Reaching a service on Windows from inside WSL, sometimes localhost works, sometimes it does not, and I cannot see the pattern Networking

For question 2, use the address the distro already knows, rather than localhost. Inside Linux:

ip route show default | awk '{print $3}'

That gives the gateway, which is the Windows host on the virtual network. It changes on every restart, which is exactly why hardcoding it into a config is a bad afternoon.

So do not hardcode it. Options in order of how well they hold up:

• Resolve $(hostname).local if your setup provides it
• Read the gateway at startup in your app's config
• Switch WSL to mirrored networking mode, in .wslconfig:

[wsl2]
networkingMode=mirrored

Mirrored mode makes the distro share the host's network interfaces, so localhost genuinely means the same thing on both sides in both directions. It is the real fix for your problem rather than a workaround, and it also tends to survive VPNs, which the shim does not.

The asymmetry is the whole answer, and it exists because only one direction has special handling.

In its default networking mode the distro is a virtual machine on its own network, with its own address. Two separate hosts.

Linux → Windows gets no help. There is a forwarding shim that makes localhost work, but it is doing translation on the fly and it is the fragile half: VPN clients, a firewall profile flipping to Public, third-party network filters and some corporate agents all break it. That is your laptop.

Windows → Linux is the direction that gets real support: when something inside the distro listens on a port, Windows publishes it on localhost automatically. That is why it never fails for you.

So it is not that one is broken. It is that one is a convenience layer and the other is a supported feature.

The firewall is the other half and it is invisible if you only compare versions, because it fails silently in one direction.

The asymmetry is the answer. Only one direction has special handling and everyone assumes both do.

Question 3 is usually one of two things, and both are invisible if you only compare versions.

The Windows firewall. A service listening on Windows is subject to the firewall, and the virtual adapter is frequently classified as a Public network. Plenty of database installers add an allow rule for Private only. Same software, same version, different network profile - and the laptop is more likely to have been on a coffee shop network and had its profile changed.

What the service is bound to. Something listening on 127.0.0.1 is reachable only from Windows itself, and no amount of addressing from the distro will reach it, because it is refusing connections from anything that is not local. Something listening on 0.0.0.0 accepts them.

Check the second one first, on Windows, netstat -ano | findstr <port> shows the bind address. If it says 127.0.0.1, that is your laptop's difference and it is a one-line config change.

Worth knowing that this is version-sensitive in a way that makes searching miserable: mirrored networking arrived relatively recently and a lot of the advice online predates it, including some of the most-linked answers.

Run wsl --version and check what you have before following anything. Advice written for the older mode is not wrong, it is just solving a problem you may not have any more, and mixing the two produces configs that half-work.