128},[118,1400,499],{"class":128},[118,1402,1121],{"class":128},[118,1404,1124],{"class":128},[118,1406,1407],{"class":128}," REACHABLE\n",[18,1409,1410,1411,1414,1415,612],{},"这是 ",[22,1412,1413],{},"Windows 主机防火墙默认拒绝来自 Hyper-V 虚拟网卡的 ICMP Echo 请求","，纯粹是 ICMP 响应被禁，",[22,1416,1417],{},"不影响 TCP\u002FUDP 流量",[18,1419,1420,1421,1424],{},"类比：很多公网服务器（Google、AWS）也不响应 ping，但完全不影响访问。",[22,1422,1423],{},"ARP 通 + 路由通 = 网络通","，ping 网关失败可以忽略。",[18,1426,1427],{},"强迫症修复（可选）：",[108,1429,1431],{"className":673,"code":1430,"language":675,"meta":113,"style":113},"New-NetFirewallRule -DisplayName \"Allow ICMPv4 from WSL\" `\n  -Direction Inbound -Protocol ICMPv4 `\n  -InterfaceAlias \"vEthernet (WSL (Hyper-V firewall))\" -Action Allow\n",[115,1432,1433,1438,1443],{"__ignoreMap":113},[118,1434,1435],{"class":120,"line":121},[118,1436,1437],{},"New-NetFirewallRule -DisplayName \"Allow ICMPv4 from WSL\" `\n",[118,1439,1440],{"class":120,"line":136},[118,1441,1442],{},"  -Direction Inbound -Protocol ICMPv4 `\n",[118,1444,1445],{"class":120,"line":176},[118,1446,1447],{},"  -InterfaceAlias \"vEthernet (WSL (Hyper-V firewall))\" -Action Allow\n",[99,1449],{},[27,1451,1452],{"id":1452},"最终配置清单",[231,1454,1456],{"id":1455},"_1-火绒安全","1. 火绒安全",[581,1458,1459,1465,1470],{},[253,1460,1461,1462],{},"打开 ",[22,1463,1464],{},"ARP 防火墙",[253,1466,1467],{},[22,1468,1469],{},"关闭\"对外 ARP 攻击拦截\"开关",[253,1471,1472],{},"保留 \"ARP 攻击防御\" 和 \"IP 冲突拦截\"",[231,1474,1476],{"id":1475},"_2-clashmihomo-party","2. Clash（Mihomo Party）",[581,1478,1479,1500,1509],{},[253,1480,1481,1482,1485,1486,608,1488,1490],{},"TUN 排除自定义网段：",[22,1483,1484],{},"仅保留"," ",[115,1487,607],{},[115,1489,611],{},[581,1491,1492],{},[253,1493,1494,1499],{},[22,1495,1496,1497],{},"绝对不要加回 ",[115,1498,574],{},"（会覆盖 WSL 网段）",[253,1501,1502,1503,1505,1506],{},"DNS 配置保持默认：fake-ip 模式、监听 ",[115,1504,618],{},"、劫持 ",[115,1507,1508],{},"any:53",[253,1510,1511,1512,1515],{},"建议",[22,1513,1514],{},"关闭\"设置系统代理\"开关","（TUN 模式不需要，否则 WSL 启动会报 localhost 代理警告）",[231,1517,1519,1520],{"id":1518},"_3-wsl-wslconfig","3. WSL ",[115,1521,422],{},[581,1523,1524,1529],{},[253,1525,1526,1527],{},"路径：",[115,1528,292],{},[253,1530,1531],{},"内容：",[108,1533,1534],{"className":296,"code":426,"language":298,"meta":113,"style":113},[115,1535,1536,1540],{"__ignoreMap":113},[118,1537,1538],{"class":120,"line":121},[118,1539,305],{},[118,1541,1542],{"class":120,"line":136},[118,1543,437],{},[15,1545,1546],{},[18,1547,1548,1549,1552,1553,1555],{},"不要用 ",[115,1550,1551],{},"mirrored"," 模式（本机存在 VMware\u002FDocker\u002FHyper-V 多虚拟化环境会冲突，错误码 ",[115,1554,411],{},"）。",[231,1557,1559],{"id":1558},"_4-windows-系统设置","4. Windows 