Download WARP stable releases

This page contains the stable WARP client releases currently supported by Cloudflare. We recommend using stable releases for production environments. You can download stable releases from the links below after checking requirements.

Cloudflare also offers an unstable beta release track with the latest features and improvements. To preview new features before they are available in a stable release, refer to the beta release page.

Windows

Download latest stable release

OS version	Windows 10, Windows 11, Windows 365 Cloud PC running Windows 11
Processor	AMD64 / x86-64
.NET Framework version	4.7.2 or later
HD space	184 MB
Memory	3 MB
Network interface type	WIFI or LAN
Minimum MTU	1360 bytes1

Footnotes

1. WireGuard requires 1360 bytes for IPv6 and 1340 bytes for IPv4. MASQUE requires 1350 bytes for IPv6 and 1330 bytes for IPv4. ↩

Latest release

Version: Windows 2025.5.893.0 Date: 2025-06-30 Size: 129 MB

Download

Release notes

This release contains improvements and new exciting features, including SCCM VPN boundary support and post-quantum cryptography. By tunneling your corporate network traffic over Cloudflare, you can now gain the immediate protection of post-quantum cryptography without needing to upgrade any of your individual corporate applications or systems.

Changes and improvements

• Fixed a device registration issue that caused WARP connection failures when changing networks.
• Captive portal improvements and fixes:
  • Captive portal sign in notifications will now be sent through operating system notification services.
  • Fix for firewall configuration issue affecting clients in DoH only mode.
• Improved the connectivity status message in the client GUI.
• Fixed a bug affecting clients in Gateway with DoH mode where the original DNS servers were not restored after disabling WARP.
• The WARP client now applies post-quantum cryptography end-to-end on enabled devices accessing resources behind a Cloudflare Tunnel. This feature can be enabled by MDM.
• Improvement to handle client configuration changes made by an MDM while WARP is not running.
• Improvements for multi-user experience to better handle fast user switching and transitions from a pre-login to a logged-in state.
• Added a WARP client device posture check for SAN attributes to the client certificate check.
• Fixed an issue affecting Split Tunnel Include mode, where traffic outside the tunnel was blocked when switching between Wi-Fi and Ethernet networks.
• Added SCCM VPN boundary support to device profile settings. With SCCM VPN boundary support enabled, operating systems will register WARP's local interface IP with the on-premise DNS server when reachable.
• Fix for an issue causing WARP connectivity to fail without full system reboot.

Known issues

• Microsoft has confirmed a regression with Windows 11 starting around 24H2 that may cause performance issues for some users. These performance issues could manifest as mouse lag, audio cracking, or other slowdowns. Microsoft's recently released preview build, Windows 11 24H2 KB5060829, may resolve these issues.

• Devices with KB5055523 installed may receive a warning about Win32/ClickFix.ABA being present in the installer. To resolve this false positive, update Microsoft Security Intelligence to version 1.429.19.0 or later.

• DNS resolution may be broken when the following conditions are all true:

  • WARP is in Secure Web Gateway without DNS filtering (tunnel-only) mode.
  • A custom DNS server address is configured on the primary network adapter.
  • The custom DNS server address on the primary network adapter is changed while WARP is connected.

  To work around this issue, reconnect the WARP client by toggling off and back on.

Previous version history (12)

Windows 2025.4.943.0

Version: Windows 2025.4.943.0 Date: 2025-05-22 Size: 130 MB

Download

Release notes

This release contains a hotfix for managed networks for the 2025.4.929.0 release.

Changes and improvements

• Fixed an issue where it could take up to 3 minutes for the correct device profile to be applied in some circumstances. In the worst case, it should now only take up to 40 seconds. This will be improved further in a future release.

Known issues

• DNS resolution may be broken when the following conditions are all true:

  • WARP is in Secure Web Gateway without DNS filtering (tunnel-only) mode.
  • A custom DNS server address is configured on the primary network adapter.
  • The custom DNS server address on the primary network adapter is changed while WARP is connected.

  To work around this issue, reconnect the WARP client by toggling off and back on.

• Microsoft has confirmed a regression with Windows 11 starting around 24H2 that may cause performance issues for some users. These performance issues could manifest as mouse lag, audio cracking, or other slowdowns. A fix from Microsoft is expected in early July.

• Devices with KB5055523 installed may receive a warning about Win32/ClickFix.ABA being present in the installer. To resolve this false positive, update Microsoft Security Intelligence to version 1.429.19.0 or later.

Windows 2025.4.929.0

Version: Windows 2025.4.929.0 Date: 2025-05-14 Size: 130 MB

Download

Release notes

This release contains two significant changes all customers should be aware of:

1. All DNS traffic now flows inside the WARP tunnel. Customers are no longer required to configure their local firewall rules to allow our DoH IP addresses and domains.
2. When using MASQUE, the connection will fall back to HTTP/2 (TCP) when we detect that HTTP/3 traffic is blocked. This allows for a much more reliable connection on some public WiFi networks.

Changes and improvements

• Fixed an issue causing reconnection loops when captive portals are detected.
• Fixed an issue that caused WARP client disk encryption posture checks to fail due to missing drive names.
• Fixed an issue where managed network policies could incorrectly report network location beacons as missing.
• Improved DEX test error reporting.
• Fixed an issue where some parts of the WARP Client UI were missing in high contrast mode.
• Fixed an issue causing client notifications to fail in IPv6 only environments which prevented the client from receiving configuration changes to settings like device profile.
• Added a TCP fallback for the MASQUE tunnel protocol to improve connectivity on networks that block UDP or HTTP/3 specifically.
• Added new IP addresses for tunnel connectivity checks. If your organization uses a firewall or other policies you will need to exempt these IPs.
• DNS over HTTPS traffic is now included in the WARP tunnel by default.
• Improved the error message displayed in the client GUI when the rate limit for entering an incorrect admin override code is met.
• Improved handling of non-SLAAC IPv6 interface addresses for better connectivity in IPv6 only environments.
• Fixed an issue where frequent network changes could cause WARP to become unresponsive.
• Improvement for WARP to check if tunnel connectivity fails or times out at device wake before attempting to reconnect.
• Fixed an issue causing WARP connection disruptions after network changes.

