Cloudflare Switches 1.1.1.1 and WARP to MASQUE

Cloudflare has announced that its consumer 1.1.1.1 and WARP apps, along with its Zero Trust device agents, now use MASQUE as the default protocol for securing internet connections. The apps provide two core functions: routing all DNS queries through Cloudflare's 1.1.1.1 resolver and protecting device traffic by creating an encrypted tunnel to destination resources, shielding users from snooping on public Wi-Fi networks or by unwanted third parties.

MASQUE is a framework for proxying traffic that enables application protocols, including HTTP/3, to run over QUIC. QUIC is an internet-standard transport protocol built on UDP that is encrypted by default and designed for mobile networks, maintaining connections through poor connectivity and rapid network changes. HTTP/3 defines the application layer on top of QUIC. MASQUE extends the HTTP CONNECT model to tunnel UDP and IP traffic, leveraging QUIC's unreliable datagram extension for efficiency. Its CONNECT-IP method establishes a tunnel supporting multiple concurrent requests over a single QUIC connection.

Cloudflare cites several advantages for MASQUE over older protocols like IPSec, WireGuard, or OpenVPN. Because it is HTTP/3-based, MASQUE traffic behaves like normal HTTP traffic, making it easier to support and compatible with existing firewall and security rules. It also supports cryptographic agility, including post-quantum crypto, making it more secure and resilient long-term. Cloudflare has already deployed MASQUE at scale for iCloud Private Relay and Microsoft Edge Secure Network.

Enabling MASQUE in the apps

All new installations of 1.1.1.1 and WARP apps support MASQUE across iOS, Android, macOS, Windows, and Linux. Cloudflare is rolling it out as the preferred protocol, gradually replacing WireGuard. On mobile, users can check or change the protocol via Advanced > Connection options > Tunnel protocol, choosing from:

  • Auto: the app selects the protocol.
  • MASQUE: always use MASQUE.
  • WireGuard: always use WireGuard.

On desktop, protocol switching is done through the WARP command-line interface. Existing users can download the latest WARP app to ensure MASQUE support.

DEX reaches general availability with Remote Captures

Digital Experience Monitoring (DEX) has moved from beta to general availability. The new feature, Remote Captures, allows IT admins to initiate network packet captures (PCAP) and WARP Diag logs remotely on end-user devices, eliminating the need for users to manually collect and share diagnostic data.

Remote Captures provide three primary benefits:

  • IT teams can quickly identify the root cause of network issues through detailed traffic analysis.
  • Security teams can proactively detect and investigate potential threats using granular network data.
  • Organizations can optimize network performance by identifying bottlenecks and latency issues.

The workflow is straightforward: select the device to troubleshoot, start the capture of network traffic and/or WARP Diag data, and download the results once complete for analysis with preferred tools.

Configuring Remote Captures

DEX Remote Captures are available to Cloudflare One customers via Cloudflare Dashboard > Zero Trust > DEX > Remote Captures. Documentation is available at Remote captures. Cloudflare notes the feature is part of its unified SASE platform for addressing security issues across SaaS applications, and interested users can start with the free tier.