Getting WSL2 and Docker Desktop through Clash

WSL2 runs on a separate virtual network, so the Windows system proxy setting means nothing to it. If you want curl, apt or git inside the subsystem to use the proxy, you have to point them at the host yourself.

Step one: allow LAN connections

Turn on Allow LAN on the General page. Without it, Clash listens on 127.0.0.1 only and connections arriving from the WSL virtual adapter are refused outright — this is the number-one reason people follow a guide correctly and still cannot connect.

Step two: point WSL at the host

The host's address on the virtual network can change on every reboot, so reading it from /etc/resolv.conf is more reliable than hard-coding it. Add to ~/.bashrc:

export hostip=$(grep nameserver /etc/resolv.conf | awk '{print $2}')
export http_proxy="http://$hostip:7890"
export https_proxy="http://$hostip:7890"

If WSL2 is running in mirrored networking mode (networkingMode=mirrored in .wslconfig, Windows 11 only), the subsystem shares the host's network stack and plain 127.0.0.1:7890 works — you can skip the lines above entirely.

Docker Desktop

Image pulls are made by the Docker daemon, which ignores environment variables set inside containers. Fill in http://host.docker.internal:7890 under Settings → Resources → Proxies. Getting programs inside a container to use the proxy is a separate matter — pass -e http_proxy=... on docker run.

One last trap: Windows Firewall. The first connection from WSL gets blocked with no prompt at all, so check the inbound rules and make sure Clash for Windows is allowed on private networks.