系统设置",[581,1561,1562],{},[253,1563,1564,293,1567,1570],{},[22,1565,1566],{},"关闭系统代理",[115,1568,1569],{},"Win + I"," → 网络和 Internet → 代理 → 关闭\"使用代理服务器\"",[99,1572],{},[27,1574,1575],{"id":1575},"故障恢复的完整步骤",[18,1577,1578,1579,612],{},"如果你已经踩进「WSL 断网」这个坑，",[22,1580,1581],{},"只关掉 TUN 再重启 WSL 往往是不够的",[18,1583,1584,1585,1587],{},"原因前面提过：Clash TUN 接管全局路由后，Hyper-V 的宿主网络服务会残留脏状态，虚拟交换机的路由与端点不会随 ",[115,1586,330],{}," 重建。必须把 Hyper-V 的网络服务一并重启，网络栈才会真正回到干净状态。",[18,1589,1590],{},"按顺序执行：",[18,1592,1593],{},[22,1594,1595],{},"第一步，先断开代理对网络栈的接管",[250,1597,1598,1604],{},[253,1599,1600,1601],{},"关闭 Clash 的 ",[22,1602,1603],{},"TUN \u002F 虚拟网卡模式",[253,1605,1606,1609],{},[22,1607,1608],{},"完全退出 Clash","（托盘退出，不是只关窗口——进程还在就仍然占着路由）",[18,1611,1612],{},[22,1613,1614],{},"第二步，以管理员身份打开 PowerShell，依次执行",[108,1616,1618],{"className":673,"code":1617,"language":675,"meta":113,"style":113},"wsl --shutdown          # 先关掉 WSL，释放它对虚拟网络的占用\nnet stop hns            # 停止 主机网络服务(Host Network Service)\nnet start hns           # 重新启动，重建虚拟交换机状态\nRestart-Service vmms    # 重启 Hyper-V 虚拟机管理服务\n",[115,1619,1620,1625,1630,1635],{"__ignoreMap":113},[118,1621,1622],{"class":120,"line":121},[118,1623,1624],{},"wsl --shutdown          # 先关掉 WSL，释放它对虚拟网络的占用\n",[118,1626,1627],{"class":120,"line":136},[118,1628,1629],{},"net stop hns            # 停止 主机网络服务(Host Network Service)\n",[118,1631,1632],{"class":120,"line":176},[118,1633,1634],{},"net start hns           # 重新启动，重建虚拟交换机状态\n",[118,1636,1637],{"class":120,"line":183},[118,1638,1639],{},"Restart-Service vmms    # 重启 Hyper-V 虚拟机管理服务\n",[15,1641,1642],{},[18,1643,1644,1645,1648,1649,1651,1652,1655],{},"这四条必须",[22,1646,1647],{},"按顺序","执行。",[115,1650,330],{}," 放在最前面，是因为 WSL 运行时会占用 HNS，不先关掉的话 ",[115,1653,1654],{},"net stop hns"," 可能失败或让服务停在异常状态。",[18,1657,1658],{},[22,1659,1660],{},"第三步，重新进入 WSL",[108,1662,1664],{"className":110,"code":1663,"language":112,"meta":113,"style":113},"wsl\n",[115,1665,1666],{"__ignoreMap":113},[118,1667,1668],{"class":120,"line":121},[118,1669,1663],{"class":124},[18,1671,1672],{},"进去之后网络就恢复了。验证一下：",[108,1674,1676],{"className":110,"code":1675,"language":112,"meta":113,"style":113},"ip neigh show        # 网关应为 REACHABLE，不是 FAILED\nping 8.8.8.8         # 外网 IP 通\nping baidu.com       # DNS 解析通\n",[115,1677,1678,1691,1702],{"__ignoreMap":113},[118,1679,1680,1683,1685,1688],{"class":120,"line":121},[118,1681,1682],{"class":124},"ip",[118,1684,839],{"class":128},[118,1686,1687],{"class":128}," show",[118,1689,1690],{"class":172},"        # 网关应为 REACHABLE，不是 FAILED\n",[118,1692,1693,1696,1699],{"class":120,"line":136},[118,1694,1695],{"class":124},"ping",[118,1697,1698],{"class":132}," 