methods / cloudflare-warp-guide
Cloudflare WARP: free 1.1.1.1 app, setup and limits
Short answer
Install the 1.1.1.1 WARP app, switch the mode to WARP, and your traffic rides Cloudflare's network over WireGuard or MASQUE with encrypted DNS. It beats DNS and SNI-level filtering for free - but there is no exit-country picker, so geo blocks stay.
WARP occupies a sweet spot the paid-VPN industry prefers to blur: it is a real, encrypted tunnel to a serious network, it is free, one toggle turns it on, and it was built by Cloudflare to survive the rough edges of mobile networks. What it is not is a VPN with a country picker - and that single fact decides whether it solves your block or not [1][2].
This guide covers what WARP actually changes on your connection, the setup on every platform, and when you should reach for something heavier.
What WARP changes - and what it deliberately does not
The client (Cloudflare now calls it the Cloudflare One Client, formerly WARP) creates an encrypted connection between your device and Cloudflare's network in two parts: your internet traffic rides a proxy tunnel over WireGuard or MASQUE, and your DNS queries go over DNS-over-HTTPS [1]. That kills the two cheapest forms of censorship in one move - name filtering and handshake cuts - without any configuration.
Three consequences matter for unblocking:
- DNS and SNI-level blocks die. Your lookups are encrypted, and the TLS handshake to the site happens inside the tunnel, so a censor cannot read the site name to cut it [1][6].
- Geo walls do not move. WARP connects you to the nearest Cloudflare location; there is no exit-country selection [1]. A site that refuses your country will keep refusing it.
- Trust moves, it does not vanish. Your ISP stops seeing what you do; Cloudflare sees the tunnel instead. That is a fine trade for most people, but it is not anonymity - the sites themselves see a Cloudflare egress address, which some sites greet with captchas [2][7].
Install and switch it on
The app is free for iOS, Android, macOS, Windows and Linux [4][3]:
- Get the 1.1.1.1 app from the official page [4] - store links for phones, installers for desktop, Linux included [3].
- Open Settings inside the app and choose your profile.
- Set the mode: 1.1.1.1 only encrypts just your DNS (the DoH setup as an app); WARP tunnels everything [1].
- Toggle the main switch on.
- Verify on the 1.1.1.1 help page - it should report "Using DNS over WARP: Yes" [5].
That is the whole installation. On Linux the client is command-line based and also offers a proxy mode that exposes a local SOCKS5 proxy instead of tunneling the whole machine - useful when you want only the browser tunneled [3].
Which mode for which problem
| Your problem | Mode | Why |
|---|---|---|
| ISP or school filters names (DNS block) | 1.1.1.1 only | encrypted lookups end the filter [1] |
| Page hangs on HTTPS, SNI cut | WARP | handshake moves inside the tunnel [1] |
| Nothing connects at all (IP block) | WARP | your traffic leaves from Cloudflare's network |
| Site refuses your region | WARP will not help | no exit picker - use a VPN |
| Site blocks Cloudflare's addresses | anything but WARP | some sites simply block WARP's egress range |
| Only the browser should be tunneled (Linux) | proxy mode | SOCKS5 proxy, no system-wide tunnel [3] |
WARP versus Psiphon and the Tor Browser: WARP is the fastest of the three and the least adversarial; in heavy-censorship environments where tunnels are actively hunted, Psiphon's obfuscation and Tor's bridges are built for that fight and WARP is not [1][6].
Honest limits
- It is not for evading geo blocks. No exit selection means streaming catalogs and region-locked services see your real general region [1].
- Some sites block WARP's addresses. Because traffic arrives from Cloudflare's known ranges, some services treat it with suspicion - the same pattern as corporate VPN exits.
- It is not anonymity. EFF's tool guide makes the right distinction: pick the tool for what you are protecting [7]. WARP protects your traffic from your local network; it does not make you anonymous to Cloudflare or to the sites.
- Corporate variant is different. The same client doubles as an endpoint agent with device-posture checks for organizations - if your employer manages the machine, the admin, not you, decides the mode [1].
When WARP is the right answer
Reach for WARP when the block is on your network and you want it gone in two minutes with zero cost: school and hotel Wi-Fi filtering, carrier-level DNS meddling, casual SNI cuts. Verify what happened with OONI Probe before and after [6], keep it on the phone as the standing default, and escalate to Psiphon or Tor only when the network fights back. For the geo-block case, our VPN buying guide and self-hosted VPN guide cover the tools with exit control.
One legal note, as everywhere on this site: circumvention tools are legal in most places, but not everywhere, and managed networks have their own rules. This guide is information, not legal advice [7].
FAQ
Is WARP a VPN?
Technically it builds the same kind of encrypted tunnel, but without the part most people buy a VPN for: choosing your exit country. Cloudflare designed it to protect your traffic on untrusted networks, not to relocate you.
Can WARP unblock geo-restricted sites?
No. WARP connects you to the nearest Cloudflare location and gives you no exit picker. Region-locked streaming and services keep seeing your real general region - a VPN with server locations is the tool for that.
What is the difference between the 1.1.1.1 mode and WARP mode?
The 1.1.1.1 mode only encrypts your DNS lookups over HTTPS. WARP mode tunnels all your traffic through Cloudflare's network as well. Name-filtering blocks fall to the first mode; handshake-level blocks need the full WARP mode.
Is WARP really free?
The basic WARP tier is free in the 1.1.1.1 app; a paid WARP+ tier buys more speed. You do not need WARP+ to get past a block - the free tier carries the full protection.
Why do some sites block WARP?
All WARP traffic arrives from Cloudflare's known address ranges, so sites that see heavy abuse from cloud exits sometimes just block them. If a site refuses WARP outright, a VPN with normal residential-looking exits or your plain connection will work better.
Does WARP hide my activity from Cloudflare?
No - Cloudflare is the endpoint of the tunnel, the same way a VPN provider is. Your ISP stops seeing your traffic details, and Cloudflare states what it does and does not log. If you need distance from the operator itself, that is Tor's threat model.
How do I verify WARP is protecting me?
Open the 1.1.1.1 help page with WARP on: it reports 'Using DNS over WARP' and shows the egress network you are presenting to sites.