Known issues

• DNS resolution may be broken when the following conditions are all true:

  • WARP is in Secure Web Gateway without DNS filtering (tunnel-only) mode.
  • A custom DNS server address is configured on the primary network adapter.
  • The custom DNS server address on the primary network adapter is changed while WARP is connected.

  To work around this issue, reconnect the WARP client by toggling off and back on.

• Microsoft has confirmed a regression with Windows 11 starting around 24H2 that may cause performance issues for some users. These performance issues could manifest as mouse lag, audio cracking, or other slowdowns. A fix from Microsoft is expected in early July.

• Devices with KB5055523 installed may receive a warning about Win32/ClickFix.ABA being present in the installer. To resolve this false positive, update Microsoft Security Intelligence to version 1.429.19.0 or later.

Windows 2025.2.664.0

Version: Windows 2025.2.664.0 Date: 2025-04-08 Size: 128 MB

Download

Release notes

This release contains a hotfix for captive portal detection for the 2025.2.600.0 release.

Changes and improvements

• Fix to reduce the number of browser tabs opened during captive portal logins.

Known issues

• DNS resolution may be broken when the following conditions are all true:

  • WARP is in Secure Web Gateway without DNS filtering (tunnel-only) mode.
  • A custom DNS server address is configured on the primary network adapter.
  • The custom DNS server address on the primary network adapter is changed while WARP is connected.

  To work around this issue, reconnect the WARP client by toggling off and back on.

Windows 2025.2.600.0

Version: Windows 2025.2.600.0 Date: 2025-03-31 Size: 128 MB

Download

Release notes

This release contains support for a new WARP setting, Global WARP override. It also includes significant improvements to our captive portal / public Wi-Fi detection logic. If you have experienced captive portal issues in the past, re-test and give this version a try.

Changes and improvements

• Improved captive portal detection to make more public networks compatible and have faster detection.
• Improved error messages shown in the app.
• Added the ability to control if the WARP interface IPs are registered with DNS servers or not.
• Removed DNS logs view from the Windows client GUI. DNS logs can be viewed as part of warp-diag or by viewing the log file on the user's local directory.
• Fixed an issue that would result in a user receiving multiple re-authentication requests when waking their device from sleep.
• WARP tunnel protocol details can now be viewed using the warp-cli tunnel stats command.
• Improvements to Windows multi-user including support for fast user switching. If you are interested in testing this feature, reach out to your Cloudflare account team.
• Fixed an issue with device revocation and re-registration when switching configurations.
• Fixed an issue where DEX tests would run during certain sleep states where the networking stack was not fully up. This would result in failures that would be ignored.
• Added a new Global WARP override setting. This setting puts account administrators in control of disabling and enabling WARP across all devices registered to an account from the dashboard. Global WARP override is disabled by default.

Known issues

• DNS resolution may be broken when the following conditions are all true:

  • WARP is in Secure Web Gateway without DNS filtering (tunnel-only) mode.
  • A custom DNS server address is configured on the primary network adapter.
  • The custom DNS server address on the primary network adapter is changed while WARP is connected.

  To work around this issue, reconnect the WARP client by toggling off and back on.

Windows 2025.1.861.0

Version: Windows 2025.1.861.0 Date: 2025-02-19 Size: 128 MB

Download

Release notes

This release contains only improvements.

Changes and improvements

• Improved command line interface for Access for Infrastructure with added function for filtering and ordering.
• Fixed client connectivity issues when switching between managed network profiles that use different WARP protocols.
• Added support for WARP desktop to use additional DoH endpoints to help reduce NAT congestion.
• Improved connectivity check reliability in certain split tunnel configurations.
• Improved reading of device DNS settings at connection restart.
• Improved WARP connectivity in environments with virtual machine interfaces.
• Improved Wireguard connection stability on reconnections.
• Improved reliability of device posture checks for OS Version, Unique Client ID, Domain Joined, Disk Encryption, and Firewall attributes.
• Added additional HTTP/3 QUIC connectivity test to warp-diag.
• Added support for collection of system health metrics for enhanced device Digital Experience Monitoring.
• Automated the removal of active registrations for devices with multiple registrations with the same Zero Trust organization.

Known issues

• DNS resolution may be broken when the following conditions are all true:

  • WARP is in Secure Web Gateway without DNS filtering (tunnel-only) mode.
  • A custom DNS server address is configured on the primary network adapter.
  • The custom DNS server address on the primary network adapter is changed while WARP is connected.

  To work around this issue, reconnect the WARP client by toggling off and back on.

Windows 2024.12.760.0

Version: Windows 2024.12.760.0 Date: 2025-01-09 Size: 126 MB

Download

Release notes

This release contains only a hotfix from the 2024.12.554.0 release.

Changes and improvements:

• Fixed an issue that could prevent clients with certain split tunnel configurations from connecting.

Known issues:

• DNS resolution may be broken when the following conditions are all true:

  • WARP is in Secure Web Gateway without DNS filtering (tunnel-only) mode.
  • A custom DNS server address is configured on the primary network adapter.
  • The custom DNS server address on the primary network adapter is changed while WARP is connected.

  To work around this issue, reconnect the WARP client by toggling off and back on.

Windows 2024.12.554.0

Version: Windows 2024.12.554.0 Date: 2024-12-19 Size: 126 MB

Download

Release notes

This release contains improvements to support custom Gateway certificate installation in addition to the changes and improvements included in version 2024.12.492.0.

