[BUG] Cowork VM cannot reach Claude API on Windows 11 Pro — missing WinNAT rule

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Cowork consistently fails with "Failed to start Claude's workspace — Can't reach the Claude API from Claude's workspace." and "API Error: Unable to connect to API (ECONNRESET)". Regular Chat mode works perfectly. Only Cowork is affected.
The root cause appears to be that Cowork creates the HNS network (cowork-vm-nat, type: NAT, subnet: 172.16.0.0/24) but does not create a corresponding WinNAT rule. Without NAT backing, the VM can reach the host but has no route to the internet.

What Should Happen?

Cowork should create both the HNS network and the corresponding WinNAT rule, and the VM should be able to reach api.anthropic.com through the host's internet connection.

Error Messages/Logs

Failed to start Claude's workspace
Can't reach the Claude API from Claude's workspace.
Restarting Claude or reconnecting to your network sometimes resolves this.

API Error: Unable to connect to API (ECONNRESET)

Steps to Reproduce

1. Open Claude Desktop
2. Launch Cowork
3. VM downloads and boots, network shows CONNECTED
4. API reachability check fails: PROBABLY_UNREACHABLE → UNREACHABLE
5. Error displayed: "Failed to start Claude's workspace — Can't reach the Claude API from Claude's workspace"

Claude Model

Opus

Is this a regression?

No, this never worked

Last Working Version

_No response_

Claude Code Version

N.A.

Platform

Anthropic API

Operating System

Windows

Terminal/Shell

Windows Terminal

Additional Information

Environment

OS: Windows 11 Pro
Subscription: Pro
No VPN active
Hyper-V: Enabled

Steps to Reproduce

Open Claude Desktop
Launch Cowork
VM downloads and boots, network shows CONNECTED
API reachability check fails: PROBABLY_UNREACHABLE → UNREACHABLE
Error displayed: "Failed to start Claude's workspace — Can't reach the Claude API from Claude's workspace"

Troubleshooting Attempted
All of the following were tried and none resolved the issue:

Restarting Claude Desktop multiple times — no change
Confirmed Hyper-V is properly installed — reinstalled the full Hyper-V stack via Enable-WindowsOptionalFeature -Online -FeatureName "Microsoft-Hyper-V" -All and rebooted. Get-NetNat initially returned "Invalid class" error, which was resolved after this step.
Verified no VPN is running — confirmed no VPN or proxy active
Checked NAT configuration — Get-NetNat returns empty. Get-HnsNetwork shows cowork-vm-nat exists (type: NAT, 172.16.0.0/24, gateway: 172.16.0.1) but there is no WinNAT rule backing it.
Enabled IP forwarding — ran Set-NetIPInterface -InterfaceAlias "vEthernet (cowork-vm-nat)" -Forwarding Enabled. Forwarding was previously disabled. Enabling it did not resolve the issue.
Attempted to manually create NAT rule — New-NetNat -Name "CoworkNAT" -InternalIPInterfaceAddressPrefix "172.16.0.0/24" fails with "You were not connected because a duplicate name exists on the network" (Windows System Error 52). This happens regardless of the name used.
Removed and recreated HNS network — ran Remove-HnsNetwork on the cowork-vm-nat network, then relaunched Claude Desktop to let Cowork recreate it. Same error on startup.

Diagnostic Output
Get-NetNat: Returns empty (no NAT rules exist)
Get-HnsNetwork:
Name : cowork-vm-nat
Type : NAT
Subnets : AddressPrefix=172.16.0.0/24; GatewayAddress=172.16.0.1

Name : Default Switch
Type : ICS
Subnets : AddressPrefix=172.30.112.0/20; GatewayAddress=172.30.112.1
ipconfig /all | findstr "172.16":
IPv4 Address. . . . . . . . . . . : 172.16.0.1(Preferred)

Related Issues

#24918
#25155
#25308