Beta releases
Cloudflare tests new WARP features and improvements in an unstable beta release before adding them to the stable release. To get early access to new features, download the latest beta client from the links below.
| OS version | Windows 10, Windows 11 |
| Processor | AMD64 / x86-64 |
| .NET Framework version | 4.7.2 or later |
| HD space | 184 MB |
| Memory | 3 MB |
| Network interface type | WIFI or LAN |
| Minimum MTU | 1360 bytes1 |
-
WireGuard requires 1360 bytes for IPv6 and 1340 bytes for IPv4. MASQUE requires 1350 bytes for IPv6 and 1330 bytes for IPv4. ↩
Latest release
Release notes
This release contains minor fixes and improvements.
Changes and improvements:
- Fixed connectivity issues switching between managed network profiles with different configured protocols.
- Added support for multiple users on shared Windows 10 and Windows 11 devices. Once a user completes the Windows login, all traffic to Cloudflare will be attributed to the currently active Windows user account. Contact your Customer Success Manager to request participation in this beta.
Known issues:
DNS resolution may be broken when the following conditions are all true:
- WARP is in Secure Web Gateway without DNS filtering (tunnel-only) mode.
- A custom DNS server address is configured on the primary network adapter.
- The custom DNS server address on the primary network adapter is changed while WARP is connected.
To work around this issue, reconnect the WARP client by toggling off and back on.
Previous version history (6)
Windows 2024.11.688.1
Release notes
This release contains minor fixes and improvements.
Changes and improvements:
- Consumers can now set the tunnel protocol using "warp-cli tunnel protocol set
". - Extended diagnostics collection time in warp-diag to ensure logs are captured reliably.
- Improved captive portal support by disabling the firewall during captive portal login flows.
- Improved captive portal detection on certain public networks.
- Improved reconnection speed when a Cloudflare server is in a degraded state.
- Fixed an issue where WARP may fail to remove certificates from the user store in device information only mode.
- Ensured at most one powershell instance is opened when fetching the device serial number for posture checks.
- Fixed an issue to prevent the daemon from following Windows junctions created by non-admin users that could be used to delete files as SYSTEM user and potentially gain SYSTEM user privileges.
- Improved reliability of connection establishment logic under degraded network conditions.
- Fixed an issue that caused high memory usage when viewing connection statistics for extended periods of time.
- Improved WARP connectivity in environments with virtual interfaces from VirtualBox, VMware, and similar tools.
- Reduced connectivity interruptions on WireGuard include split tunnel configurations.
Known issues:
DNS resolution may be broken when the following conditions are all true:
- WARP is in Secure Web Gateway without DNS filtering (tunnel-only) mode.
- A custom DNS server address is configured on the primary network adapter.
- The custom DNS server address on the primary network adapter is changed while WARP is connected.
To work around this issue, please reconnect the WARP client by toggling off and back on.
Windows 2024.10.537.1
Release notes
This release contains an exciting new feature along with reliability improvements and general bug fixes. Please take time over the next few weeks to play with the new functionality and let us know what you think on both the community forum and through your account teams.
New features:
- Added the ability for administrators to initiate remote packet capture (PCAP) and warp-diag collection
Changes and improvements:
- Improved reliability of connection establishment logic under degraded network conditions
- Improved captive portal detection behavior by forcing captive portal checks outside the tunnel
- Allow the ability to configure tunnel protocol for consumer registrations
- Fixed an issue with the WARP client becoming unresponsive during startup
- Extended diagnostics collection time in warp-diag to ensure logs are captured reliably
Known issues:
DNS resolution may be broken when the following condition are all true:
- WARP is in Secure Web Gateway without DNS filtering (tunnel-only) mode.
- A custom DNS server address is configured on the primary network adapter.
- The custom DNS server address on the primary network adapter is changed while WARP is connected.
To work around this issue, please reconnect the WARP client by toggling off and back on.
Windows 2024.10.279.1
Release notes
This release contains minor fixes and improvements.
Changes and improvements:
- Fixed an issue where SSH sessions and other application connections over TCP or UDP could be dropped when using MASQUE and the device's primary network interface changed.
- Fixed an issue to ensure the managed certificate is installed in the trust store if not already there.
Known issues:
DNS resolution may be broken when the following condition are all true:
- WARP is in Secure Web Gateway without DNS filtering (tunnel-only) mode.
