--- title: "Getting Started with CloudFlare Warp" description: "CloudFlare WARP is an easy-to-use VPN service with tons of features. Learn how to get it set up with this handy guide." canonical: "https://adamtheautomator.com/cloudflare-warp/" --- # Getting Started with CloudFlare Warp > CloudFlare WARP is an easy-to-use VPN service with tons of features. Learn how to get it set up with this handy guide. Source: https://adamtheautomator.com/cloudflare-warp/ --- ATA Learning Tap to hide [ ATA Learning ](/) * [Home](/) * [Tutorials](/tutorials/) * [Instructors](/author/) * [Advertising](/advertising/) * [Recommended Resources](/resources/) * [About Adam](/about-adam/) Search for: * [](https://twitter.com/adbertram) * [](https://github.com/Adam-the-Automator) * [](https://www.linkedin.com/company/adam-the-automator-llc) * [](/feed/) ![Getting Started with Cloudflare Warp](https://adamtheautomator.com/wp-content/uploads/2021/08/Getting-Started-with-CloudFlare-Warp.jpg) # Getting Started with Cloudflare Warp [![](https://secure.gravatar.com/avatar/f08b754bc0dce1c76685f6afa93185ecfb6f861fd14f993286e06bba69eaeb8b?s=192&d=mm&r=g)Adam Listek](https://adamtheautomator.com/author/alistek/)4 August 20217 min. read Categories: [Home Ops](/category/home-ops/) Tags:[CloudFlare](/tag/cloudflare/) Table of Contents * [Prerequisites](#prerequisites) * [Installing the Cloudflare WARP client](#installingthecloudflarewarpclient) * [Starting a VPN Connection with the Cloudflare WARP Client](#startinga-vpn-connection-with-thecloudflarewarpclient) * [Configuring the Cloudflare WARP Client](#configuring-the-cloudflare-warp-client) * [Connection Options](#connection-options) * [Configuring Split Networks](#configuring-split-networks) * [Defining Local Domain Fallback Entries](#defining-local-domain-fallback-entries) * [Configuring Proxy Mode](#configuring-proxy-mode) * [Combining the Cloudflare WARP client with Cloudflare Teams](#combining-the-cloudflare-warp-client-with-cloudflareteams) * [Installing the Root Cloudflare Certificate](#installing-the-root-cloudflare-certificate) * [Configuring a DNS over HTTPS (DoH) Subdomain](#configuring-a-dns-over-https-doh-subdomain) * [Enrolling the Cloudflare WARP Client in Cloudflare Teams](#enrolling-the-cloudflare-warp-client-in-cloudflare-teams) * [Creating a Device Enrollment Policy](#creating-a-device-enrollment-policy) * [Registering the Cloudflare WARP Client](#registering-the-cloudflare-warp-client) * [Conclusion](#conclusion) In the past, VPN tunnels have been challenging to set up and hard for folks to use. The [Cloudflare WARP client](https://developers.cloudflare.com/warp-client/) is a fast and modern VPN, built on top of the secure [WireGuard](https://www.wireguard.com/#conceptual-overview) protocol and free for everyone to use, consumer or business alike. In this article, you will learn how to use the Cloudflare WARP client and see how the Cloudflare WARP client is built for more than just consumer use. [Cloudflare Teams](https://www.cloudflare.com/zero-trust/), a [zero-trust](https://www.cloudflare.com/learning/security/glossary/what-is-zero-trust/) secure web gateway, leverages the WARP client to secure the network traffic of end-user systems to an internal system as well as the internet. Related:[How to Set Up End-to-End SSL Encryption with CloudFlare](https://adamtheautomator.com/cloudflare-ssl/) ## Prerequisites To follow along with the Cloudflare Teams enrollment, you need an existing [Cloudflare Teams account](https://developers.cloudflare.com/cloudflare-one/setup) set up. To use PowerShell commands, any recent version of PowerShell will work, and 7.1 is used in this article. In addition, all steps in this article are performed on a recent version of Windows 10. ## **Installing the Cloudflare WARP client** The Cloudflare WARP client is cross-platform with installation instructions for multiple different operating systems. In this article, you’re going to install the Windows OS installation of the Cloudflare WARP, but also available