A Linux client and per-app control

Cloudflare has expanded its WARP desktop client with two capabilities: support for Linux, and the option to route traffic from individual applications rather than the whole device. The Linux client is available now for Ubuntu, Red Hat Enterprise Linux, and CentOS, and the proxy mode is being added across all desktop platforms.

WARP, built on Cloudflare's BoringTun WireGuard implementation, encrypts device traffic and sends it to Cloudflare's edge. Traffic bound for Cloudflare customers is delivered directly from the edge; WARP+ uses Argo Smart Routing to find the shortest path through Cloudflare's network. The 1.1.1.1 DNS resolver handles lookups, and since most internet activity begins with a DNS request, the speed of that resolver affects nearly everything users do online.

What the Linux client includes

The desktop client was designed from the start with Linux in mind. The core of the product is written in Rust, and roughly 95 percent of the code is shared across platforms — internally the common component is called the shared Daemon (or Service on Windows). That approach lets Cloudflare push quality improvements to all platforms at once, and it means the code base has already been exercised by millions of existing WARP users before reaching Linux.

The remaining code is split between UI and operating-system-specific behavior. For now, Linux users get no UI: interaction is through the warp-cli command-line tool, which already ships with the other desktop clients and is used by some Cloudflare engineers as their preferred interface. Support currently covers:

  • Ubuntu
  • Red Hat Enterprise Linux
  • CentOS

Other Debian- and Red Hat-based distributions may work as well, though Cloudflare says additional official distribution support may come later. Users of unsupported distributions are encouraged to report feedback in the Cloudflare Community Forums.

Installation and basic usage

Installation instructions are available at https://pkg.cloudflareclient.com/install. After linking Cloudflare's repository, the package installs with either sudo apt install cloudflare-warp or sudo yum install cloudflare-warp, depending on the distribution. Detailed setup steps are in the WARP Client documentation.

Once installed, the CLI is invoked with warp-cli. Connecting requires two commands: register, which prompts for authentication, and connect, which enables the client and creates the WireGuard tunnel. To verify the connection is live, the trace command can be used to check that traffic is appropriately routed.

The CLI also exposes configuration options. warp-cli set-mode toggles between encrypting all traffic through WARP and using only the 1.1.1.1 DNS resolver. Malware protection through 1.1.1.1 for Families can be enabled in either mode.

Support for Cloudflare for Teams is planned for the same package in a future update; existing customers can request notification when a beta is available. Errors can be reported with sudo warp-diag feedback, and full command details are available via warp-cli --help or the documentation.

Proxy mode: WARP for specific applications

WARP has historically been an all-or-nothing client: once enabled, all device traffic is encrypted to Cloudflare's edge. Recent additions such as split tunnel and local domain fallback gave Cloudflare for Teams customers control over which routes WARP handles, and those options were quietly added to the consumer client as well. The new proxy mode addresses another deployment pattern: routing only the applications a user specifies.

In local proxy mode, WARP listens for HTTPS or SOCKS5 proxy traffic on a configurable local port. Only applications explicitly configured to use that proxy — a web browser or a specific app, for example — get their traffic encrypted through WARP. All other traffic remains unencrypted on the open internet.

Because the default state leaves most traffic unencrypted, the feature is intentionally tucked away in the advanced menu:

  1. Navigate to Preferences -> Advanced and click the Configure Proxy button.
  2. Check the box and set the port WARP should listen on.
  3. This enables a new mode selectable from the main client.

Applications then point to 127.0.0.1 as the proxy address and the chosen port (40000 by default). Firefox, for instance, configures its proxy settings to that address and port.

The desktop clients are available immediately at https://one.one.one.one.