Changes and improvements:

• Adds support for installing all available custom Gateway certificates from an account to the system store.
• Users can now get a list of installed certificates by running warp-cli certs.

Known issues:

• DNS resolution may be broken when the following conditions are all true:

  • WARP is in Secure Web Gateway without DNS filtering (tunnel-only) mode.
  • A custom DNS server address is configured on the primary network adapter.
  • The custom DNS server address on the primary network adapter is changed while WARP is connected.

  To work around this issue, reconnect the WARP client by toggling off and back on.

Windows 2024.12.492.0

Version: Windows 2024.12.492.0 Date: 2024-12-18 Size: 126 MB

Download

Release notes

This release contains minor fixes and improvements.

Changes and improvements:

• Consumers can now set the tunnel protocol using warp-cli tunnel protocol set <protocol>.
• Extended diagnostics collection time in warp-diag to ensure logs are captured reliably.
• Improved captive portal support by disabling the firewall during captive portal login flows.
• Improved captive portal detection on certain public networks.
• Improved reconnection speed when a Cloudflare server is in a degraded state.
• Fixed an issue where WARP may fail to remove certificates from the user store in Device Information Only mode.
• Ensured at most one Powershell instance is opened when fetching the device serial number for posture checks.
• Fixed an issue to prevent the daemon from following Windows junctions created by non-admin users that could be used to delete files as SYSTEM user and potentially gain SYSTEM user privileges.
• Improved reliability of connection establishment logic under degraded network conditions.
• Fixed an issue that caused high memory usage when viewing connection statistics for extended periods of time.
• Improved WARP connectivity in environments with virtual interfaces from VirtualBox, VMware, and similar tools.
• Reduced connectivity interruptions on WireGuard Split Tunnel Include mode configurations.
• Fixed connectivity issues switching between managed network profiles with different configured protocols.
• QLogs are now disabled by default and can be enabled with warp-cli debug qlog enable. The QLog setting from previous releases will no longer be respected.

Known issues:

• DNS resolution may be broken when the following conditions are all true:

  • WARP is in Secure Web Gateway without DNS filtering (tunnel-only) mode.
  • A custom DNS server address is configured on the primary network adapter.
  • The custom DNS server address on the primary network adapter is changed while WARP is connected.

  To work around this issue, reconnect the WARP client by toggling off and back on.

Windows 2024.11.309.0

Version: Windows 2024.11.309.0 Date: 2024-11-18 Size: 123 MB

Download

Release notes

This release contains minor fixes and improvements.

Changes and improvements:

• Fixed an issue where SSH sessions and other application connections over TCP or UDP could drop when a device that is using MASQUE changes its primary network interface.
• Fixed an issue to ensure the Cloudflare root certificate (or custom certificate) is installed in the trust store if not already there.
• Fixed an issue with the WARP client becoming unresponsive during startup.
• Extended diagnostics collection time in warp-diag to ensure logs are captured reliably.
• Fixed an issue that was preventing proper operation of DNS-over-TLS (DoT) for consumer users.

Known issues:

• DNS resolution may be broken when the following conditions are all true:

  • WARP is in Secure Web Gateway without DNS filtering (tunnel-only) mode.
  • A custom DNS server address is configured on the primary network adapter.
  • The custom DNS server address on the primary network adapter is changed while WARP is connected.

  To work around this issue, reconnect the WARP client by toggling off and back on.

Windows 2024.9.346.0

Version: Windows 2024.9.346.0 Date: 2024-10-03 Size: 122 MB

Download

Release notes

This release contains minor fixes and improvements.

Changes and improvements:

• Added target list to the warp-cli to enhance the user experience with the Access for Infrastructure SSH solution.
• Added pre-login configuration details to the warp-diag output.
• Added a tunnel reset mtu subcommand to the warp-cli.
• Added a JSON output option to the warp-cli.
• Added the ability for warp-cli to use the team name provided in the MDM file for initial registration.
• Added the ability to execute a PCAP on multiple interfaces with warp-cli and warp-dex.
• Improved warp-dex default interface selection for PCAPs and changed warp-dex CLI output to JSON.
• Fixed an issue where the client, when switching between WireGuard and MASQUE protocols, sometimes required a manual tunnel key reset.
• Added MASQUE tunnel protocol support for the consumer version of WARP (1.1.1.1 w/ WARP).

Known issues:

• Using MASQUE as the tunnel protocol may be incompatible if your organization has Regional Services enabled.

Windows 2024.8.458.0

Version: Windows 2024.8.458.0 Date: 2024-09-26 Size: 121 MB

Download

Release notes

This release contains minor fixes and improvements.

Notable updates

• Added the ability to customize PCAP options in the warp-cli.
• Added a list of installed applications in warp-diag.
• Added a summary of warp-dex traceroute results in its JSON output.
• Improved the performance of firewall operations when enforcing split tunnel configuration.
• Reduced the time it takes for a WARP client update to complete.
• Fixed an issue where clients using service tokens failed to retry the initial connection when there is no network connectivity on startup.
• Fixed issues where incorrect DNS server addresses were being applied following reboots and network changes. Any incorrect static entries set by previous WARP versions must be manually reverted.
• Fixed a known issue which required users to re-register when an older single configuration MDM file was deployed after deploying the newer, multiple configuration format.
• Deprecated warp-cli commands have been removed. If you have any workflows that use the deprecated commands, please update to the new commands where necessary.

Known issues

• Using MASQUE as the tunnel protocol may be incompatible if your organization has Regional Services enabled.
• DNS resolution may be broken when the following condition are all true:
  • WARP is in Secure Web Gateway without DNS filtering (tunnel-only) mode.
  • A custom DNS server address is configured on the primary network adapter.
  • The custom DNS server address on the primary network adapter is changed while WARP is connected. To work around this issue, please reconnect the WARP client by toggling off and back on.

