WARP with firewall
If your organization uses a firewall or other policies to restrict or intercept Internet traffic, you may need to exempt the following IP addresses and domains to allow the WARP client to connect.
Client orchestration API
The WARP client talks with our edge via a standard HTTPS connection outside the tunnel for operations like registration or settings changes. To perform these operations, you must allow
zero-trust-client.cloudflareclient.com which will lookup the following IP addresses:
- IPv4 API Endpoints:
- IPv6 API Endpoints:
All DNS requests through WARP are sent outside the tunnel via DoH (DNS over HTTPS). The following IP addresses must be reachable for DNS to work correctly.
- IPv4 DoH Addresses:
- IPv6 DoH Addresses:
If you are deploying the Cloudflare One Agent on Android/ChromeOS, you must also add
cloudflare-dns.com to your firewall exception list. On Android/ChromeOS devices, WARP uses
cloudflared-dns.com to resolve domains on your .
Client authentication endpoint
- The IdP used to authenticate to Cloudflare Zero Trust
WARP ingress IP
These are the IP addresses that the WARP client will connect to. All traffic from your device to the Cloudflare edge will go through these IP addresses.
- IPv4 Range:
- IPv6 Range:
WARP UDP ports
WARP utilizes UDP for all of its communications. By default, the UDP port required for WARP is
UDP 2408. WARP can fallback to
UDP 1701, or
The following domains are used as part of our captive portal check:
As part of establishing the WARP connection, the client will check the following URLs to validate a successful connection:
engage.cloudflareclient.comverifies general Internet connectivity outside of the WARP tunnel.
connectivity.cloudflareclient.comverifies connectivity inside of the WARP tunnel. Because this check happens inside of the tunnel, you do not need to add
connectivity.cloudflareclient.comto your firewall allowlist.
While not required for the WARP client to function, we will report connectivity issues to our NEL endpoint via
a.nel.cloudflare.com. This is not technically required to operate but will result in errors in our logs if not excluded properly.
Scope of firewall rules
If your organization does not currently allow inbound/outbound communication over the IP addresses, ports, and domains described above, you must manually add an exception. The rule at a minimum needs to be scoped to the following process based on your platform:
C:\Program Files\Cloudflare\Cloudflare WARP\warp-svc.exe
C:\Program Files\Cloudflare\Cloudflare WARP\warp-dex.exe