WARP

By default a profile's traffic leaves a node from the node's own address. With WARP it leaves through Cloudflare's network instead: sites see a Cloudflare address, not your hoster's. A node has at most one WARP account, and every profile with the WARP exit on that node goes through it. Both Hysteria2 and AmneziaWG profiles can use it.

How it fits together#

• The exit is a profile setting. Exit (in Advanced for Hysteria2, in Basics for AmneziaWG) is Direct or WARP.
• The account belongs to a node. It is set up on the WARP card of the node: node → Settings, the first card. The WARP chip in the node's header leads there too.
• A profile with the WARP exit needs an account on every node it runs on. The editor lists the nodes of the profile that have no working WARP, each a link to its WARP card.

To offer people both exits, make a twin of the profile with the other exit ("WARP copy"): see Profiles.

Fail-closed#

A profile with the WARP exit never leaves directly. If WARP is not there, the profile does not carry traffic, instead of silently showing people's traffic from the node's own address:

The add-profile dialog warns before the click when the node has no WARP, has it paused, or its tunnel is down. The doctor's WARP exit check and the client-eye checks show the same from the other side: a node whose direct profile works while its WARP profile fails gets an alert that names the WARP exit. See Health.

Getting an account#

The card of a node without an account says Not set up and offers two ways. Both need the owner and a fresh confirmation of the sign-in (step-up), and both need an agent that supports WARP; an older agent gets a link to Updates.

Enable WARP (register)#

Enable WARP registers a new Cloudflare WARP account for this node and stores it encrypted. The window says what the click does:

• it is an anonymous device account: no e-mail, no password;
• the request leaves from the panel's address, not from the node;
• it accepts the Cloudflare WARP terms on your behalf, for this one account. The window links the terms, and Enable WARP stays off until you tick "I have read the Cloudflare WARP terms and accept them for this account".

It takes a few seconds; then the node brings the tunnel up. If Cloudflare refuses new accounts from the panel's address ("Cloudflare refuses new accounts from the panel's address right now"), the window offers Import wgcf profile.

Import a wgcf profile#

Use this when registration from the panel does not work. Make the files with the wgcf tool on a computer where it works, then paste them or open them with Open file:

The WARP card#

Next to the title the card shows where the account came from (Registered here or Imported), the account type (free or plus) and the Cloudflare data centre of the last probe.

States#

Health of the link#

• Handshake: when the tunnel last completed a handshake with Cloudflare.
• Endpoint: the Cloudflare address and port in use.
• Traffic: bytes in and out through the tunnel.
• Cloudflare and Other site: two probes through the tunnel, one to Cloudflare and one to a site outside it. Each reads ok with its time, slow (over 2 seconds) or no answer (nothing within 6 seconds).
• "Checked N s ago". The node checks every 30 seconds, every 5 while the tunnel is starting. A run of failures shows as "3 failed checks in a row".
• Details: the WireGuard backend, Cloudflare's own flag (warp=on, warp=plus or warp=off) and whether the account's reserved bytes are stamped on packets.

When a check fails, the card says what happened and what it means, in words: Cloudflare did not answer through WARP, the traffic does not go through WARP (warp=off), no handshake for over 3 minutes, no handshake yet, the interface is not up, no WireGuard on the host.

Recovering by itself#

While the tunnel is down, the node climbs a ladder, one step per failed check:

1. it sets the routes, rules and device up again;
2. it tries the other Cloudflare addresses and ports: ports 2408, 500, 1701 and 4500, the IPv4 endpoint first, then the IPv6 one if the account has it;
3. it asks the panel to read the account from Cloudflare again (this needs the access token and creates nothing);
4. it gives up and the card says Needs your attention.

After the last step it rests for 10 minutes, still trying the next address after each failed check, and then starts over. The card shows the step it is on ("Trying to recover: switched the address and port to …").

Buttons#

Some problems need you, not a button. The card names them:

• the routing table WARP uses (51820) holds another program's routes, often wg-quick: free the table or stop the other tunnel;
• another program uses the routing-rule priorities WARP needs (90 and 110);
• a network interface named mgwarp already exists and is not WARP's;
• the node could not apply the account: the reason is in the node's events.

IPv4 and IPv6#

• The account stores Cloudflare's endpoint as IP addresses, never as a name. The node tries the IPv4 endpoint on every port first, then the IPv6 one, if the account has it.
• New accounts often have no IPv6 address inside the tunnel. Then the WARP exit dials IPv4 only, and IPv6-only destinations are not reachable through WARP.
• A node without IPv6 is fine for WARP: the doctor notes that WARP goes through its IPv4 address.
• Names are resolved with the node's DNS for user traffic, the same as for the direct exit. See DNS.

What the host needs#

A WireGuard kernel module, or /dev/net/tun for the userspace one. A node installed with an old service unit may hide /dev/net/tun from the agent; run mistgate-node install once with the current binary to rewrite the unit.

Registration settings#

Two things about registration are not in the admin, only in the API (WarpService.GetWarpRegistrationParams and UpdateWarpRegistrationParams, owner only):

• the values the registration request is built from (the API version, the user agent, the client version and the TLS fingerprint). Cloudflare changes what it accepts from time to time. An empty value falls back to the built-in one, and the read call returns the built-in values next to yours;
• automatic re-registration, off by default. When it is on and Cloudflare revokes a registered account, the panel registers a new one by itself, at most once an hour per node. Turning it on accepts the Cloudflare terms for those future accounts too.

See API.