Windows 2024.6.473.0

Version: Windows 2024.6.473.0 Date: 2024-07-30 Size: 120 MB

Download

Release notes

This release only contains a hotfix from the 2024.6.415.0 release.

Notable updates

• Fixed an issue which could cause alternate network detections to fail for hosts using TLS 1.2 which do not support TLS Extended Master Secret (EMS).
• Improved the stability of device profile switching based on alternate network detection.

Known issues

• If a user has an MDM file configured to support multiple profiles (for the switch configurations feature), and then changes to an MDM file configured for a single profile, the WARP client may not connect. The workaround is to use the warp-cli registration delete command to clear the registration, and then re-register the client.
• There are certain known limitations preventing the use of the MASQUE tunnel protocol in certain scenarios. Do not use the MASQUE tunnel protocol if:
  • A Magic WAN integration is on the account and is not yet migrated to the warp_unified_flow. Please check migration status with your account team.
  • Your account has Regional Services enabled.

macOS

Download latest stable release

OS version	Big Sur 11.0+, Monterey 12.0+, Ventura 13.0+, Sonoma 14.0+, Sequoia 15.1+ (15.0.x is not supported)
Processor	Intel or M series
HD space	75 MB
Memory	35 MB
Network interface type	WIFI or LAN
Minimum MTU	1360 bytes1

Footnotes

1. WireGuard requires 1360 bytes for IPv6 and 1340 bytes for IPv4. MASQUE requires 1350 bytes for IPv6 and 1330 bytes for IPv4. ↩

Latest release

Version: macOS 2025.5.893.0 Date: 2025-06-30 Size: 95.5 MB

Download

Release notes

This release contains improvements and new exciting features, including post-quantum cryptography. By tunneling your corporate network traffic over Cloudflare, you can now gain the immediate protection of post-quantum cryptography without needing to upgrade any of your individual corporate applications or systems.

Changes and improvements

• Fixed an issue where WARP sometimes failed to automatically relaunch after updating.
• Fixed a device registration issue causing WARP connection failures when changing networks.
• Captive portal improvements and fixes:
  • Captive portal sign in notifications will now be sent through operating system notification services.
  • Fix for firewall configuration issue affecting clients in DoH only mode.
• Improved the connectivity status message in the client GUI.
• The WARP client now applies post-quantum cryptography end-to-end on enabled devices accessing resources behind a Cloudflare Tunnel. This feature can be enabled by MDM.
• Improvement to handle client configuration changes made by an MDM while WARP is not running.
• Fixed an issue affecting Split Tunnel Include mode, where traffic outside the tunnel was blocked when switching between Wi-Fi and Ethernet networks.
• Improvement for WARP connectivity issues on macOS due to the operating system not accepting DNS server configurations.
• Added a WARP client device posture check for SAN attributes to the client certificate check.

Known issues

• macOS Sequoia: Due to changes Apple introduced in macOS 15.0.x, the WARP client may not behave as expected. Cloudflare recommends the use of macOS 15.4 or later.

Previous version history (11)

macOS 2025.4.943.0

Version: macOS 2025.4.943.0 Date: 2025-05-22 Size: 96.4 MB

Download

Release notes

This release contains a hotfix for managed networks for the 2025.4.929.0 release.

Changes and improvements

• Fixed an issue where it could take up to 3 minutes for the correct device profile to be applied in some circumstances. In the worst case, it should now only take up to 40 seconds. This will be improved further in a future release.

Known issues

• macOS Sequoia: Due to changes Apple introduced in macOS 15.0.x, the WARP client may not behave as expected. Cloudflare recommends the use of macOS 15.4 or later.

macOS 2025.4.929.0

Version: macOS 2025.4.929.0 Date: 2025-05-12 Size: 96.4 MB

Download

Release notes

This release contains two significant changes all customers should be aware of:

1. All DNS traffic now flows inside the WARP tunnel. Customers are no longer required to configure their local firewall rules to allow our DoH IP addresses and domains.
2. When using MASQUE, the connection will fall back to HTTP/2 (TCP) when we detect that HTTP/3 traffic is blocked. This allows for a much more reliable connection on some public WiFi networks.

Changes and improvements

• Fixed an issue where the managed network policies could incorrectly report network location beacons as missing.
• Improved DEX test error reporting.
• Fixed an issue causing client notifications to fail in IPv6 only environments which prevented the client from receiving configuration changes to settings like device profile.
• Improved captive portal detection.
• Added a TCP fallback for the MASQUE tunnel protocol to improve connectivity on networks that block UDP or HTTP/3 specifically.
• Added new IP addresses for tunnel connectivity checks. If your organization uses a firewall or other policies you will need to exempt these IPs.
• DNS over HTTPS traffic is now included in the WARP tunnel by default.
• Improved the error message displayed in the client GUI when the rate limit for entering an incorrect admin override code is met.
• Improved handling of non-SLAAC IPv6 interface addresses for better connectivity in IPv6 only environments.
• Fixed an issue where frequent network changes could cause WARP to become unresponsive.
• Improvement for WARP to check if tunnel connectivity fails or times out at device wake before attempting to reconnect.
• Fixed an issue causing WARP connection disruptions after network changes.

Known issues

• macOS Sequoia: Due to changes Apple introduced in macOS 15.0.x, the WARP client may not behave as expected. Cloudflare recommends the use of macOS 15.4 or later.

macOS 2025.2.664.0

Version: macOS 2025.2.664.0 Date: 2025-04-08 Size: 91.8 MB

Download

Release notes

This release contains a hotfix for captive portal detection and PF state tables for the 2025.2.600.0 release.

Changes and improvements

• Fix to reduce the number of browser tabs opened during captive portal logins.
• Improvement to exclude local DNS traffic entries from PF state table to reduce risk of connectivity issues from exceeding table capacity.

