Modern Windows 11 workstations frequently operate as multi-homed endpoints connected to multiple concurrent network segments. Examples include developer systems bridging Wi-Fi and physical 10GbE LANs, virtualization hosts running Hyper-V or WSL2 virtual switches, and enterprise workstations connected to corporate VPN tunnels alongside local IoT management subnets. In complex multi-adapter configurations, network administrators often encounter scenarios where packets routed across secondary adapters or loopback bridges are silently discarded by the operating system kernel.
This behavior is governed by the TCP/IP stack’s Host Model. By default, Windows enforces the Strong Host Model for both packet transmission and reception. While the strong host model improves network isolation, multi-homed routing scenarios and asymmetrical network topologies require transitioning specific interfaces to the Weak Host Model. Using PowerShell, administrators can configure WeakHostSend and WeakHostReceive flags to enable flexible cross-adapter routing without disabling Windows Defender Firewall protections.
Understanding the Strong Host vs Weak Host Models
In RFC 1122, the Internet Engineering Task Force (IETF) defines two distinct behaviors for multi-homed devices handling IP packets:
- Strong Host Model (Windows Default):
- Inbound (WeakHostReceive = Disabled): The network stack accepts incoming packets only if the arrival physical interface matches the exact destination IP address specified in the packet header. Packets arriving on Interface A destined for Interface B’s IP address are dropped immediately.
- Outbound (WeakHostSend = Disabled): The network stack transmits packets from an interface only if the source IP address assigned to that packet belongs directly to that transmitting physical adapter.
- Weak Host Model:
- Inbound (WeakHostReceive = Enabled): The host accepts packets destined for any of its assigned IP addresses, regardless of which physical interface the packet arrived on.
- Outbound (WeakHostSend = Enabled): The host permits packets bearing source IP addresses from one adapter to be routed and transmitted out through another adapter’s physical link.
Enabling weak host parameters is essential when running Hyper-V internal switches, Docker/WSL2 bridged containers, loopback server testing, or dual-NIC routing configurations where incoming and outgoing routing paths are asymmetrical.
Inspecting Current Host Model Settings in PowerShell
Open an elevated PowerShell prompt on Windows 11 by right-clicking Start and selecting Terminal (Admin). To query the current weak host configurations across all network adapters, execute the Get-NetIPInterface cmdlet:
Get-NetIPInterface | Select-Object InterfaceAlias, AddressFamily, WeakHostSend, WeakHostReceiveThe command lists active IPv4 and IPv6 interface states:
InterfaceAlias AddressFamily WeakHostSend WeakHostReceive
-------------- ------------- ------------ ---------------
Ethernet IPv4 Disabled Disabled
Wi-Fi IPv4 Disabled Disabled
vEthernet (WSL) IPv4 Disabled Disabled
Loopback Pseudo-In… IPv4 Disabled DisabledNotice that all physical and virtual interfaces default to Disabled, enforcing the strong host model.
Enabling Weak Host Send and Receive on an Adapter
To permit an interface to send packets with foreign source IP addresses and accept packets addressed to any host IP, enable both flags using the Set-NetIPInterface cmdlet.
For IPv4 on a physical adapter named Ethernet, execute:
Set-NetIPInterface -InterfaceAlias "Ethernet" -AddressFamily IPv4 -WeakHostSend Enabled -WeakHostReceive EnabledIf you are routing modern IPv6 traffic across the same adapter, enable the flags for the IPv6 address family as well:
Set-NetIPInterface -InterfaceAlias "Ethernet" -AddressFamily IPv6 -WeakHostSend Enabled -WeakHostReceive EnabledTo enable weak host behavior across both physical interfaces on a dual-NIC workstation simultaneously, pass an array of adapter aliases:
"Ethernet 1", "Ethernet 2" | ForEach-Object {
Set-NetIPInterface -InterfaceAlias $_ -AddressFamily IPv4 -WeakHostSend Enabled -WeakHostReceive Enabled
}Configuring Hyper-V Virtual Switch Adapters
When running Hyper-V virtual machines or WSL2 container environments that require bridging or secondary IP aliasing, the virtual switch management interface (e.g., vEthernet (Default Switch)) often drops packets originating from container subnets.
Enable weak host send and receive on the Hyper-V virtual adapter:
Set-NetIPInterface -InterfaceAlias "vEthernet (Default Switch)" -WeakHostSend Enabled -WeakHostReceive EnabledAdditionally, if your Windows 11 machine routes packets between adapters, ensure that IPv4 packet forwarding is enabled on the virtual bridge:
Set-NetIPInterface -InterfaceAlias "vEthernet (Default Switch)" -Forwarding EnabledVerifying Configuration and Testing Network Flow
After applying the settings, verify that the properties reflect Enabled in the network stack:
Get-NetIPInterface -InterfaceAlias "Ethernet" | Select-Object InterfaceAlias, AddressFamily, WeakHostSend, WeakHostReceive, ForwardingTo verify that cross-interface routing succeeds, send an active ICMP ping from an external machine on Subnet A targeted at the IP address assigned to Subnet B on your Windows 11 workstation. With weak host receive active, the workstation will acknowledge and reply to the packet rather than dropping it silently at the transport layer.
Restoring Default Strong Host Model Security
If you no longer require multi-homed routing and wish to restore maximum operating system network isolation, revert the interface back to default settings:
Set-NetIPInterface -InterfaceAlias "Ethernet" -WeakHostSend Disabled -WeakHostReceive DisabledConfirm that the strong host model has been re-engaged:
Get-NetIPInterface -InterfaceAlias "Ethernet" | Select-Object InterfaceAlias, WeakHostSend, WeakHostReceiveBy configuring WeakHostSend and WeakHostReceive via PowerShell, network engineers ensure seamless communication across Hyper-V switches, asymmetric WAN routing paths, and multi-homed developer workstations without compromising core firewall security.