for mobile via the [Google Play Store](https://play.google.com/store/apps/details?id=com.cloudflare.onedotonedotonedotone&hl=en_US&gl=US) as well. Read on to learn how to get started! First, download the latest version of the [Windows x64 client](https://www.cloudflarewarp.com/Cloudflare_WARP_Release-x64.msi), which for this article is 1.5.461.0. Next, run the downloaded package and install with defaults. ## **Starting a VPN Connection with the Cloudflare WARP Client** Now that you have installed the Cloudflare WARP client, the installation program will make a system tray icon available to control the Cloudflare WARP client. To start the VPN connection, follow the steps below. 1\. Click on the Cloudflare WARP client contained within the system tray. ![System tray icon for Cloudflare WARP.](https://adamtheautomator.com/wp-content/uploads/2021/08/Untitled-2021-08-02T165403.836.png) System tray icon for Cloudflare WARP. 2\. Now, click **Next** on the “What is WARP?” and **Accept** on the “Our Commitment to Privacy” screens. This screen appears the first time you use Cloudflare WARP. ![Welcome to the Cloudflare WARP message. ](https://adamtheautomator.com/wp-content/uploads/2021/08/Untitled-2021-08-02T165440.012.png) Welcome to the Cloudflare WARP message. ![Cloudflare WARP privacy agreement,](https://adamtheautomator.com/wp-content/uploads/2021/08/Untitled-2021-08-02T165508.653.png) Cloudflare WARP privacy agreement, 3\. Click the toggle button to enable a secure VPN connection and connect to the Cloudflare network. This is disconnected by default. ![Enabled Cloudflare WARP client connection.](https://adamtheautomator.com/wp-content/uploads/2021/08/Untitled-2021-08-02T165553.309.png) Enabled Cloudflare WARP client connection. 4\. Finally, verify the VPN is connected by using PowerShell to check the IP the world is seeing your traffic come from. Invoke the `Invoke-RESTMethod` command to query the [ipify.org](https://www.ipify.org/) service. As shown below, the IP is different after the Cloudflare WARP VPN has been enabled. ```powershell Invoke-RESTMethod -URI 'https://api.ipify.org?format=json' | Select-Object -ExpandProperty IP ``` ![Invoke Rest Method](https://adamtheautomator.com/wp-content/uploads/2021/08/Untitled-2021-08-02T165646.703.png) Invoke Rest Method ## Configuring the Cloudflare WARP Client Now that you have installed the client, more advanced installation scenarios are possible with configuration options in the Cloudflare WARP client. Access the Cloudflare WARP client preferences by clicking on the gear icon and choosing the **Preferences** menu item. ![Preferences menu item.](https://adamtheautomator.com/wp-content/uploads/2021/08/Untitled-2021-08-02T165741.686.png) Preferences menu item. ### Connection Options Several preferences screens offer information only, such as **General**, but others allow configuration. Customize client behavior by clicking on the **Connection** pane. Here you can explicitly add Wi-Fi networks, under the **Network Name** section, to pause the VPN connection intended to keep traffic from leaving the VPN when connected or even set to disable the WARP client for all Wi-Fi or wired networks. In addition, you may customize the DNS Protocol option used in Cloudflare WARP and how [1.1.1.1 for Families](https://1.1.1.1/family/) DNS service option behaves, an option that allows for blocking content such as malware sites. The DNS Protocol option tells Cloudflare WARP which method to use to route DNS requests. The **Gateway DoH Subdomain** option is intended for use with Cloudflare Teams. The Gateway DoH Subdomain is a value specific to an account value to route all DNS requests for filtering against user-specified filter policies. ![Connection preferences page,](https://adamtheautomator.com/wp-content/uploads/2021/08/Untitled-2021-08-02T165811.070.png) Connection preferences page, ### Configuring Split Networks By default, when the Cloudflare WARP client is active, all traffic is sent over the VPN tunnel. There may be times when