- A custom DNS server address is configured on the primary network adapter.
- The custom DNS server address on the primary network adapter is changed while WARP is connected.
To work around this issue, please reconnect the WARP client by toggling off and back on.
Windows 2024.8.308.1
Release notes
This is a release focused on fixes and improvements.
Changes and improvements:
- Added the ability to customize PCAP options in the warp-cli.
- Added a list of installed applications in warp-diag.
- Added a summary of warp-dex traceroute results in its JSON output.
- Improved the performance of firewall operations when enforcing split tunnel configuration.
- Reduced time it takes for a WARP client update to complete.
- Fixed issues where incorrect DNS server addresses were being applied following reboots and network changes. Any incorrect static entries set by previous WARP versions must be manually reverted.
- Fixed a Known Issue which required users to re-register when an older single configuration MDM file was deployed after deploying the newer, multiple configuration format.
- Deprecated warp-cli commands have been removed. If you have any workflows that use the deprecated commands, please update to the new commands where necessary.
Known issues:
Using MASQUE as the tunnel protocol may be incompatible if your organization has either of the following conditions:
- Magic WAN is enabled but not the latest packet flow path for WARP. Please check migration status with your account team.
- Regional Services enabled.
DNS resolution may be broken when the following condition are all true:
- WARP is in Secure Web Gateway without DNS filtering (tunnel-only) mode.
- A custom DNS server address is configured on the primary network adapter.
- The custom DNS server address on the primary network adapter is changed while WARP is connected. To work around this issue, please reconnect the WARP client by toggling off and back on.
Windows 2024.5.310.1
Release notes
This is a release focused on fixes and improvements.
Notable updates
- Added a new Unable to Connect message to the UI to help in troubleshooting.
- In the upgrade window, a change was made to use international date formats to resolve an issue with localization.
- Made a change to ensure DEX tests are not running when the tunnel is not up due to the device going to or waking from sleep. This is specific to devices using the S3 power model.
- Fixed a known issue where the certificate was not always properly left behind in
%ProgramData%\Cloudflare\installed_cert.pem. - Fixed an issue where ICMPv6 Neighbor Solicitation messages were being incorrectly sent on the WARP tunnel.
Known issues
- If a user has an MDM file configured to support multiple profiles (for the switch configurations feature), and then changes to an MDM file configured for a single profile, the WARP client may not connect. The workaround is to use the 'warp-cli registration delete' command to clear the registration, and then re-register the client.
Windows 2024.3.237.1
Release notes
This release contains no new features and is focused exclusively on improvements.
Notable updates
- Windows client downloads will now contain version numbers in the file name to allow easy identification.
- Enabled re-authentication and other notifications to always be shown (without sound) regardless of Windows Focus Assist settings.
- Suppressed the GUI certificate error message "Limited connectivity: A certificate missing; please contact your administrator" for a scenario where it was not needed.
- Improved the re-connection logic to minimize impact to existing tunneled TCP sessions.
- Corrected an issue where the DNS server information was being improperly persisted across network changes.
- Increased the data collected by warp-diag to improve debugging capabilities.
Known issues
- When
Install CA to system certificate storeis enabled, the certificate is not always properly left behind in%ProgramData%\Cloudflare\installed_cert.pem. This issue will be fixed in a future release.
| OS version | Big Sur 11.0+, Monterey 12.0+, Ventura 13.0+, Sonoma 14.0+, Sequoia 15.1+ (15.0.x is not supported) |
| Processor | Intel or M series |
| HD space | 75 MB |
| Memory | 35 MB |
| Network interface type | WIFI or LAN |
| Minimum MTU | 1360 bytes1 |
-
WireGuard requires 1360 bytes for IPv6 and 1340 bytes for IPv4. MASQUE requires 1350 bytes for IPv6 and 1330 bytes for IPv4. ↩
Latest release
Release notes
This release contains minor fixes and improvements.
Note: If using macOS Sequoia, Cloudflare recommends the use of macOS 15.1 or later. With macOS 15.1, Apple addressed several issues that may have caused the WARP client to not behave as expected when used with macOS 15.0.x.
Changes and improvements:
- Consumers can now set the tunnel protocol using
warp-cli tunnel protocol set <protocol>. - Extended diagnostics collection time in
warp-diagto ensure logs are captured reliably. - Improved captive portal support by disabling the firewall during captive portal login flows.
