Cloudflare WARP vs VPN: What the Client Actually Does

Search “Cloudflare WARP vs VPN explained” and the answers contradict each other, because two different products ship under the name WARP and three different things get called a VPN. Cloudflare settled the semantic argument in its own launch post back in April 2019: “Technically, WARP is a VPN.” So the label is not the interesting question. The interesting question is which job it does, because it does one of the three well, one only if you build it, and one not at all.

Those three jobs:

1. Exit-IP relocation. Look like you are somewhere else. This is what commercial VPN subscriptions sell.
2. Corporate remote access. Put a laptop on 10.0.0.0/8 so it can reach the file server and the jump host. IPsec/IKEv2 concentrators, OpenVPN servers, SSL VPN appliances.
3. Encrypted transport for an untrusted last mile. Stop the hotel Wi-Fi and the ISP from seeing where you go.

WARP does job 3 by default, job 2 only with a connector and policy behind it, and job 1 deliberately not at all.

Two products, one name

Consumer 1.1.1.1 with WARP needs no account, holds no organisation policy, and exists to encrypt your traffic and move DNS to Cloudflare’s resolver. The Cloudflare One Client (the enterprise build of the same client) enrols the device into a Zero Trust organisation. At that point the tunnel is carrying identity, and Cloudflare’s docs describe the client as making it possible to build Access or Gateway policies that check “a device’s location, disk encryption status, OS version, and more.”

Same binary, same transport, completely different security proposition. Most of the confused comparisons online are comparing the consumer app against a corporate VPN concentrator, which is a category error.

The data path: MASQUE by default, WireGuard on request

WARP began on a WireGuard implementation. It is not the default any more. Cloudflare’s docs list the device tunnel protocol as MASQUE (default), which “establishes an HTTP/3 connection to Cloudflare” and encrypts with TLS 1.3 and the FIPS 140-3 compliant cipher suite TLS_AES_256_GCM_SHA384, with WireGuard available as the alternative on a suite the same page marks as non-FIPS-compliant.

MASQUE is not a Cloudflare protocol. It is the IETF work on proxying inside HTTP: RFC 9298, Proxying UDP in HTTP (Standards Track, August 2022) and RFC 9484, Proxying IP in HTTP (Standards Track, October 2023). A full-device tunnel has to carry arbitrary IP packets, which is what 9484 specifies.

Cloudflare’s engineering rationale for moving is blunt about WireGuard’s limits in this role: it “is not easily extended” for things like FIPS-compliant cipher suites, it uses a non-standard port (51820 by default, 2408 in WARP), and being non-standards-based it “can be blocked, sometimes intentionally, sometimes not.”

The port table is where that becomes operational, per Cloudflare’s firewall requirements:

	MASQUE	WireGuard
Default port	UDP 443	UDP 2408
Fallback ports	UDP 500, 1701, 4500, 4443, 8443, 8095; TCP 443	UDP 500, 1701, 4500
Edge IPv4	162.159.197.0/24	162.159.193.0/24
Edge IPv6	2606:4700:102::/48	2606:4700:100::/48
Device IP	unique, from 100.96.0.0/12	172.16.0.2 on every device unless unique IPs are enabled

Two rows matter more than the rest. MASQUE has a TCP 443 fallback; WireGuard has no TCP path at all, so a network that drops UDP kills it outright. And the WireGuard default hands 172.16.0.2 to every enrolled device, so anything that keys on client IP sees one host for the whole fleet, while MASQUE assigns a per-device address out of the CGNAT range 100.96.0.0/12.

What WARP will not do for you

It is not an exit-node picker. There is no country list. Traffic egresses at the nearest Cloudflare data centre. If the goal is a Netherlands IP for a streaming catalogue, this is the wrong tool and no setting fixes that.

It moves trust, it does not remove it. Your ISP stops seeing your destinations and Cloudflare starts. The published commitments are specific: Cloudflare states it “only collect[s] limited DNS query and traffic data (excluding payload)”, retaining the app install ID, data transfer volume, and average connection speed for the region, alongside the 2019 pledges not to write user-identifiable log data to disk and never to sell browsing data. That is a good policy. It is still a policy, not a mathematical guarantee, and it is the correct thing to weigh rather than the word “VPN”.

It is not a LAN bridge by default. The Split Tunnels default mode is “Exclude IPs and domains: all traffic will be sent to Cloudflare Gateway except for the IPs and domains you specify”, and Cloudflare’s default exclusion list carries 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16. RFC 1918 space stays on the local link. Turning WARP on does not put a remote laptop on the office 10.20.0.0/16; you get there by narrowing the excluded range (subtract your subnet from the RFC 1918 base and re-add the remainder) and publishing the route through a connector. That is the actual VPN-replacement design, and it is covered in the Zero Trust ingress walkthrough.

”WARP is on” is not one state

The client has five modes, and they route very different amounts of traffic:

• Traffic and DNS (default): routes device traffic and forwards DNS to Cloudflare’s resolver. DNS, network, and HTTP filtering plus posture.
• DNS only: forwards DNS resolution but does not route device traffic. DNS filtering only.
• Traffic only: routes traffic on all ports and protocols; DNS stays on the OS resolver.
• Local proxy: forwards only explicitly-directed local HTTP traffic, listening on port 40000 by default. Requires MASQUE; WireGuard is not supported here.
• Posture only: collects device health data, routes nothing, forwards no DNS.

A device in Posture only mode shows a connected client and sends zero packets through Cloudflare. Check the mode before debugging a “the VPN is not working” ticket.

Which one you actually want

• Untrusted Wi-Fi and household DNS filtering: consumer 1.1.1.1 with WARP in Traffic and DNS mode. Genuinely good at this and free.
• A specific exit country: not WARP. Buy a commercial VPN.
• Retiring a VPN concentrator: Cloudflare One Client plus Access policies plus a tunnel connector. The client alone is transport, not access control. The Access vs Tailscale comparison covers the proxy-versus-mesh decision that sits underneath this.
• Flat peer-to-peer reachability between machines you own: a mesh is the better shape. WireGuard Lab covers the protocol directly and Tailscale Guide covers the managed version of it.

Things to test before you call it done

warp-cli status
warp-cli settings | grep protocol
curl -s https://www.cloudflare.com/cdn-cgi/trace | grep -E 'warp|gateway|kex|colo'
resolvectl status | grep -A2 'DNS Servers'
ip route get 10.20.0.10
mtr -rwc 20 1.1.1.1
iperf3 -c <your-host> -t 30 -P 4

warp=on and gateway=on in the trace output are the only real confirmations that traffic and policy are both live; the tray icon is not evidence. The kex field tells you the key agreement in use, which is how you confirm the post-quantum hybrid Cloudflare shipped for the MASQUE tunnel in September 2025 is actually negotiating. Run ip route get against an address inside your private range to see whether the split-tunnel policy sends it to the tunnel interface or the local gateway, and run the mtr and iperf3 pair with the client both on and off, because a tunnel that adds 40 ms to every path is a decision you should make knowingly rather than discover in three weeks.