you may not want to send all traffic over the Cloudflare network. Within the Cloudflare WARP client, you can define certain routes that will not proxy traffic through the VPN. Navigate to the **Advanced → Split Tunnels** section of the Preferences dialog to modify excluded IP addresses or routes. ![Advanced preferences page.](https://adamtheautomator.com/wp-content/uploads/2021/08/Untitled-2021-08-02T165831.402.png) Advanced preferences page. Several default routes are already configured, but if you have a specific route to exclude, click the plus button to enter a specific route. ![Split Tunnels configuration.](https://adamtheautomator.com/wp-content/uploads/2021/08/Untitled-2021-08-02T165857.533.png) Split Tunnels configuration. ### Defining Local Domain Fallback Entries Much like the internet route option, you may also specify specific domains that will be excluded from the Cloudflare WARP VPN, known as **Local Domain Fallback** entries. When excluded, these domains will fall back to using the local DNS resolvers on the system. The excluded domain may be a local intranet site or a corporate network. Add either entry by navigating to the **Advanced → Local Domain Fallback** and clicking on the plus button to enter a domain and optional description. ![Entering a Fallback Domain.](https://adamtheautomator.com/wp-content/uploads/2021/08/Untitled-2021-08-02T165921.876.png) Entering a Fallback Domain. ### Configuring Proxy Mode The final advanced feature is the ability for Cloudflare WARP to act as a local proxy server. Perhaps you only want a specific application to route its traffic through the Cloudflare WARP VPN; with the local proxy server option, you can do just that. The format defines a local proxy server. `localhost:port` (default port is `4000`), that a SOCKS or HTTPS client may be configured to connect to and send traffic over. ![Enabling the local proxy server.](https://adamtheautomator.com/wp-content/uploads/2021/08/Untitled-2021-08-02T165941.811.png) Enabling the local proxy server. ## Combining the Cloudflare WARP client with **Cloudflare Teams** If you are a user of Cloudflare Teams, you may enhance the VPN connection via the Cloudflare WARP client to extend to filtering all DNS queries via Cloudflare Gateway DoH and HTTP filtering. There are three steps to make DNS and HTTP filtering work with Cloudflare Teams. 1. Install the root Cloudflare certificate to allow Cloudflare to inspect and filter SSL traffic. 2. Configure the Gateway DoH Subdomain, a value specific to an account to route DNS requests for filtering. 3. Configure a device registration to connect a given device to a Cloudflare Teams account. Let’s dive in and see how to combine these two tools. ### Installing the Root Cloudflare Certificate As a prerequisite to enabling HTTP filtering for Cloudflare Teams over the Cloudflare WARP client, you must first download, install, and trust the Cloudflare Root certificate to allow Cloudflare to inspect and filter SSL traffic. Follow along below to install the certificate on Windows 10. 1\. First, download the root CA certificate. 2\. Next, double-click on the certificate to start the installation. ![Certificate Information.](https://adamtheautomator.com/wp-content/uploads/2021/08/Untitled-2021-08-02T170025.886.png) Certificate Details. 3\. First, click on **Install Certificate** and then choose **Local Machine**, to import the certificate for use with all users on the system. ![Choose Local Machine to import the certificate to.](https://adamtheautomator.com/wp-content/uploads/2021/08/Untitled-2021-08-02T170102.850.png) Choose Local Machine to import the certificate to. 4\. Choose the option for “**Place all certificates in the following store**,” choose the **Trusted Root Certificate Authorities** and click **OK**. As the Cloudflare root CA certificate is not intended for public use, your system will not trust this certificate by default. Installing the certificate will inform your system to trust this traffic. ![Placing the certificate in the Trusted Root Certificate Authorities certificate store.](https://adamtheautomator.com/wp-content/uploads/2021/08/Untitled-2021-08-02T170151.633.png) Placing the certificate in the Trusted Root Certificate Authorities certificate store. 