- Improved reliability of connection establishment logic under degraded network conditions.
- Improved reconnection speed when a Cloudflare server is in a degraded state.
- Improved captive portal detection on certain public networks.
- Fixed an issue where admin override displayed an incorrect override end time.
- Reduced connectivity interruptions on WireGuard Split Tunnel Include mode configurations.
Known issues:
- macOS Sequoia: Due to changes Apple introduced in macOS 15.0.x, the WARP client may not behave as expected. Cloudflare recommends the use of macOS 15.1 or later.
Previous version history (5)
macOS 2024.10.537.1
Release notes
This release contains an exciting new feature along with reliability improvements and general bug fixes. Please take time over the next few weeks to play with the new functionality and let us know what you think on both the community forum and through your account teams.
New features:
- Added the ability for administrators to initiate remote packet capture (PCAP) and warp-diag collection
Changes and improvements:
- Improved handling of multiple network interfaces on the system
- Improved reliability of connection establishment logic under degraded network conditions
- Improved captive portal detection behavior by forcing captive portal checks outside the tunnel
- Allow the ability to configure tunnel protocol for consumer registrations
- Fixed an issue with the WARP client becoming unresponsive during startup
- Extended diagnostics collection time in warp-diag to ensure logs are captured reliably
- Extended warp-diag to collect system profiler firewall state as part of diagnostics
- Fixed an issue with the Cloudflare WARP GUI showing garbled text in some cases
- Fixed an issue with the WARP client becoming unresponsive while handling LAN inclusion
Known issues:
- The WARP client may not function correctly on macOS 15.0 (Sequoia). We recommend updating to macOS 15.1 to resolve these issues.
macOS 2024.10.279.1
Release notes
This release contains minor fixes and improvements.
Changes and improvements:
- Fixed an issue where SSH sessions and other application connections over TCP or UDP could be dropped when using MASQUE and the device’s primary network interface changed.
- Fixed an issue to ensure the managed certificate is installed in the trust store if not already there.
Known issues:
- Cloudflare is investigating temporary networking issues caused by macOS 15 (Sequoia) changes that seem to affect some users and may be seen with any version of the WARP client.
macOS 2024.8.309.1
Release notes
This is a release focused on fixes and improvements.
Changes and improvements:
- Added the ability to customize PCAP options in the warp-cli.
- Added a list of installed applications in warp-diag.
- Added a summary of warp-dex traceroute results in its JSON output.
- Improved the performance of firewall operations when enforcing split tunnel configuration.
- Fixed an issue where the DNS logs were not being cleared when the user switched configurations.
- Fixed a Known Issue which required users to re-register when an older single configuration MDM file was deployed after deploying the newer, multiple configuration format.
- Fixed an issue which prevented the use of private IP ranges that overlapped with end user's home networks.
- Deprecated warp-cli commands have been removed. If you have any workflows that use the deprecated commands, please update to the new commands where necessary.
Known issues:
- Using MASQUE as the tunnel protocol may be incompatible if your organization has either of the following conditions:
- Magic WAN is enabled but not the latest packet flow path for WARP. Please check the migration status with your account team.
- Regional Services enabled.
macOS 2024.5.287.1
Release notes
This is a release focused on fixes and improvements.
Notable updates:
- Fixed a known issue where the certificate was not always properly left behind in
/Library/Application Support/Cloudflare/installed_cert.pem. - Fixed an issue so that that the reauth notification is cleared from the UI when the user switches configurations.
- Fixed an issue by correcting the WARP client setting of macOS firewall rules. This relates to TunnelVision (CVE-2024-3661).
- Fixed an issue that could cause the Cloudflare WARP menu bar application to disappear when switching configurations.
Known issues:
- If a user has an MDM file configured to support multiple profiles (for the switch configurations feature), and then changes to an MDM file configured for a single profile, the WARP client may not connect. The workaround is to use the 'warp-cli registration delete' command to clear the registration, and then re-register the client.
macOS 2024.3.236.1
Release notes
This release contains no new features and is focused exclusively on improvements.
Notable updates
- macOS client downloads will now contain version numbers in the file name to allow easy identification.
- Improved the re-connection logic to minimize impact to existing tunneled TCP sessions.
- Increased the data collected by warp-diag to improve debugging capabilities.
- Improved compatibility with multicast DNS (mDNS) systems.
Known issues
- No known issues.