[BUG] Cowork Windows: NAT subnet mismatch + missing IP forwarding + no DNS on VM adapter

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Cowork fails with "API unreachable" on every single session - both on corporate network and home WiFi. The Hyper-V Linux VM boots successfully but has no internet connectivity due to three network misconfigurations:

1. NAT subnet mismatch: cowork-vm-nat has InternalIPInterfaceAddressPrefix: 172.16.0.0/24 but vEthernet (cowork-vm-vnet) gets IP 172.17.0.1/24 - VM traffic never matches the NAT rule
2. IP Forwarding disabled on vEthernet (cowork-vm-vnet) for both IPv4 and IPv6
3. No IPv4 DNS servers on the VM adapter (IPv6 shows deprecated fec0:0:0:ffff::* stubs)

Manual fix attempts (correcting NAT rule, enabling forwarding, setting DNS) partially work but Claude Desktop fails to recreate the HNS endpoint after changes (HcnCreateEndpoint failed with HRESULT 0x800706bf). After PC reboot, Claude recreates HNS network but still does not create a proper WinNAT rule, does not enable IP forwarding, and does not set DNS.

<img width="987" height="810" alt="Image" src="https://github.com/user-attachments/assets/b2d0a3ab-abb1-4bce-aabb-867cd8527571" />

What Should Happen?

Claude Desktop should correctly configure the Cowork VM networking:

1. Create a WinNAT rule matching the actual HNS network subnet
2. Enable IP forwarding on the virtual adapter
3. Configure functional IPv4 DNS servers on the virtual adapter

The Cowork workspace should start and reach the Claude API successfully.

Error Messages/Logs

cowork_vm_node.log (same pattern on every session):

[VM] Network status: NOT_CONNECTED
[VM] Network status: CONNECTED
[VM] API reachability: PROBABLY_UNREACHABLE
[VM] API reachability: UNREACHABLE
[VM:network] API is unreachable

Debug log (UNABLE_TO_VERIFY_LEAF_SIGNATURE):

[ERROR] Error: 1P event logging: 13 events failed to export (code=UNABLE_TO_VERIFY_LEAF_SIGNATURE, unable to verify the first certificate)

Network state (PowerShell as Admin):

PS> Get-NetNat
Name: cowork-vm-nat
InternalIPInterfaceAddressPrefix: 172.16.0.0/24

PS> Get-HnsNetwork | Format-List Name, Subnets
Name: cowork-vm-vnet
AddressPrefix: 172.17.0.0/24
GatewayAddress: 172.17.0.1
# --> Mismatch\! NAT expects 172.16.x.x but VM is on 172.17.x.x

PS> Get-DnsClientServerAddress -InterfaceAlias "vEthernet (cowork-vm-vnet)"
IPv4 ServerAddresses: {} (empty\!)
IPv6 ServerAddresses: fec0:0:0:ffff::1, fec0:0:0:ffff::2, fec0:0:0:ffff::3

PS> Get-NetIPInterface -InterfaceAlias "vEthernet (cowork-vm-vnet)" -AddressFamily IPv4
Forwarding: Disabled

Steps to Reproduce

1. Install Claude Desktop (MSIX) on Windows 11 Enterprise with Hyper-V enabled
2. Open Claude Desktop and navigate to Cowork
3. Error appears: "Claude API cannot be reached from Claude workspace"
4. Verify network misconfiguration in Admin PowerShell:

• Get-NetNat shows subnet 172.16.0.0/24
• Get-HnsNetwork shows subnet 172.17.0.0/24 (mismatch)
• Get-DnsClientServerAddress -InterfaceAlias "vEthernet (cowork-vm-vnet)" shows empty IPv4 DNS
• Get-NetIPInterface -InterfaceAlias "vEthernet (cowork-vm-vnet)" shows Forwarding: Disabled

1. This reproduces on every single session, on any network

Claude Model

Opus

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

Claude Desktop 1.1.4173.0 (MSIX)

Platform

Other

Operating System

Windows

Terminal/Shell

Other

Additional Information

• Cisco AnyConnect VPN agent runs in background (not connected) - may contribute to DNS issues
• Corporate PAC file configured in registry (proxy.buhler-ltd.com) but not active on home WiFi
• NODE_EXTRA_CA_CERTS is set at user level but cowork-svc.exe runs as a Windows Service (Session 0) and does not inherit it
• Host machine can reach api.anthropic.com successfully (verified with Invoke-WebRequest, cert issued by Google Trust Services)
• Related issues: #25155, #24962, #27010, #25024, #28231