Deploying an Enclave Gateway in WSL¶

Enclave Gateways require a Linux operating system. Installing Enclave directly onto a physical or virtual Linux machine is recommended wherever possible.

In some scenarios, organisations may not have easy access to Linux hosts. The Windows Subsystem for Linux (WSL) allows Linux distributions to run directly on Windows using nested virtualisation, avoiding the overhead of provisioning dedicated Linux resources. However, there are significant limitations to be aware of when deploying an Enclave Gateway inside WSL.

Prerequisites¶

WSL2 with systemd support requires Windows 11 or Windows Server 2022 or later. Windows 10 does not support the systemd configuration required by this guide.

Limitations¶

When running Enclave inside WSL there are three limitations to be aware of:

Reduced throughput - Nested virtualisation introduces an additional layer of abstraction, which can lead to reduced compute performance compared to native virtualisation, negatively affecting throughput.
NAT prevents direct connections - By default, WSL uses Network Address Translation (NAT) which prevents Enclave from establishing peer-to-peer connections, causing reduced network performance as traffic passes through relay servers instead. The port forwarding steps below work around this limitation.
WSL does not run as a persistent service - WSL is designed as a development tool, not a service host. WSL instances terminate when the user logs out as of build 20211, and systemd services do not keep WSL alive. There is no official mechanism to start WSL at boot before a user logs in. On Windows Server, this is partially mitigated by the fact that servers typically maintain a persistent user session - but an Enclave Gateway running in WSL will stop if that session ends. The vmIdleTimeout setting in .wslconfig can prevent the WSL virtual machine from shutting down during idle periods, but does not prevent instance termination on logout.

As a result, running an Enclave Gateway inside WSL is not recommended unless no other alternatives are available. For always-on gateway deployments, install Enclave directly onto a Linux host, virtual machine, or Docker container.

If running an Enclave Gateway in WSL is the only option, the following steps show how to enable port forwarding and fix Enclave to a specific port number to enable direct peer-to-peer connections. Note that the Enclave Gateway in WSL will only support TCP connections, which may still result in reduced network performance compared to a native Linux installation.

Installation¶

Install WSL. The Ubuntu distribution is recommended and is used throughout this guide. Once installed, start WSL by running wsl in the Windows terminal.
Enable systemd in the WSL instance; follow the guide in the Microsoft documentation.
Install Enclave and enrol a new system within WSL. Follow the Getting Started guide if you are unfamiliar with the process.
Find the IP address allocated to your WSL instance by running the following command inside your WSL instance:
```
ip addr | grep eth0
```
In the example below, the WSL instance has been allocated the IP address 182.18.144.139 (underlined) inside a /20 subnet.

Warning

The WSL subnet is allocated randomly, and there is no guarantee that the subnet allocated to you will be equal to the value underlined above.
Enable port forwarding to the WSL instance by running the following netsh command on the Windows host machine. This example uses port 59724 from the ephemeral port range, but you may wish to change the port according to your own requirements.

Important: Replace [ipaddr] in this command with the IP address obtained in step 4.
```
netsh interface portproxy add v4tov4 listenaddress=0.0.0.0 listenport=59724 connectport=59724 connectaddress=[ipaddr]
```

Open the Windows Firewall by running the following netsh command on the Windows host machine.

netsh advfirewall firewall add rule name="Enclave WSL2" dir=in action=allow protocol=TCP localport=59724

Enclave normally selects a random port number each time it starts. To match the port forwarding rule, fix Enclave to the same port number by running the following command inside the WSL instance:
```
enclave set-config localport 59724
```
You may need to restart Enclave for the change to take effect. If you’re prompted to restart Enclave, do so.
Tip

If you're using multiple profiles, you can use the --profile argument to specify which profile Enclave should configure. For example:
```
enclave set-config localport 59724 --profile Universe
```
You can confirm that Enclave is using the new fixed port by running the following command inside your WSL instance:
```
enclave status
```
The port number in the Binding address should match the value chosen for port forwarding, which is 59724 if following this guide exactly.
If the WSL instance of Enclave is not already configured as a Gateway, follow the guide to Enabling Enclave Gateway.
Optionally, you can check that connections to the Enclave Gateway are using the specified port number by running the following command inside your WSL instance:
```
sudo netstat -tupn | grep enclave
```
If the Enclave Gateway is configured correctly, the netstat output will confirm that all Enclave partner systems are connected using the specified port number, as expected:

Having problems? Contact the Enclave team at support@enclave.io or visit the support options page.

Last updated August 1, 2026