5\. Finally, click **Finish** to complete the certificate import. ### Configuring a DNS over HTTPS (DoH) Subdomain To allow the WARP client to use DNS filtering within Cloudflare Teams, you need to locate the DoH subdomain within Cloudflare Teams, which gives your system a Cloudflare account specific location to filter DNS traffic against. To do so, follow the steps below. 1\. First, login via a web browser to the [Cloudflare Teams dashboard](https://one.dash.cloudflare.com/). 2\. Next, navigate to **Gateway → Locations** and click on **Add Location**. The location is a descriptive name for a set of DNS and HTTP filtering policies. ![Adding a new location into Cloudflare Teams.](https://adamtheautomator.com/wp-content/uploads/2021/08/Untitled-2021-08-02T170250.854.png) Adding a new location into Cloudflare Teams. 3\. Name your location, set to External as an example in this article, and click **Add Location**. ![Creating a new location.](https://adamtheautomator.com/wp-content/uploads/2021/08/Untitled-2021-08-02T170332.501.png) Creating a new location. 4\. Copy the highlighted subdomain section and click **Done** to add the location. The copied text will then be used in the Cloudflare WARP client. ![Copying the subdomain for DoH set up in the Cloudflare WARP client.](https://adamtheautomator.com/wp-content/uploads/2021/08/Untitled-2021-08-02T170412.138.png) Copying the subdomain for DoH set up in the Cloudflare WARP client. 5\. Within the Cloudflare WARP client preferences Connection pane, enter the newly setup location DoH subdomain and click **Save**. ![Configuring the Gateway DoH Subdomain.](https://adamtheautomator.com/wp-content/uploads/2021/08/Untitled-2021-08-02T170451.771.png) Configuring the Gateway DoH Subdomain. ### Enrolling the Cloudflare WARP Client in Cloudflare Teams The final step for configuring the Cloudflare WARP client for Cloudflare Teams is via device registration and enrollment. The registration and enrollment step ensures that you are in explicit control of what devices are filtered. #### Creating a Device Enrollment Policy 1\. Open the Cloudflare Team dashboard and navigate to **Settings → Devices**. Click on **Manage** under Device Enrollment. ![Navigating to the Manage Device Enrollment settings.](https://adamtheautomator.com/wp-content/uploads/2021/08/Untitled-2021-08-02T170536.283.png) Navigating to the Manage Device Enrollment settings. 2\. Click on Add Rule. ![Creating a new Device Enrollment policy.](https://adamtheautomator.com/wp-content/uploads/2021/08/Untitled-2021-08-02T170609.324.png) Creating a new Device Enrollment policy. 3\. Create an **Allow** device rule with an include set to **Everyone**. By setting this rule to everyone, any device explicitly registered will be allowed without meeting additional conditions such as a specific country. All other values are set to their defaults and finally, click on **Save**. ![Create an Allow rule set to include Everyone.](https://adamtheautomator.com/wp-content/uploads/2021/08/Untitled-2021-08-02T170650.240.png) Create an Allow rule set to include Everyone. 4\. Set a **Session Duration** before requiring a login, here it is set to **1 month** but set yours to an appropriate length, the maximum, and click **Save**. ![Set the session duration to a maximum of 1 month.](https://adamtheautomator.com/wp-content/uploads/2021/08/Untitled-2021-08-02T170740.347.png) Set the session duration to a maximum of 1 month. #### Registering the Cloudflare WARP Client With the location defined and enrollment policies defined, you must register the device with Cloudflare Teams to start using the DNS and HTTP filtering abilities. 