Known issues

• macOS Sequoia: Due to changes Apple introduced in macOS 15.0.x, the WARP client may not behave as expected. Cloudflare recommends the use of macOS 15.4 or later.

macOS 2025.2.600.0

Version: macOS 2025.2.600.0 Date: 2025-03-31 Size: 91.8 MB

Download

Release notes

This release contains support for a new WARP setting, Global WARP override. It also includes significant improvements to our captive portal / public Wi-Fi detection logic. If you have experienced captive portal issues in the past, re-test and give this version a try.

Changes and improvements

• Improved captive portal detection to make more public networks compatible and have faster detection.
• Improved error messages shown in the app.
• WARP tunnel protocol details can now be viewed using the warp-cli tunnel stats command.
• Fixed an issue with device revocation and re-registration when switching configurations.
• Added a new Global WARP override setting. This setting puts account administrators in control of disabling and enabling WARP across all devices registered to an account from the dashboard. Global WARP override is disabled by default.

Known issues

• macOS Sequoia: Due to changes Apple introduced in macOS 15.0.x, the WARP client may not behave as expected. Cloudflare recommends the use of macOS 15.3 or later.

macOS 2025.1.861.0

Version: macOS 2025.1.861.0 Date: 2025-02-19 Size: 92.4 MB

Download

Release notes

This release contains minor fixes and improvements.

Note: If using macOS Sequoia, Cloudflare recommends the use of macOS 15.3 or later. With macOS 15.3, Apple addressed several issues that may have caused the WARP client to not behave as expected when used with macOS 15.0.x.

Changes and improvements

• Improved command line interface for Access for Infrastructure with added function for filtering and ordering.
• Fixed client connectivity issues when switching between managed network profiles that use different WARP protocols.
• Improved OS version posture checks on macOS for greater reliability and availability.
• Added support for WARP desktop to use additional DoH endpoints to help reduce NAT congestion.
• Improved Wireguard connection stability on reconnections.
• Added additional HTTP/3 QUIC connectivity test to warp-diag.
• Added support for collection of system health metrics for enhanced device Digital Experience Monitoring.
• Automated the removal of active registrations for devices with multiple registrations with the same Zero Trust organization.
• Fixes issues with deleted registration at start up.

Known issues

• macOS Sequoia: Due to changes Apple introduced in macOS 15.0.x, the WARP client may not behave as expected. Cloudflare recommends the use of macOS 15.3 or later.

macOS 2024.12.554.0

Version: macOS 2024.12.554.0 Date: 2024-12-19 Size: 86.1 MB

Download

Release notes

This release contains improvements to support custom Gateway certificate installation in addition to the changes and improvements included in version 2024.12.492.0.

Note: If using macOS Sequoia, Cloudflare recommends the use of macOS 15.2 or later. With macOS 15.2, Apple addressed several issues that may have caused the WARP client to not behave as expected when used with macOS 15.0 and 15.1.

Changes and improvements:

• Adds support for installing all available custom Gateway certificates from an account to the system store.
• Users can now get a list of installed certificates by running warp-cli certs.

Known issues:

• macOS Sequoia: Due to changes Apple introduced in macOS 15.0.x, the WARP client may not behave as expected. Cloudflare recommends the use of macOS 15.2 or later.

macOS 2024.12.492.0

Version: macOS 2024.12.492.0 Date: 2024-12-19 Size: 84.7 MB

Download

Release notes

This release contains minor fixes and improvements.

Note: If using macOS Sequoia, Cloudflare recommends the use of macOS 15.2 or later. With macOS 15.2, Apple addressed several issues that may have caused the WARP client to not behave as expected when used with macOS 15.0 and 15.1.

Changes and improvements:

• Consumers can now set the tunnel protocol using warp-cli tunnel protocol set <protocol>.
• Extended diagnostics collection time in warp-diag to ensure logs are captured reliably.
• Improved captive portal support by disabling the firewall during captive portal login flows.
• Improved reliability of connection establishment logic under degraded network conditions.
• Improved reconnection speed when a Cloudflare server is in a degraded state.
• Improved captive portal detection on certain public networks.
• Fixed an issue where admin override displayed an incorrect override end time.
• Reduced connectivity interruptions on WireGuard Split Tunnel Include mode configurations.
• Fixed connectivity issues switching between managed network profiles with different configured protocols.
• QLogs are now disabled by default and can be enabled with warp-cli debug qlog enable. The QLog setting from previous releases will no longer be respected.

Known issues:

• macOS Sequoia: Due to changes Apple introduced in macOS 15.0, the WARP client may not behave as expected. Cloudflare recommends the use of macOS 15.2 or later.

macOS 2024.11.309.0

Version: macOS 2024.11.309.0 Date: 2024-11-18 Size: 81 MB

Download

Release notes

This release contains reliability improvements and general bug fixes.

Changes and improvements:

• Fixed an issue where SSH sessions and other application connections over TCP or UDP could drop when a device that is using MASQUE changes its primary network interface.
• Fixed an issue to ensure the Cloudflare root certificate (or custom certificate) is installed in the trust store if not already there.
• Fixed an issue with the WARP client becoming unresponsive during startup.
• Extended warp-diag to collect system profiler firewall state as part of diagnostics.
• Fixed an issue with the WARP client becoming unresponsive while handling LAN inclusion.
• Fixed an issue where users were unable to connect with an IPC error message displayed in the UI.
• Fixed an issue that was preventing proper operation of DNS-over-TLS (DoT) for consumer users.

Known issues:

• macOS Sequoia: Due to changes Apple introduced in macOS 15.0.x, the WARP client may not behave as expected. Cloudflare recommends the use of macOS 15.1 or later.

macOS 2024.9.346.0

Version: macOS 2024.9.346.0 Date: 2024-10-03 Size: 80 MB

Download

Release notes

This release contains minor fixes and improvements.

