Cloudflare WARP VPN

Overview

This is not a virtual private network in the sense the marketing industry uses the phrase. It does not let you appear to be in another country and it is not sold as a way to watch things you should not. What it does is take every packet leaving your machine, encrypt it, and send it to the nearest edge of a very large network, which means the coffee shop wireless, the hotel network and your own internet provider see an encrypted tunnel instead of a list of the places you go.

The second half is the resolver. Domain lookups normally travel in plain text to whichever server your router hands you, which is both slow and completely visible. This client sends them encrypted to a resolver that answers in single digit milliseconds from almost anywhere. Running it in resolver only mode without the tunnel is a legitimate configuration and is often the faster option.

The two modes and when to use each

Resolver only mode encrypts domain lookups and leaves the rest of your traffic alone. It is close to free in performance terms, it usually makes browsing feel slightly faster because the lookups are quicker, and it stops the network you are on from building a list of the sites you visit from the lookups alone. On a home connection you trust, this is often all you want.

Full tunnel mode wraps everything. On a public network this is the correct setting and there is no real argument against it. The transport is a modern protocol designed for exactly this, so the overhead is far lower than the older tunnel protocols, and on many connections the routing improvement actually makes throughput better rather than worse.

Performance and routing

Because the tunnel terminates at a very widely distributed network, the first hop is usually physically close, and from there traffic travels over a private backbone rather than the public path. On a connection whose provider routes badly, this can measurably reduce latency to distant servers, which is the opposite of what people expect from a tunnel.

There is a split tunnel configuration for excluding specific applications or address ranges, which is necessary for local network resources like a printer or a file server that must not go through the tunnel. Exclusions can be set by application, by hostname or by address range, and the defaults already exclude private address space.

Filtering, honesty about limitations and daily use

The resolver can be pointed at variants that block known malware hosts, and optionally adult content, at the lookup level. This is coarse filtering rather than a security product, and it should be understood as one layer among several rather than protection on its own.

The honest limitations: the operator of the tunnel can see your traffic destinations by definition, so this moves trust from your network provider to a different company rather than eliminating it. It does not change your apparent country in any useful way. It does not make you anonymous. What it does, it does very well and for nothing, and that combination is why it is worth installing on a laptop that connects to networks you do not control.

What you get

• System wide encrypted tunnel over a modern low overhead transport
• Encrypted domain resolution with very low lookup latency
• Resolver only mode for encrypting lookups without tunnelling traffic
• Split tunnel exclusions by application, hostname or address range
• Private address space excluded by default so local resources keep working
• Optional resolver variants that filter known malware and adult hosts
• Automatic reconnection on network change without dropping sessions
• Connection quality diagnostics built into the client
• No account required for the free tunnel

Inside the archive

• WARP client installer, offline
• Configuration profile with sensible split tunnel defaults
• Language files for the interface list shown above
• Notes covering resolver only mode and exclusion syntax

System requirements

Installing it

1. Unpack the archive and run the installer as administrator, since it installs a network adapter.
2. Allow the network adapter driver when prompted, otherwise the tunnel cannot come up.
3. On first launch choose resolver only or full tunnel mode.
4. Add exclusions for any local network resources such as printers or file servers.
5. Check the connection status panel and confirm the tunnel reports connected before relying on it.

Mirrors

Release history

Questions about this release

Comments

Comments are read before they appear. If a build stops working, say so here and it gets rebuilt rather than quietly left up.