Access a Windows PC on the Local Network with Cloudflare WARP Enabled

Cloudflare One WARP is commonly used by organizations to secure employee devices and route traffic through Zero Trust policies. However, it can sometimes interfere with direct communication between computers on the same local network.

A typical scenario is simple: one Windows computer has Cloudflare WARP installed, while another computer on the same LAN needs to connect to it using Windows Remote Desktop. Ideally, this connection should remain entirely inside the local network.

How Cloudflare Split Tunnel Affects Local Traffic

Cloudflare WARP uses Split Tunneling to decide which traffic goes through Cloudflare and which traffic bypasses it.

In Exclude mode, only destinations specifically listed in the Split Tunnel configuration bypass Cloudflare.

For example, if the configuration contains:

172.16.0.0/12

then addresses between:

172.16.0.0
and
172.31.255.255

can bypass Cloudflare.

However, networks such as:

192.168.0.0/16
10.0.0.0/8

may still be affected if they are not included in the exclusion list.

This is especially important when Cloudflare settings are controlled by an organization and cannot be modified locally.

Find the Computer’s Local IP Address

On the computer running Cloudflare WARP, open Command Prompt and run:

ipconfig

Find the IPv4 address of the physical Ethernet or Wi-Fi adapter.

For example:

IPv4 Address: 192.168.1.50

Avoid using addresses assigned to virtual VPN adapters.

Test Remote Desktop Connectivity

From the second Windows computer, run:

Test-NetConnection 192.168.1.50 -Port 3389

If you see:

TcpTestSucceeded : True

the Remote Desktop port is reachable.

You can then connect using:

mstsc /v:192.168.1.50

Using the IP address directly also avoids DNS or hostname resolution problems.

Enable Windows Remote Desktop

On the target computer, open:

Settings → System → Remote Desktop

Enable Remote Desktop.

Windows Pro, Enterprise, and Education editions can normally accept RDP connections. Windows Home can use the Remote Desktop client but does not normally provide the built-in RDP server functionality.

You can also enable the Windows Firewall rules from Administrator PowerShell:

Enable-NetFirewallRule -DisplayGroup "Remote Desktop"

To confirm that Remote Desktop is listening:

Get-NetTCPConnection -LocalPort 3389 -State Listen

Allow RDP Only from the Local Network

Instead of disabling Windows Firewall, create a rule that permits Remote Desktop only from the local subnet:

New-NetFirewallRule `
  -DisplayName "RDP from Local Network" `
  -Direction Inbound `
  -Protocol TCP `
  -LocalPort 3389 `
  -RemoteAddress LocalSubnet `
  -Action Allow `
  -Profile Any

This is much safer than exposing RDP to all networks.

What If You Cannot Modify Cloudflare?

In corporate environments, Cloudflare Split Tunnel rules are usually managed centrally. The local client may display the rules without allowing users to edit them.

If your organization’s configuration excludes:

172.16.0.0/12

but your LAN uses:

192.168.1.0/24

Cloudflare may interfere with local access.

If you control the router and organizational policy permits it, one possible solution is to configure the LAN inside an already excluded subnet.

For example:

Router:      172.20.50.1
Subnet:      172.20.50.0/24
Computer A:  172.20.50.101
Computer B:  172.20.50.102

Because 172.20.50.0/24 is inside 172.16.0.0/12, the traffic can use the existing Cloudflare exclusion.

Before changing the network, make sure the subnet does not conflict with corporate VPNs, Docker networks, Kubernetes networks, or other infrastructure.

Other Problems That Can Look Like Cloudflare Issues

Cloudflare is not always responsible for failed LAN access.

Check for:

• Windows Firewall blocking port 3389;
• Remote Desktop being disabled;
• Windows Home edition on the target computer;
• Wi-Fi client isolation;
• devices connected to a guest network;
• different VLANs or subnets;
• incorrect IP addresses;
• the target computer being asleep.

Some routers use settings called AP Isolation, Client Isolation, or Wireless Isolation. These prevent Wi-Fi devices from communicating directly even though both can access the Internet.

Recommended Troubleshooting Order

Start with:

ipconfig

Then, from the second computer:

Test-NetConnection TARGET_IP -Port 3389

If port 3389 is reachable, connect with:

mstsc /v:TARGET_IP

If it fails, check Remote Desktop, Windows Firewall, Cloudflare Split Tunnel rules, and router isolation settings.

Conclusion

It is possible to use Windows Remote Desktop between two computers on the same LAN without installing third-party software, even when Cloudflare WARP is installed.

The key question is whether the local subnet is allowed to bypass Cloudflare.

If the local subnet is already excluded by the organization’s Split Tunnel policy, the connection can remain local. If it is not excluded and the Cloudflare policy is centrally locked, the available options are limited to approved local-network access, changing the LAN subnet when appropriate, or requesting a policy change from the administrator.

For most troubleshooting situations, the most useful command is:

Test-NetConnection TARGET_IP -Port 3389

It quickly shows whether the problem is Remote Desktop itself or the underlying network path.