All customers running macOS Ventura 13.0 and above (including macOS Sequoia) are advised to upgrade to this release. This release fixes an incompatibility with the firewall that may sometimes result in the firewall becoming disabled.

Changes and improvements:

• Added target list to the warp-cli to enhance the user experience with the Access for Infrastructure SSH solution.
• Added a tunnel reset mtu subcommand to the warp-cli.
• Added the ability for warp-cli to use the team name provided in the MDM file for initial registration.
• Added a JSON output option to the warp-cli.
• Added the ability to execute a PCAP on multiple interfaces with warp-cli and warp-dex.
• Improved warp-dex default interface selection for PCAPs and changed warp-dex CLI output to JSON.
• Improved application posture check compatibility with symbolically linked files.
• Fixed an issue where the client, when switching between WireGuard and MASQUE protocols, sometimes required a manual tunnel key reset.
• Added MASQUE tunnel protocol support for the consumer version of WARP (1.1.1.1 w/ WARP).

Known issues:

• Using MASQUE as the tunnel protocol may be incompatible if your organization has Regional Services enabled.

macOS 2024.8.457.0

Version: macOS 2024.8.457.0 Date: 2024-09-26 Size: 77.8 MB

Download

Release notes

This release contains minor fixes and improvements.

Notable updates:

• Added the ability to customize PCAP options in warp-cli.
• Added a list of installed applications in warp-diag.
• Added a summary of warp-dex traceroute results in its JSON output.
• Improved the performance of firewall operations when enforcing Split Tunnels configuration.
• Fixed an issue where the DNS logs were not being cleared when the user switched configurations.
• Fixed an issue where clients using service tokens failed to retry after a network change.
• Fixed a known issue which required users to re-register when an older single configuration MDM file was deployed after deploying the newer, multiple configuration format.
• Fixed an issue which prevented the use of private IP ranges that overlapped with end users' home networks.
• Deprecated warp-cli commands have been removed. If you have any workflows that use the deprecated commands, update to the new commands where necessary.

Known issues:

• Cloudflare is investigating temporary networking issues on macOS 15 (Sequoia) that seem to affect some users.
• Using MASQUE as the tunnel protocol may be incompatible if your organization has Regional Services enabled.

macOS 2024.6.474.0

Version: macOS 2024.6.474.0 Date: 2024-07-30 Size: 76.9 MB

Download

Release notes

This release only contains a hotfix from the 2024.6.416.0 release.

Notable updates

• Fixed an issue which could cause alternate network detections to fail for hosts using TLS 1.2 which do not support TLS Extended Master Secret (EMS).
• Improved the stability of device profile switching based on alternate network detection.

Known issues

• If a user has an MDM file configured to support multiple profiles (for the switch configurations feature), and then changes to an MDM file configured for a single profile, the WARP client may not connect. The workaround is to use the warp-cli registration delete command to clear the registration, and then re-register the client.
• There are certain known limitations preventing the use of the MASQUE tunnel protocol in certain scenarios. Do not use the MASQUE tunnel protocol if:
  • A Magic WAN integration is on the account and is not yet migrated to the warp_unified_flow. Please check migration status with your account team.
  • Your account has Regional Services enabled.

Linux

Package repository

OS version	CentOS 8, RHEL 8, Debian 10, Debian 11, Debian 12, Fedora 34, Fedora 35, Ubuntu 20.04, Ubuntu 22.04, Ubuntu 24.04
Processor	AMD64 / x86-64 or ARM64 / AArch64
HD space	75 MB
Memory	35 MB
Network interface type	WIFI or LAN
Minimum MTU	1360 bytes1

Footnotes

1. WireGuard requires 1360 bytes for IPv6 and 1340 bytes for IPv4. MASQUE requires 1350 bytes for IPv6 and 1330 bytes for IPv4. ↩

Latest release

Version: Linux 2025.5.893.0 Date: 2025-06-30 Size: 44.8 MB

CentOS / RHEL 8 (arm64) CentOS / RHEL 8 (x86-64) Debian 10 (arm64) Debian 10 (x86-64) Debian 11 (arm64) Debian 11 (x86-64) Debian 12 (arm64) Debian 12 (x86-64) Fedora 34 (arm64) Fedora 34 (x86-64) Fedora 35 (arm64) Fedora 35 (x86-64) Ubuntu 20.04 (arm64) Ubuntu 20.04 (x86-64) Ubuntu 22.04 (arm64) Ubuntu 22.04 (x86-64) Ubuntu 24.04 (arm64) Ubuntu 24.04 (x86-64) Download

Release notes

This release contains improvements and new exciting features, including post-quantum cryptography. By tunneling your corporate network traffic over Cloudflare, you can now gain the immediate protection of post-quantum cryptography without needing to upgrade any of your individual corporate applications or systems.

Changes and improvements

• Fixed a device registration issue causing WARP connection failures when changing networks.
• Captive portal improvements and fixes:
  • Captive portal sign in notifications will now be sent through operating system notification services.
  • Fix for firewall configuration issue affecting clients in DoH only mode.
• Improved the connectivity status message in the client GUI.
• The WARP client now applies post-quantum cryptography end-to-end on enabled devices accessing resources behind a Cloudflare Tunnel. This feature can be enabled by MDM.
• Improvement to handle client configuration changes made by MDM while WARP is not running.
• Fixed an issue affecting Split Tunnel Include mode, where traffic outside the tunnel was blocked when switching between Wi-Fi and Ethernet networks.
• Added a WARP client device posture check for SAN attributes to the client certificate check.

