SSH into WSL 2 from a Mac: VS Code Setup and Troubleshooting

To SSH into WSL 2 from a Mac, you need an SSH server inside the Linux distribution and a network path from the Mac to that server. Installing SSH on Windows alone connects you to Windows, not your WSL development environment.

This guide uses Ubuntu on a Windows computer and a Mac on the same local network. Replace the example usernames and addresses with your own. For a server-side checklist, see WSL SSH server troubleshooting.

Choose the network path first

Windows configuration	Connection path
WSL 2 with default NAT networking	Forward a Windows LAN port to the SSH port inside WSL
Supported Windows 11 installation with mirrored networking	Test direct LAN access and configure the applicable firewall rules

Microsoft documents both NAT and mirrored networking. Mirrored networking is available on Windows 11 22H2 and later. It is not correct to assume that every WSL installation uses the same network mode or that mirrored networking never works.

1. Install and start SSH inside Ubuntu

Run these commands in Ubuntu, not in PowerShell:

sudo apt update
sudo apt install openssh-server
sudo sshd -t
sudo service ssh start
ss -ltn | grep ':22'

The configuration check should finish without an error. The final command should show a listener on port 22. If Ubuntu uses systemd, you can manage the service with sudo systemctl status ssh instead. Ubuntu's OpenSSH documentation covers installation and configuration.

Check your Linux username with whoami. That is the account you will use for the SSH connection. Starting the server now does not prove it will start after a Windows reboot; test that separately after connectivity works.

2. Test Windows → WSL before involving the Mac

In PowerShell, list the distributions and inspect the address:

wsl -l -v
wsl -d Ubuntu hostname -I

Then connect to the relevant WSL address:

ssh your_linux_user@172.30.98.229

The address above is an example. If hostname -I prints several addresses, inspect Ubuntu's interfaces and use the address for the network you intend to forward to. A failed connection here is an SSH or Windows-to-WSL issue; creating a Mac configuration will not fix it.

3. For NAT mode, forward a dedicated Windows port

Find the Windows computer's LAN address using ipconfig. The following example uses 192.168.1.50 and exposes port 2222, leaving Windows port 22 available for a separate Windows SSH server.

Run in Administrator PowerShell:

$WindowsLanIp = '192.168.1.50'
$WslIp = ((wsl -d Ubuntu hostname -I).Trim() -split '\s+')[0]

netsh interface portproxy add v4tov4 listenaddress=$WindowsLanIp listenport=2222 connectaddress=$WslIp connectport=22

New-NetFirewallRule -DisplayName 'WSL SSH LAN 2222' -Direction Inbound -Action Allow -Protocol TCP -LocalPort 2222 -RemoteAddress LocalSubnet

netsh interface portproxy show all

Check the selected WSL address before running the forwarding command. Microsoft documents netsh interface portproxy, including adding, showing and deleting rules.

The Windows LAN address and WSL NAT address can change. If a connection stops working after a restart, compare the current addresses with the forwarding rule. Update the rule rather than adding a series of stale rules. Do not expose this port on your internet router for this LAN-only setup.

4. Test SSH from macOS

Open Terminal on the Mac:

ssh -p 2222 your_linux_user@192.168.1.50

Verify the server's host-key fingerprint before accepting a new host. A successful session should open the Linux shell. Run uname -a and pwd to confirm you reached the intended environment.

For repeat use, add this entry to your Mac's SSH configuration:

Host windows-wsl
    HostName 192.168.1.50
    User your_linux_user
    Port 2222

Now test ssh windows-wsl. Set up key authentication before disabling password authentication, and keep a working session open while changing access settings.

5. Connect VS Code to that working SSH host

Install Microsoft's Remote - SSH extension. Run Remote-SSH: Connect to Host…, select windows-wsl, and open a directory inside the Linux distribution.

VS Code installs its remote server on the target. Follow the official Remote SSH guide for prerequisites and installation failures. Establishing a Terminal connection first separates network problems from editor problems.

What changes with mirrored networking?

With a supported mirrored setup, test direct access from the Mac to the Windows machine's LAN address and the Linux SSH port. Windows and Hyper-V firewall policy can still block incoming traffic. Follow Microsoft's networking documentation for narrowly scoped inbound rules; do not disable the firewall as a connectivity shortcut.

A localhost connection working on Windows does not establish that a different computer can reach the service. Test from the Mac itself.

Troubleshoot the failing layer

Symptom	Check next
Connection refused	SSH listener, destination address, forwarding rule and selected port
Connection times out	LAN reachability, Windows firewall, VPN routing and network isolation
Permission denied	Linux username, authentication method and authorized key
Worked before a reboot	WSL service status and changed Windows/WSL addresses
Terminal works, VS Code fails	Remote server prerequisites and VS Code connection logs

Use ssh -vvv windows-wsl for connection diagnostics. For Linux service and authentication checks, continue with the WSL SSH troubleshooting guide.

Questions readers often ask

Can a Mac connect directly to a WSL NAT address?

Not through the ordinary LAN path in the default setup. Use a reachable Windows endpoint with forwarding, or configure an appropriate alternative network path.

Do I need Windows OpenSSH Server too?

Not for the forwarding approach above: the destination SSH server runs inside Ubuntu. A separate Windows SSH server is needed if you deliberately choose an SSH jump-host design through Windows.

Why does the WSL address change?

Treat the NAT address as dynamic. Check it when the distribution restarts and refresh the forwarding destination when necessary.