8.8.8.8",[118,1700,1701],{"class":172},"         # 外网 IP 通\n",[118,1703,1704,1706,1708],{"class":120,"line":176},[118,1705,1695],{"class":124},[118,1707,1202],{"class":128},[118,1709,1710],{"class":172},"       # DNS 解析通\n",[18,1712,1713],{},[22,1714,1715],{},"几个容易踩的点",[581,1717,1718,1728,1733,1751],{},[253,1719,1720,1721,1724,1725,1727],{},"必须是",[22,1722,1723],{},"管理员权限","的 PowerShell，否则 ",[115,1726,1654],{}," 会直接报权限错误",[253,1729,1730,1732],{},[115,1731,1654],{}," 偶尔会因为有容器\u002F虚拟机正在使用而失败，此时先把 Docker Desktop、VMware 等一并退出再试",[253,1734,1735,1736,1739,1740,1743,1744,1747,1748,1750],{},"重启 HNS 后 WSL 的 IP 网段",[22,1737,1738],{},"大概率会变","（我这次就从 ",[115,1741,1742],{},"172.28.x"," 变成了 ",[115,1745,1746],{},"172.20.x","），这是正常现象；只要 Clash TUN 的排除网段里没有 ",[115,1749,574],{},"，新网段照样能用",[253,1752,1753],{},"如果你只是想临时用一下 WSL，不想每次都折腾，那就别开 TUN——这套流程是给「已经断网了要救回来」用的",[99,1755],{},[27,1757,1758],{"id":1758},"排查思路与诊断命令汇总",[231,1760,1762],{"id":1761},"wsl-内linux","WSL 内（Linux）",[108,1764,1766],{"className":110,"code":1765,"language":112,"meta":113,"style":113},"ip a                 # 查看网卡和 IP\nip route             # 查看路由表\nip neigh show        # 查看 ARP 邻居表（关键诊断！）\narp -an              # 同上（旧风格）\nping \u003C网关>          # 测 L2\u002FL3 连通\nping 8.8.8.8         # 测外网 IP\nping baidu.com       # 测 DNS + 代理\ncurl -I https:\u002F\u002Fwww.google.com  # 测 HTTPS + 代理\ncat \u002Fetc\u002Fresolv.conf # 查看 DNS 配置\n",[115,1767,1768,1778,1788,1799,1810,1827,1836,1845,1858],{"__ignoreMap":113},[118,1769,1770,1772,1775],{"class":120,"line":121},[118,1771,1682],{"class":124},[118,1773,1774],{"class":128}," a",[118,1776,1777],{"class":172},"                 # 查看网卡和 IP\n",[118,1779,1780,1782,1785],{"class":120,"line":136},[118,1781,1682],{"class":124},[118,1783,1784],{"class":128}," route",[118,1786,1787],{"class":172},"             # 查看路由表\n",[118,1789,1790,1792,1794,1796],{"class":120,"line":176},[118,1791,1682],{"class":124},[118,1793,839],{"class":128},[118,1795,1687],{"class":128},[118,1797,1798],{"class":172},"        # 查看 ARP 邻居表（关键诊断！）\n",[118,1800,1801,1804,1807],{"class":120,"line":183},[118,1802,1803],{"class":124},"arp",[118,1805,1806],{"class":132}," -an",[118,1808,1809],{"class":172},"              # 同上（旧风格）\n",[118,1811,1812,1814,1816,1819,1822,1824],{"class":120,"line":193},[118,1813,1695],{"class":124},[118,1815,376],{"class":375},[118,1817,1818],{"class":128},"网",[118,1820,1821],{"class":382},"关",[118,1823,386],{"class":375},[118,1825,1826],{"class":172},"          # 测 L2\u002FL3 连通\n",[118,1828,1829,1831,1833],{"class":120,"line":1182},[118,1830,1695],{"class":124},[118,1832,1698],{"class":132},[118,1834,1835],{"class":172},"         # 测外网 IP\n",[118,1837,1838,1840,1842],{"class":120,"line":1187},[118,1839,1695],{"class":124},[118,1841,1202],{"class":128},[118,1843,1844],{"class":172},"       # 测 DNS + 代理\n",[118,1846,1847,1850,1852,1855],{"class":120,"line":1196},[118,1848,1849],{"class":124},"curl",[118,1851,1267],{"class":132},[118,1853,1854],{"class":128}," https:\u002F\u002Fwww.google.com",[118,1856,1857],{"class":172},"  # 测 HTTPS + 代理\n",[118,1859,1860,1863,1866],{"class":120,"line":1214},[118,1861,1862],{"class":124},"cat",[118,1864,1865],{"class":128}," \u002Fetc\u002Fresolv.conf",[118,1867,1868],{"class":172}," # 查看 DNS 配置\n",[231,1870,1872],{"id":1871},"windows-powershell管理员","Windows PowerShell（管理员）",[108,1874,1876],{"className":673,"code":1875,"language":675,"meta":113,"style":113},"# 网卡状态\nGet-NetAdapter -IncludeHidden | Format-Table Name,Status,InterfaceDescription -AutoSize\n\n# 启用\u002F禁用网卡\nEnable-NetAdapter -Name \"vEthernet (WSL (Hyper-V firewall))\" -Confirm:$false\nDisable-NetAdapter -Name \"\u003C名字>\" -Confirm:$false\n\n# IP 地址\nGet-NetIPAddress -AddressFamily IPv4 | Format-Table IPAddress,InterfaceAlias\n\n# 网卡上绑定的所有协议\u002F驱动（找拦截元凶用！）\nGet-NetAdapterBinding -Name \"\u003C网卡名>\" | Where-Object {$_.Enabled -eq $true} | Format-Table ComponentID,DisplayName\n\n# Hyper-V 虚拟交换机\nGet-VMSwitch | Format-Table Name,SwitchType,NetAdapterInterfaceDescription\n\n# Hyper-V 防火墙状态\nGet-NetFirewallHyperVProfile | Format-Table Name,Enabled,DefaultInboundAction,DefaultOutboundAction\n\n# WSL 重启（只重启 WSL，不会重建 Hyper-V 网络栈）\nwsl --shutdown\n\n# 完整重建 Hyper-V 网络栈 —— TUN 断网后的救命组合，需管理员权限\n# 并且要先关闭 clash 的 tun 模式，再退出之后，进行下面操作\nwsl --shutdown\nnet stop hns\nnet start hns\nRestart-Service vmms\n",[115,1877,1878,1883,1887,1891,1896,1900,1905,1909,1914,1919,1923,1928,1933,1938,1944,1950,1955,1961,1966,1971,1977,1983,1988,1994,2000,2005,2011,2017],{"__ignoreMap":113},[118,1879,1880],{"class":120,"line":121},[118,1881,1882],{},"# 网卡状态\n",[118,1884,1885],{"class":120,"line":136},[118,1886,674],{},[118,1888,1889],{"class":120,"line":176},[118,1890,180],{"emptyLinePlaceholder":179},[118,1892,1893],{"class":120,"line":183},[118,1894,1895],{},"# 启用\u002F禁用网卡\n",[118,1897,1898],{"class":120,"line":193},[118,1899,702],{},[118,1901,1902],{"class":120,"line":1182},[118,1903,1904],{},"Disable-NetAdapter -Name \"\u003C名字>\" -Confirm:$false\n",[118,1906,1907],{"class":120,"line":1187},[118,1908,180],{"emptyLinePlaceholder":179},[118,1910,1911],{"class":120,"line":1196},[118,1912,1913],{},"# IP 地址\n",[118,1915,1916],{"class":120,"line":1214},[118,1917,1918],{},"Get-NetIPAddress -AddressFamily IPv4 | Format-Table IPAddress,InterfaceAlias\n",[118,1920,1921],{"class":120,"line":1254},[118,1922,180],{"emptyLinePlaceholder":179},[118,1924,1925],{"class":120,"line":1259},[118,1926,1927],{},"# 网卡上绑定的所有协议\u002F驱动（找拦截元凶用！）