Previous version history (8)

Linux 2025.4.943.0

Version: Linux 2025.4.943.0 Date: 2025-05-22 Size: 45.5 MB

CentOS / RHEL 8 (arm64) CentOS / RHEL 8 (x86-64) Debian 10 (arm64) Debian 10 (x86-64) Debian 11 (arm64) Debian 11 (x86-64) Debian 12 (arm64) Debian 12 (x86-64) Fedora 34 (arm64) Fedora 34 (x86-64) Fedora 35 (arm64) Fedora 35 (x86-64) Ubuntu 20.04 (arm64) Ubuntu 20.04 (x86-64) Ubuntu 22.04 (arm64) Ubuntu 22.04 (x86-64) Ubuntu 24.04 (arm64) Ubuntu 24.04 (x86-64) Download

Release notes

This release contains a hotfix for managed networks for the 2025.4.929.0 release.

Changes and improvements

• Fixed an issue where it could take up to 3 minutes for the correct device profile to be applied in some circumstances. In the worst case, it should now only take up to 40 seconds. This will be improved further in a future release.

Linux 2025.4.929.0

Version: Linux 2025.4.929.0 Date: 2025-05-12 Size: 45.5 MB

CentOS / RHEL 8 (arm64) CentOS / RHEL 8 (x86-64) Debian 10 (arm64) Debian 10 (x86-64) Debian 11 (arm64) Debian 11 (x86-64) Debian 12 (arm64) Debian 12 (x86-64) Fedora 34 (arm64) Fedora 34 (x86-64) Fedora 35 (arm64) Fedora 35 (x86-64) Ubuntu 20.04 (arm64) Ubuntu 20.04 (x86-64) Ubuntu 22.04 (arm64) Ubuntu 22.04 (x86-64) Ubuntu 24.04 (arm64) Ubuntu 24.04 (x86-64) Download

Release notes

This release contains two significant changes all customers should be aware of:

1. All DNS traffic now flows inside the WARP tunnel. Customers are no longer required to configure their local firewall rules to allow our DoH IP addresses and domains.
2. When using MASQUE, the connection will fall back to HTTP/2 (TCP) when we detect that HTTP/3 traffic is blocked. This allows for a much more reliable connection on some public WiFi networks.

Changes and improvements

• Fixed an issue where the managed network policies could incorrectly report network location beacons as missing.
• Improved DEX test error reporting.
• Fixed an issue causing client notifications to fail in IPv6 only environments which prevented the client from receiving configuration changes to settings like device profile.
• Added a TCP fallback for the MASQUE tunnel protocol to improve connectivity on networks that block UDP or HTTP/3 specifically.
• Added new IP addresses for tunnel connectivity checks. If your organization uses a firewall or other policies you will need to exempt these IPs.
• Fixed an issue where frequent network changes could cause WARP to become unresponsive.
• DNS over HTTPS traffic is now included in the WARP tunnel by default.
• Improvement for WARP to check if tunnel connectivity fails or times out at device wake before attempting to reconnect.
• Fixed an issue causing WARP connection disruptions after network changes.

Linux 2025.2.600.0

Version: Linux 2025.2.600.0 Date: 2025-03-31 Size: 44.5 MB

CentOS / RHEL 8 (arm64) CentOS / RHEL 8 (x86-64) Debian 10 (arm64) Debian 10 (x86-64) Debian 11 (arm64) Debian 11 (x86-64) Debian 12 (arm64) Debian 12 (x86-64) Fedora 34 (arm64) Fedora 34 (x86-64) Fedora 35 (arm64) Fedora 35 (x86-64) Ubuntu 20.04 (arm64) Ubuntu 20.04 (x86-64) Ubuntu 22.04 (arm64) Ubuntu 22.04 (x86-64) Ubuntu 24.04 (arm64) Ubuntu 24.04 (x86-64) Download

Release notes

This release contains support for a new WARP setting, Global WARP override. It also includes significant improvements to our captive portal / public Wi-Fi detection logic. If you have experienced captive portal issues in the past, re-test and give this version a try.

Changes and improvements

• Improved captive portal detection to make more public networks compatible and have faster detection.
• WARP tunnel protocol details can now be viewed using the warp-cli tunnel stats command.
• Fixed an issue with device revocation and re-registration when switching configurations.
• Added a new Global WARP override setting. This setting puts account administrators in control of disabling and enabling WARP across all devices registered to an account from the dashboard. Global WARP override is disabled by default.

Linux 2025.1.861.0

Version: Linux 2025.1.861.0 Date: 2025-02-19

CentOS / RHEL 8 (arm64) CentOS / RHEL 8 (x86-64) Debian 10 (arm64) Debian 10 (x86-64) Debian 11 (arm64) Debian 11 (x86-64) Debian 12 (arm64) Debian 12 (x86-64) Fedora 34 (arm64) Fedora 34 (x86-64) Fedora 35 (arm64) Fedora 35 (x86-64) Ubuntu 20.04 (arm64) Ubuntu 20.04 (x86-64) Ubuntu 22.04 (arm64) Ubuntu 22.04 (x86-64) Ubuntu 24.04 (arm64) Ubuntu 24.04 (x86-64) Download

Release notes

This release includes fixes and minor improvements.

Changes and improvements

• Improved command line interface for Access for Infrastructure with added function for filtering and ordering.
• Fixed client connectivity issues when switching between managed network profiles that use different WARP protocols.
• Added support for WARP desktop to use additional DoH endpoints to help reduce NAT congestion.
• Improved Wireguard connection stability on reconnections.
• Added additional HTTP/3 QUIC connectivity test to warp-diag.
• Added support for collection of system health metrics for enhanced device Digital Experience Monitoring.
• Automated the removal of active registrations for devices with multiple registrations with the same Zero Trust organization.

Linux 2024.12.554.0

Version: Linux 2024.12.554.0 Date: 2024-12-19

Ubuntu 24.04 (x86-64) Download

Release notes

This release includes fixes and minor improvements.

