Skip to content

[ZT] Add NetBIOS over TCPIP WARP setting #27369

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
ranbel wants to merge 5 commits into
base: production
Choose a base branch
from
Open

[ZT] Add NetBIOS over TCPIP WARP setting #27369

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
38533f4
Add NetBT WARP setting
ranbel Dec 30, 2025
9783f44
Update src/content/docs/cloudflare-one/team-and-resources/devices/war…
ranbel Dec 30, 2025
749224b
Update src/content/docs/cloudflare-one/team-and-resources/devices/war…
ranbel Jan 5, 2026
021abe4
Update src/content/docs/cloudflare-one/team-and-resources/devices/war…
ranbel Jan 5, 2026
0f92f49
Update src/content/docs/cloudflare-one/team-and-resources/devices/war…
ranbel Jan 5, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
72 changes: 70 additions & 2 deletions ...lare-one/team-and-resources/devices/warp/configure-warp/warp-settings/index.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -84,9 +84,9 @@

| System | Availability | Minimum WARP version |
| -------- | ------------ | -------------------- |
| Windows | ✅ | 2024.12.554.0 |

Check warning on line 87 in src/content/docs/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-settings/index.mdx

View workflow job for this annotation

GitHub Actions / Semgrep

semgrep.style-guide-potential-date-year 

Potential year found. Documentation should strive to represent universal truth, not something time-bound. (add [skip style guide checks] to commit message to skip)
| macOS | ✅ | 2024.12.554.0 |

Check warning on line 88 in src/content/docs/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-settings/index.mdx

View workflow job for this annotation

GitHub Actions / Semgrep

semgrep.style-guide-potential-date-year 

Potential year found. Documentation should strive to represent universal truth, not something time-bound. (add [skip style guide checks] to commit message to skip)
| Linux | ✅ | 2024.12.554.0 |

Check warning on line 89 in src/content/docs/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-settings/index.mdx

View workflow job for this annotation

GitHub Actions / Semgrep

semgrep.style-guide-potential-date-year 

Potential year found. Documentation should strive to represent universal truth, not something time-bound. (add [skip style guide checks] to commit message to skip)
| iOS | ❌ | |
| Android | ❌ | |
| ChromeOS | ❌ | |
Expand Down Expand Up @@ -127,9 +127,9 @@

| System | Availability | Minimum WARP version |
| -------- | ------------ | -------------------- |
| Windows | ✅ | 2025.2.600.0 |

Check warning on line 130 in src/content/docs/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-settings/index.mdx

View workflow job for this annotation

GitHub Actions / Semgrep

semgrep.style-guide-potential-date-year 

Potential year found. Documentation should strive to represent universal truth, not something time-bound. (add [skip style guide checks] to commit message to skip)
| macOS | ✅ | 2025.2.600.0 |

Check warning on line 131 in src/content/docs/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-settings/index.mdx

View workflow job for this annotation

GitHub Actions / Semgrep

semgrep.style-guide-potential-date-year 

Potential year found. Documentation should strive to represent universal truth, not something time-bound. (add [skip style guide checks] to commit message to skip)
| Linux | ✅ | 2025.2.600.0 |

Check warning on line 132 in src/content/docs/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-settings/index.mdx

View workflow job for this annotation

GitHub Actions / Semgrep

semgrep.style-guide-potential-date-year 

Potential year found. Documentation should strive to represent universal truth, not something time-bound. (add [skip style guide checks] to commit message to skip)
| iOS | ❌ | |
| Android | ❌ | |
| ChromeOS | ❌ | |
Expand Down Expand Up @@ -178,9 +178,9 @@

| System | Availability | Minimum WARP version |
| -------- | ------------ | -------------------- |
| Windows | ✅ | 2024.11.309.0 |

Check warning on line 181 in src/content/docs/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-settings/index.mdx

View workflow job for this annotation

GitHub Actions / Semgrep

semgrep.style-guide-potential-date-year 

Potential year found. Documentation should strive to represent universal truth, not something time-bound. (add [skip style guide checks] to commit message to skip)
| macOS | ✅ | 2024.11.309.0 |

Check warning on line 182 in src/content/docs/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-settings/index.mdx

View workflow job for this annotation

GitHub Actions / Semgrep

semgrep.style-guide-potential-date-year 

Potential year found. Documentation should strive to represent universal truth, not something time-bound. (add [skip style guide checks] to commit message to skip)
| Linux | ✅ | 2024.11.309.0 |

Check warning on line 183 in src/content/docs/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-settings/index.mdx

View workflow job for this annotation

GitHub Actions / Semgrep

semgrep.style-guide-potential-date-year 

Potential year found. Documentation should strive to represent universal truth, not something time-bound. (add [skip style guide checks] to commit message to skip)
| iOS | ✅ | 1.7 |
| Android | ✅ | 2.0 |
| ChromeOS | ✅ | 2.0 |
Expand Down Expand Up @@ -301,7 +301,7 @@

| System | Availability | Minimum WARP version |
| -------- | ------------ | -------------------- |
| Windows | ✅ | 2024.1.159.0 |

Check warning on line 304 in src/content/docs/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-settings/index.mdx