1\. Open the Cloudflare WARP client preferences and navigate to the Account page. Once there, click on the **Login with Cloudflare for Teams** button. ![Navigate to the Cloudflare WARP client Preferences → Account.](https://adamtheautomator.com/wp-content/uploads/2021/08/Untitled-2021-08-02T170820.731.png) Navigate to the Cloudflare WARP client Preferences → Account. 2\. Click **Next** on the overview prompt and **Accept** on the Privacy prompt. ![Cloudflare Teams informational pop-up. ](https://adamtheautomator.com/wp-content/uploads/2021/08/Untitled-2021-08-02T170858.986.png) Cloudflare Teams overview pop-up. ![Privacy agreement.](https://adamtheautomator.com/wp-content/uploads/2021/08/Untitled-2021-08-02T170932.001.png) Privacy agreement. 3\. Enter the Cloudflare Teams account name. You can find the account name on the Cloudflare Teams dashboard, **Settings → General Settings → Team domain**. ![Entering the team name for registration.](https://adamtheautomator.com/wp-content/uploads/2021/08/Untitled-2021-08-02T171009.758.png) Entering the team name for registration. 4\. Sign in to register your device with Cloudflare for Teams. ![Signing in to the Cloudflare Teams account.](https://adamtheautomator.com/wp-content/uploads/2021/08/Untitled-2021-08-02T171051.837.png) Signing in to the Cloudflare Teams account. 5\. If the sign-in was successful, you will see a success message. If so, click **OK** to dismiss. ![Success message.](https://adamtheautomator.com/wp-content/uploads/2021/08/Untitled-2021-08-02T171136.718.png) Success message. Finally, the Cloudflare WARP client will have a different look to note that it is now connected to Teams rather than the WARP network by itself, as shown below. ![Cloudflare WARP client](https://adamtheautomator.com/wp-content/uploads/2021/08/Untitled-2021-08-02T171211.283.png) Cloudflare WARP client Related:[How to Host an Azure Static Website Backed by Cloudflare](https://adamtheautomator.com/azure-static-website/) ## **Conclusion** The Cloudflare WARP client makes securing an internet connection quick with minimal configuration. By focusing on speed and portability, a powerful cross-platform VPN connection allows you to secure your connection with less of a performance hit to the overhead of the connection. What will you use Cloudflare WARP to secure? Share this article [Share on X](https://twitter.com/intent/tweet?url=https%3A%2F%2Fadamtheautomator.com%2Fcloudflare-warp%2F&text=Getting%20Started%20with%20Cloudflare%20Warp)[Share on Facebook](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fadamtheautomator.com%2Fcloudflare-warp%2F)[Share on LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fadamtheautomator.com%2Fcloudflare-warp%2F) ## Related Posts ![](https://adamtheautomator.com/wp-content/uploads/2021/10/python-if-else-if.jpg) ### [Python If Else If Explained: A Guide to Conditional Logic](/python-if-else-if/) Discover the essentials of Python if else if with our concise guide. Enhance your coding with key insights to conditional logic, tailored for all skill levels. ![](https://adamtheautomator.com/wp-content/uploads/2021/06/How-to-Recall-Email-in-Outlook-Preventing-that-Oh-Crap-Moment.jpg) ### [How to Recall Email in Outlook: A Step-By-Step Guide to Undoing Mistakes](/recall-outlook-email/) Learn how to recall Outlook email by understanding how Outlook recall works and how to implement it in this handy tutorial. ![](https://adamtheautomator.com/wp-content/uploads/2023/09/revo-uninstaller.jpg) ### [Optimize Windows System Performance Using Revo Uninstaller](/revo-uninstaller/) Need to remove, clean up and d spring clean on your Windows 10 PC? IF so, learn how to clean house with Revo Uninstaller. ## Categories * [IT Ops](/category/it-ops/) * [Cloud](/category/cloud/) * [DevOps](/category/devops/) * [Home Ops](/category/home-ops/) * [Information Security](/category/infosec/) * [Software Development](/category/software-development/) ## Site * [Home](/) * [Tutorials](/tutorials/) * [Instructors](/author/) * [Advertising](/advertising/) * [Recommended Resources](/resources/) * [About Adam](/about-adam/) Copyright 2026© ATA Learning | [Privacy Policy](/privacy/)