Skip to content
Cloudflare Docs

WARP with firewall

If your organization uses a firewall or other policies to restrict or intercept Internet traffic, you may need to exempt the following IP addresses and domains to allow the WARP client to connect.

Client orchestration API

The WARP client connects to Cloudflare via a standard HTTPS connection outside the tunnel for operations like registration or settings changes. To perform these operations, you must allow zero-trust-client.cloudflareclient.com which will lookup the following IP addresses:

  • IPv4 API Endpoints: 162.159.137.105 and 162.159.138.105
  • IPv6 API Endpoints: 2606:4700:7::a29f:8969 and 2606:4700:7::a29f:8a69

DoH IP

All DNS requests through WARP are sent outside the tunnel via DoH (DNS over HTTPS). In your organization's firewall, you must allow the following host: <ACCOUNT_ID>.cloudflare-gateway.com. WARP will connect to the following IPs, which must be reachable for DNS to work correctly.

  • IPv4 DoH Addresses: 162.159.36.1 and 162.159.46.1
  • IPv6 DoH Addresses: 2606:4700:4700::1111 and 2606:4700:4700::1001

Android devices

If you are deploying the Cloudflare One Agent on Android/ChromeOS, you must also add cloudflare-dns.com to your firewall exception list. On Android/ChromeOS devices, WARP uses cloudflare-dns.com to resolve domains on your Split Tunnel list.

Client authentication endpoint

When you log in to your Zero Trust organization, you will have to complete the authentication steps required by your organization in the browser window that opens. To perform these operations, you must allow the following domains:

  • The IdP used to authenticate to Cloudflare Zero Trust
  • <your-team-name>.cloudflareaccess.com

WARP ingress IP

WARP connects to the following IP addresses, depending on which tunnel protocol is configured for your device (WireGuard or MASQUE). All network traffic from your device to Cloudflare goes through these IPs and ports over UDP.

WireGuard

IPv4 address162.159.193.0/24
IPv6 address2606:4700:100::/48
Default portUDP 2408
Fallback portsUDP 500
UDP 1701
UDP 4500

MASQUE

IPv4 address162.159.197.0/24
IPv6 address2606:4700:102::/48
Default portUDP 443
Fallback portsUDP 500
UDP 1701
UDP 4500
UDP 4443
UDP 8443
UDP 8095
TCP 443 1

Captive portal

The following domains are used as part of our captive portal check:

  • cloudflareportal.com
  • cloudflareok.com
  • cloudflarecp.com

Connectivity checks

As part of establishing the WARP connection, the client runs connectivity checks inside and outside of the WARP tunnel.

Outside tunnel

The client connects to the following destinations to verify general Internet connectivity outside of the WARP tunnel. Make sure that these IPs and domains are on your firewall allowlist.

  • engage.cloudflareclient.com: The client will always send requests directly to an IP in the WARP ingress IPv4 or IPv6 range (or to your override_warp_endpoint if set). Requests will not use a proxy server, even if one is configured for the system.
  • 162.159.197.3
  • 2606:4700:102::3

Inside tunnel

The client connects to the following destinations to verify connectivity inside of the WARP tunnel. Because this check happens inside of the tunnel, you do not need to add these IPs and domains to your firewall allowlist. However, since the requests go through Gateway, ensure that they are not blocked by a Gateway HTTP or Network policy.

  • connectivity.cloudflareclient.com
  • 162.159.197.4
  • 2606:4700:102::4

NEL reporting (optional)

The WARP client reports connectivity issues to our NEL endpoint via a.nel.cloudflare.com. This is not technically required to operate but will result in errors in our logs if not excluded properly.

Latency statistics (optional)

The WARP client generates ICMP traffic to the WARP ingress IPs when running tunnel latency tests. This is not technically required to operate but will result in errors in our logs if not excluded properly.

Time synchronization (optional)

The WARP client attempts to synchronize the exact time by NTP (UDP 123) to Cloudflare's Time Service via time.cloudflare.com. This is not technically required to operate but will result in errors in our logs if not excluded properly.

Scope of firewall rules

Required scopes

If your organization does not currently allow inbound/outbound communication over the IP addresses, ports, and domains described above, you must manually add an exception. The rule at a minimum needs to be scoped to the following process based on your platform:

  • Windows: C:\Program Files\Cloudflare\Cloudflare WARP\warp-svc.exe
  • macOS: /Applications/Cloudflare WARP.app/Contents/Resources/CloudflareWARP

Optional scopes

DEX tests

To run Digital Experience Monitoring tests, you will need to allow the warp-dex process to generate network traffic to your target destinations:

  • Windows: C:\Program Files\Cloudflare\Cloudflare WARP\warp-dex.exe
  • macOS: /Applications/Cloudflare WARP.app/Contents/Resources/warp-dex

WARP network statistics

To use the network connectivity tests built into the WARP GUI, you will need to allow the GUI application to generate network traffic:

  • Windows: C:\Program Files\Cloudflare\Cloudflare WARP\Cloudflare WARP.exe
  • macOS: /Applications/Cloudflare WARP.app

Footnotes

  1. Required for HTTP/2 fallback ↩