\n",[118,1929,1930],{"class":120,"line":1273},[118,1931,1932],{},"Get-NetAdapterBinding -Name \"\u003C网卡名>\" | Where-Object {$_.Enabled -eq $true} | Format-Table ComponentID,DisplayName\n",[118,1934,1936],{"class":120,"line":1935},13,[118,1937,180],{"emptyLinePlaceholder":179},[118,1939,1941],{"class":120,"line":1940},14,[118,1942,1943],{},"# Hyper-V 虚拟交换机\n",[118,1945,1947],{"class":120,"line":1946},15,[118,1948,1949],{},"Get-VMSwitch | Format-Table Name,SwitchType,NetAdapterInterfaceDescription\n",[118,1951,1953],{"class":120,"line":1952},16,[118,1954,180],{"emptyLinePlaceholder":179},[118,1956,1958],{"class":120,"line":1957},17,[118,1959,1960],{},"# Hyper-V 防火墙状态\n",[118,1962,1964],{"class":120,"line":1963},18,[118,1965,775],{},[118,1967,1969],{"class":120,"line":1968},19,[118,1970,180],{"emptyLinePlaceholder":179},[118,1972,1974],{"class":120,"line":1973},20,[118,1975,1976],{},"# WSL 重启（只重启 WSL，不会重建 Hyper-V 网络栈）\n",[118,1978,1980],{"class":120,"line":1979},21,[118,1981,1982],{},"wsl --shutdown\n",[118,1984,1986],{"class":120,"line":1985},22,[118,1987,180],{"emptyLinePlaceholder":179},[118,1989,1991],{"class":120,"line":1990},23,[118,1992,1993],{},"# 完整重建 Hyper-V 网络栈 —— TUN 断网后的救命组合，需管理员权限\n",[118,1995,1997],{"class":120,"line":1996},24,[118,1998,1999],{},"# 并且要先关闭 clash 的 tun 模式，再退出之后，进行下面操作\n",[118,2001,2003],{"class":120,"line":2002},25,[118,2004,1982],{},[118,2006,2008],{"class":120,"line":2007},26,[118,2009,2010],{},"net stop hns\n",[118,2012,2014],{"class":120,"line":2013},27,[118,2015,2016],{},"net start hns\n",[118,2018,2020],{"class":120,"line":2019},28,[118,2021,2022],{},"Restart-Service vmms\n",[99,2024],{},[27,2026,2028],{"id":2027},"复盘踩坑链总结","复盘：踩坑链总结",[31,2030,2031,2044],{},[34,2032,2033],{},[37,2034,2035,2038,2041],{},[40,2036,2037],{},"#",[40,2039,2040],{},"误判\u002F失误",[40,2042,2043],{},"实际后果",[47,2045,2046,2056,2070,2081,2094,2108,2119],{},[37,2047,2048,2050,2053],{},[52,2049,154],{},[52,2051,2052],{},"看到 DNS 不通就以为是 DNS 问题",[52,2054,2055],{},"没意识到 IP 层也可能受影响",[37,2057,2058,2061,2064],{},[52,2059,2060],{},"2",[52,2062,2063],{},"直接上 mirrored 模式想一步到位",[52,2065,2066,2067,2069],{},"触发 ",[115,2068,411],{},"，WSL 回退到 None 模式彻底断网",[37,2071,2072,2075,2078],{},[52,2073,2074],{},"3",[52,2076,2077],{},"误以为 mirrored 失败会回退到 NAT",[52,2079,2080],{},"实际回退到 None（没网络）",[37,2082,2083,2086,2091],{},[52,2084,2085],{},"4",[52,2087,2088,2089],{},"Clash TUN 排除网段含 ",[115,2090,574],{},[52,2092,2093],{},"屏蔽了 WSL 整个网段，流量出不去",[37,2095,2096,2099,2105],{},[52,2097,2098],{},"5",[52,2100,2101,2102,2104],{},"手动 ",[115,2103,650],{}," 后启用失败",[52,2106,2107],{},"PowerShell 多行命令换行符问题，没注意",[37,2109,2110,2113,2116],{},[52,2111,2112],{},"6",[52,2114,2115],{},"怀疑 Hyper-V 防火墙是元凶",[52,2117,2118],{},"实际是 NotConfigured，方向错误",[37,2120,2121,2124,2127],{},[52,2122,2123],{},"7",[52,2125,2126],{},"忽略火绒的影响",[52,2128,2129],{},"真正的元凶藏在网卡绑定列表里",[99,2131],{},[27,2133,2134],{"id":2134},"关键经验",[250,2136,2137,2151,2157,2163,2173,2181,2196,2202],{},[253,2138,2139,2144,2145,608,2148,612],{},[22,2140,2141,2143],{},[115,2142,548],{}," 来自本机 = ARP 失败 \u002F 包出不去网卡","，第一时间查 ",[115,2146,2147],{},"ip neigh show",[115,2149,2150],{},"Get-NetAdapterBinding",[253,2152,2153,2156],{},[22,2154,2155],{},"网卡绑定列表是排查\"无形拦截\"的金矿","。各种 NDIS 过滤驱动（安全软件、抓包工具、虚拟网络）都会出现在这里，挨个排查。",[253,2158,2159,2162],{},[22,2160,2161],{},"国产安全软件的 ARP 防护是 Hyper-V\u002FWSL\u002F虚拟机的常见杀手","。火绒、360、腾讯电脑管家等都有类似机制。出问题先检查它们的\"网络保护\"或\"ARP 防火墙\"。",[253,2164,2165,2168,2169,2172],{},[22,2166,2167],{},"mirrored 模式不是银弹","。它要求干净的 Hyper-V 环境，存在 VMware、Docker、其他 Hyper-V 虚拟交换机时容易冲突。",[22,2170,2171],{},"NAT 模式 + Clash TUN 排除网段配置正确","已经足够好用。",[253,2174,2175,1485,2178,2180],{},[22,2176,2177],{},"PowerShell 跨行命令必须用反引号",[115,2179,666],{},"，否则会被拆成多条独立命令执行。",[253,2182,2183,2186,2187,2189,2190,2192,2193,2195],{},[22,2184,2185],{},"WSL 的 IP 网段可能在重启后变化","（如本案例 ",[115,2188,578],{}," → ",[115,2191,1319],{},"），但都在 ",[115,2194,574],{}," 范围内，所以 Clash TUN 排除网段配置具有稳定性。",[253,2197,2198,2201],{},[22,2199,2200],{},"ping 网关不通 ≠ 网络不通","。判断网络可用性应该看 ARP 表、路由表、TCP 流量，而不是单纯的 ICMP 响应。",[253,2203,2204,2207,2208,2210,2211,2189,2213,2189,2216,2219],{},[22,2205,2206],{},"关掉 TUN 不等于网络会自己好","。Clash TUN 接管过全局路由后，Hyper-V 的宿主网络服务（HNS）会残留脏状态，",[115,2209,330],{}," 只重启 WSL、不重建虚拟交换机。必须 ",[115,2212,1654],{},[115,2214,2215],{},"net start hns",[115,2217,2218],{},"Restart-Service vmms"," 把网络栈整个重建。这是最容易让人误判的一环——以为「我明明已经关掉代理了」，于是把方向引向别处。",[99,2221],{},[27,2223,2224],{"id":2224},"后记",[18,2226,2227],{},"整个排查过程从\"WSL DNS 不通\"开始，中途经历了\"彻底断网\"的灾难，最终定位到火绒。",[18,2229,2230,2231,2236,2237,2240,2241,2243],{},"回头看，",[22,2232,2233,2234],{},"最快的捷径是第七阶段就执行 ",[115,2235,2150],{}," 检查网卡绑定，那一刻 ",[115,2238,2239],{},"Huorong NDIS Filter Driver"," 就在眼前。但因为前面被 Clash 配置、",[115,2242,1551],{}," 模式、网卡禁用等问题分散了注意力，直到 ARP FAILED 才回到这条路。",[18,2245,2246,2247,2250,2251],{},"希望这份记录能帮到同样环境的朋友 —— ",[22,2248,2249],{},"WSL2 + Clash TUN + 火绒"," 这个组合，火绒 ARP 防护是绕不开的坑。\n",[22,2252,2253],{},"本来我只关了 ARP 就能用了，但是我担心后续其他影响索性把三个全关了",[18,2255,2256,2257,2260],{},"最后补一句后来才摸清的事：",[22,2258,2259],{},"排查这类问题时，「先关掉代理试试」这一步本身就不可靠","。