Donning a MASQUE: building a new protocol into Cloudflare WARP

MASQUE support lands in Cloudflare WARP for iOS

Cloudflare has announced that its consumer WARP iOS app now supports MASQUE, a new protocol framework that extends HTTP/3 to proxy IP and UDP traffic. The company is framing this as a shift toward a faster, more flexible tunneling standard—one that builds on the same underlying technology that powers an increasing share of web traffic. The feature is rolling out first in a beta version of the iOS app, with plans to bring it into Cloudflare’s Zero Trust enterprise offering later.

Why WARP is moving beyond WireGuard

WARP originally launched using WireGuard, and that choice was driven largely by simplicity. The protocol is only about 4,000 lines of code, uses public-key cryptography to establish encrypted tunnels, and has proven easy to implement across platforms. Cloudflare currently supports WireGuard clients on iOS, Android, macOS, Windows, and Linux.

But that simplicity comes with tradeoffs. WireGuard is rigid—it lacks built-in mechanisms for session management, congestion control, or fast recovery from error states. It also relies on non-standard cryptography, which makes it harder to adopt newer standards like post-quantum crypto. MASQUE, by contrast, is an IETF standard built on QUIC, and it fits more naturally into the direction the Internet is heading.

Embracing HTTP/3 and QUIC

The push toward MASQUE reflects broader adoption of HTTP/3. Cloudflare’s Radar data shows that while HTTP/2 still carries most traffic, HTTP/3 accounted for 28% of traffic as of June 2023. When RFC 9000—the QUIC transport protocol—was published, Cloudflare enabled it for all customers the next day.

HTTP/3 offers several advantages over earlier versions. It reduces connection establishment time by combining transport and security handshakes, eliminating the need for the multiple round trips required by TCP+TLS. It also avoids head-of-line blocking so that a lost packet doesn’t stall every stream on a connection. And because QUIC encrypts nearly its entire wire image, new transport features are easier to deploy without interference from middleboxes that stymied TCP evolution.

These properties matter for proxying. Standard web traffic benefits from reliable streams, but tunneling UDP or IP packets requires an unreliable datagram path. QUIC’s datagram extension provides that substrate, which is what makes MASQUE viable for VPN-style traffic.

How MASQUE tunneling works

MASQUE extends the familiar HTTP-CONNECT method, which opens a tunnel between a client and a proxy for relaying traffic. Cloudflare already uses HTTP-CONNECT for many services. The MASQUE working group has extended this concept to run multiple concurrent stream- and datagram-based connections over QUIC, using the same port 443 used by general HTTP/3 traffic.

From a development standpoint, Cloudflare is leaning on existing infrastructure. The company already runs MASQUE for iCloud Private Relay and other Privacy Proxy partners, using its Rust-based proxy framework and its open-source QUIC implementation, quiche. These components are deployed globally and have been operating at scale, which gives Cloudflare a head start in refining performance. Improvements made to MASQUE-based connections for WARP will also benefit HTTP-CONNECT customers, and vice versa.

MASQUE’s standards-based nature also leaves room for future extensions. Cloudflare is particularly interested in Multipath QUIC, which would allow a single logical QUIC connection to use multiple network interfaces simultaneously—for example, LTE and WiFi on a phone—enabling seamless switching between them and reducing disruptions when users move between networks.

Trying MASQUE in the WARP beta

Cloudflare is inviting users to join a waitlist for the MASQUE beta. Participants need a valid iOS device with TestFlight installed. Invitations will be sent out on a first-come, first-served basis, starting as early as next week. The beta version of the WARP app will default to MASQUE, and it requires iOS 17 or later.

Users can switch between WireGuard and MASQUE from Settings > Personalization > Protocol.

Privacy protections unchanged

Despite the protocol change, Cloudflare’s privacy stance remains the same. WARP still routes DNS queries through 1.1.1.1, never writes user-identifiable logs to disk, does not sell or use browsing data for ad targeting, and can be used without any personal information such as name, phone number, or email address.