Changes and improvements

• Consumers can now set the tunnel protocol using warp-cli tunnel protocol set <protocol>.
• Extended diagnostics collection time in warp-diag to ensure logs are captured reliably.
• Improved captive portal support by disabling the firewall during captive portal login flows.
• Improved reliability of connection establishment logic under degraded network conditions.
• Improved reconnection speed when a Cloudflare server is in a degraded state.
• Improved captive portal detection on certain public networks.
• Reduced connectivity interruptions on WireGuard Split Tunnel Include mode configurations.
• Fixed connectivity issues switching between managed network profiles with different configured protocols.
• QLogs are now disabled by default and can be enabled with warp-cli debug qlog enable. The QLog setting from previous releases will no longer be respected.

Linux 2024.11.309.0

Version: Linux 2024.11.309.0 Date: 2024-11-18

Ubuntu 24.04 (x86-64) Download

Release notes

This release contains reliability improvements and general bug fixes.

Changes and improvements

• Fixed an issue where SSH sessions and other connections ould drop when a device that is using MASQUE changes its primary network interface.
• Device posture client certificate checks now support PKCS#1.
• Fixed an issue to ensure the Cloudflare root certificate (or custom certificate) is installed in the trust store if not already there.
• Reduced unnecessary log messages when resolv.conf has no owner.
• Fixed an issue with warp-diag printing benign TLS certificate errors.
• Fixed an issue with the WARP client becoming unresponsive during startup.
• Extended diagnostics collection time in warp-diag to ensure logs are captured reliably.
• Fixed an issue that was preventing proper operation of DNS-over-TLS (DoT) for consumer users.

Linux 2024.9.346.0

Version: Linux 2024.9.346.0 Date: 2024-10-03

Ubuntu 24.04 (x86-64) Download

Release notes

This release contains minor fixes and minor improvements.

Notable updates

• Added target list to the warp-cli to enhance the user experience with the Access for Infrastructure SSH solution.
• Added the ability to customize PCAP options in the warp-cli.
• Added a list of installed applications in warp-diag.
• Added a tunnel reset mtu subcommand to the warp-cli.
• Added the ability for warp-cli to use the team name provided in the MDM file for initial registration.
• Added a JSON output option to the warp-cli.
• Added the ability to execute a PCAP on multiple interfaces with warp-cli.
• Added MASQUE tunnel protocol support for the consumer version of WARP (1.1.1.1 w/ WARP).
• Improved the performance of firewall operations when enforcing split tunnel configuration.
• Fixed an issue where device posture certificate checks were unexpectedly failing.
• Fixed an issue where the Linux GUI fails to open the browser login window when registering a new Zero Trust organization.
• Fixed an issue where clients using service tokens failed to retry after a network change.
• Fixed an issue where the client, when switching between WireGuard and MASQUE protocols, sometimes required a manual tunnel key reset.
• Fixed a known issue which required users to re-register when an older single configuration MDM file was deployed after deploying the newer, multiple configuration format.
• Deprecated warp-cli commands have been removed. If you have any workflows that use the deprecated commands, update to the new commands where necessary.

Known issues:

• Using MASQUE as the tunnel protocol may be incompatible if your organization has Regional Services is enabled.

Linux 2024.6.497.0

Version: Linux 2024.6.497.0 Date: 2024-08-15

Ubuntu 24.04 (x86-64) Download

Release notes

This release includes some exciting new features. It also includes additional fixes and minor improvements.

New features

• The WARP client now supports operation on Ubuntu 24.04.
• Admins can now elect to have ZT WARP clients connect using the MASQUE protocol; this setting is in Device Profiles. Note: before MASQUE can be used, the global setting for Override local interface IP must be enabled. For more detail, refer to Device tunnel protocol. This feature will be rolled out to customers in stages over approximately the next month.
• The Device Posture client certificate check has been substantially enhanced. The primary enhancement is the ability to check for client certificates that have unique common names, made unique by the inclusion of the device serial number or host name (for example, CN = 123456.mycompany, where 123456 is the device serial number).
• TCP MSS clamping is now used where necessary to meet the MTU requirements of the tunnel interface. This will be especially helpful in Docker use cases.

Warning

• Ubuntu 16.04 and 18.04 are not supported by this version of the client.
• This is the last GA release that will be supporting older, deprecated warp-cli commands. There are two methods to identify these commands. One, when used in this release, the command will work but will also return a deprecation warning. And two, the deprecated commands do not appear in the output of warp-cli -h.

Known issues

• There are certain known limitations preventing the use of the MASQUE tunnel protocol in certain scenarios. Do not use the MASQUE tunnel protocol if:
  • A Magic WAN integration is on the account and does not have the latest packet flow path for WARP traffic. To check the migration status, contact your account team.
  • Your account has Regional Services enabled.
• The Linux client GUI does not yet support all GUI features found in the Windows and macOS clients. Future releases of the Linux client will be adding these GUI features.
• The Zero Trust team name is not visible in the GUI if you upgraded from the previous GA release using an MDM tool.
• Sometimes the WARP icon will remain gray (disconnected state) while in dark mode.

iOS

OS version	iOS 11+

Download from the iOS App Store ↗ or search for "Cloudflare One Agent".

Migrate from 1.1.1.1

The legacy iOS client, 1.1.1.1: Faster Internet ↗, has been replaced by the Cloudflare One Agent. Learn more in our migration guide.

Android

OS version	5.0+

Download from the Google Play store ↗ or search for "Cloudflare One Agent".

Migrate from 1.1.1.1

The legacy Android client, 1.1.1.1 + WARP: Safer Internet ↗, has been replaced by the Cloudflare One Agent. Learn more in our migration guide.

ChromeOS

OS version	Chromebooks manufactured after 2019

Chromebooks are supported by our Android app. All Chromebooks made after 2019 should fully support our Android app. If you have a Chromebook made before 2019, refer to this list ↗ to verify that your device is supported.