View workflow job for this annotation

GitHub Actions / Semgrep

semgrep.style-guide-potential-date-year 

Potential year found. Documentation should strive to represent universal truth, not something time-bound. (add [skip style guide checks] to commit message to skip)
| macOS | ✅ | 2024.1.160.0 |
| Linux | ✅ | 2024.2.62.0 |
| iOS | ❌ | N/A[^1] |
Expand Down Expand Up @@ -454,14 +454,14 @@
Physical Address. . . . . . . . . :
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes
IPv6 Address. . . . . . . . . . . : 2606:4700:110:8f79:145:f180:fc4:8106(Preferred)
IPv6 Address. . . . . . . . . . . : 2001:db8:110:8f79:145:f180:fc4:8106(Preferred)
Link-local IPv6 Address . . . . . : fe80::83b:d647:4bed:d388%49(Preferred)
IPv4 Address. . . . . . . . . . . : 172.16.0.2(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.255
Default Gateway . . . . . . . . . :
DNS Servers . . . . . . . . . . . : 127.0.2.2
127.0.2.3
NetBIOS over Tcpip. . . . . . . . : Enabled
NetBIOS over Tcpip. . . . . . . . : Disabled
```

</Details>
Expand All @@ -476,3 +476,71 @@
b. Assign this boundary to one or more boundary groups.

When the device is remote, the WARP interface description changes to `(SCCM) Cloudflare WARP Interface Tunnel` and the SCCM server will determine that the device belongs to the VPN boundary group. The device can now download updates from the distribution point assigned to this boundary group. When a network change occurs and WARP detects a managed network, it will revert the interface description to `Cloudflare WARP Interface Tunnel` and the boundary condition will no longer be satisfied. The device will match your local IP range and be considered as on-prem.

### NetBIOS over TCPIP

<Details header="Feature availability">

| [WARP modes](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-modes/) | [Zero Trust plans](https://www.cloudflare.com/teams-pricing/) |
| ----------------------------------------------------------------------------------------- | ------------------------------------------------------------- |
| <ul><li> Gateway with WARP</li><li> Secure Web Gateway without DNS filtering </li></ul> | All plans |

| System | Availability | Minimum WARP version |
| -------- | ------------ | -------------------- |
| Windows | ✅ | 2025.5.735.1 |
Copy link
Contributor Author

@ranbel ranbel Dec 30, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

need to update the version # to Q1-1 beta

| macOS | ❌ | |
| Linux | ❌ | |
| iOS | ❌ | |
| Android | ❌ | |
| ChromeOS | ❌ | |

</Details>

NetBIOS over TCPIP (NetBT) is a legacy protocol used for name resolution and other features on Windows. NetBT has been deprecated for years, but Windows has not removed it. Cloudflare WARP disables NetBT on the tunnel interface by default for security reasons and to align with modern best practices. This setting allows you to override the default behavior and enable NetBT over the WARP tunnel.

#### When to enable NetBT

You should turn on **NetBIOS over TCPIP** only if devices need to access internal resources over NetBT. Example scenarios include:

- **Legacy name resolution**: You rely on NetBIOS to resolve single-label names (such as `\\SERVER01`), instead of modern alternatives like mDNS for single-label names or standard DNS for Fully Qualified Domain Names (such as `\\server01.corp.internal`).
- **SMBv1**: You are accessing very old file shares or printers that do not support modern SMB (v2/v3) and require NetBT for discovery.
- **Legacy applications**: You use specialized internal software that hard-codes NetBIOS for node-to-node communication.

Otherwise, the recommendation is to always disable **NetBIOS over TCPIP**. You can choose a different setting for [remote devices](/cloudflare-one/team-and-resources/devices/warp/configure-warp/device-profiles/) versus [on-prem devices](/cloudflare-one/team-and-resources/devices/warp/configure-warp/managed-networks/#4-configure-device-profile).

#### Verify NetBT settings

To check if **NetBIOS over TCPIP** is enabled on the WARP tunnel interface, run the following command:

```cmd
warp-cli settings | findstr "NetBT"
```

```cmd output
(network policy) NetBT: true
```

You can also verify network interface details for the `CloudflareWARP` adapter:

```cmd
ipconfig /all
```

```cmd output {16}
Windows IP Configuration
...
Unknown adapter CloudflareWARP:
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Cloudflare WARP Interface Tunnel
Physical Address. . . . . . . . . :
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes
IPv6 Address. . . . . . . . . . . : 2001:db8:110:8f79:145:f180:fc4:8106(Preferred)
Link-local IPv6 Address . . . . . : fe80::83b:d647:4bed:d388%49(Preferred)
IPv4 Address. . . . . . . . . . . : 172.16.0.2(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.255
Default Gateway . . . . . . . . . :
DNS Servers . . . . . . . . . . . : 127.0.2.2
127.0.2.3
NetBIOS over Tcpip. . . . . . . . : Enabled
```
11 changes: 11 additions & 0 deletions ...re-one/team-and-resources/devices/warp/deployment/mdm-deployment/parameters.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -99,6 +99,17 @@ Identifies a Zero Trust organization in the WARP GUI when WARP is deployed with

**Value:** Organization nickname shown to users in the WARP GUI (for example, `Test environment`).

### `enable_netbt`

NetBIOS over TCPIP (NetBT) is a legacy feature in Windows primarily used for name resolution in some [rare scenarios](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-settings/#when-to-enable-netbt). Cloudflare WARP disables NetBT on the tunnel interface by default for security reasons. If your organization still relies on legacy applications that require NetBT, you can override the default behavior and enable NetBT.

**Value Type:** `boolean`

**Value:**

- `false` — (default) Disables NetBT on the WARP tunnel interface.
- `true` — Enables NetBT on the WARP tunnel interface.

### `enable_pmtud`

[Path MTU Discovery (PMTUD)](/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/path-mtu-discovery/) allows WARP to discover the largest packet size that can be sent over the current network and optimize connection performance.
Expand Down
Loading