TUN 模式下 HNS 残留的脏状态不会随着代理退出而清除，必须走完《故障恢复的完整步骤》里那四条命令，才能真正判断\"网络到底还有没有问题\"。我当时要是知道这点，第二到第六阶段绕的那些弯路能省掉一大半。",[2262,2263,2264],"style",{},"html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .sScJk, html code.shiki .sScJk{--shiki-default:#6F42C1;--shiki-dark:#B392F0}html pre.shiki code .sZZnC, html code.shiki .sZZnC{--shiki-default:#032F62;--shiki-dark:#9ECBFF}html pre.shiki code .sj4cs, html code.shiki .sj4cs{--shiki-default:#005CC5;--shiki-dark:#79B8FF}html pre.shiki code .sJ8bj, html code.shiki .sJ8bj{--shiki-default:#6A737D;--shiki-dark:#6A737D}html pre.shiki code .szBVR, html code.shiki .szBVR{--shiki-default:#D73A49;--shiki-dark:#F97583}html pre.shiki code .sVt8B, html code.shiki .sVt8B{--shiki-default:#24292E;--shiki-dark:#E1E4E8}",{"title":113,"searchDepth":176,"depth":176,"links":2266},[2267,2268,2269,2280,2281,2288,2289,2293,2294,2295],{"id":29,"depth":136,"text":29},{"id":103,"depth":136,"text":103},{"id":228,"depth":136,"text":229,"children":2270},[2271,2272,2273,2274,2275,2276,2277,2278,2279],{"id":233,"depth":176,"text":234},{"id":285,"depth":176,"text":286},{"id":415,"depth":176,"text":416},{"id":552,"depth":176,"text":553},{"id":643,"depth":176,"text":644},{"id":753,"depth":176,"text":754},{"id":821,"depth":176,"text":822},{"id":931,"depth":176,"text":932},{"id":1011,"depth":176,"text":1012},{"id":1334,"depth":136,"text":1335},{"id":1452,"depth":136,"text":1452,"children":2282},[2283,2284,2285,2287],{"id":1455,"depth":176,"text":1456},{"id":1475,"depth":176,"text":1476},{"id":1518,"depth":176,"text":2286},"3. WSL .wslconfig",{"id":1558,"depth":176,"text":1559},{"id":1575,"depth":136,"text":1575},{"id":1758,"depth":136,"text":1758,"children":2290},[2291,2292],{"id":1761,"depth":176,"text":1762},{"id":1871,"depth":176,"text":1872},{"id":2027,"depth":136,"text":2028},{"id":2134,"depth":136,"text":2134},{"id":2224,"depth":136,"text":2224},"devops","2026-05-28","代理开着 WSL2 就断网，关掉又访问不了外网。记录一次从 ARP 拦截日志追到 TUN 模式冲突的完整排查过程，以及重建 Hyper-V 网络栈的正确恢复步骤。",false,"md",{},"\u002Fblog\u002Fwsl2-clash-huorong-troubleshooting",{"title":5,"description":2298},null,"blog\u002Fwsl2-clash-huorong-troubleshooting",[2307,2308,2309,2310,2311],"wsl2","proxy","network","troubleshooting","debugging","X04GM2DaqK-6fEYUTMDBrCSL3JFZ0Y8yHi_ksoMiINU",{"prev":2314,"next":2318},{"path":2315,"title":2316,"description":2317},"\u002Fblog\u002Fvuex-source-code-analysis","Vuex 源码深度解析","从单例模式与单向数据流的设计思想入手，跟读 install 函数、store 构造与响应式状态的实现细节。",{"path":2319,"title":2320,"description":2321},"\u002Fblog\u002Fwsl2-port-forwarding-guide","WSL2 端口转发完整指南","WSL2 里跑起 dev server 本机能开、同事却访问不到？讲透 NAT 网络拓扑、portproxy 方案、防火墙放行与开机自动化脚本。",1788337377921]