Preface

For many people in China, Cloudflare is mainly a boon for personal webmasters (like me): for novice webmasters with a certain technical foundation, if they don't have an ICP filing but want to publish their site to the public internet, using Cloudflare is just a matter of minutes (by default, access is slow, but most of the reason for the slowness is actually not Cloudflare, you know what I mean~). I will have a series of tutorials on Cloudflare website building and security optimization in the future, but these are not the points I want to talk about today. What I actually want to talk about today is Cloudflare's WARP.

Cloudflare's Global Layout

WARP is actually just the result of a technology. Before discussing it, we first need to mention the global private backbone network that Cloudflare has already established. According to current data on the official website: "Cloudflare has a massive global network, with data centers covering 310 cities across 120 countries." (Naturally, "excluding China and North Korea"). Precisely because it cannot officially enter China, Cloudflare collaborates with domestic cloud providers in China (such as Baidu Cloud and JD Cloud). However, this limited cooperation is far less effective compared to other countries where Cloudflare directly establishes data centers, interconnects directly with multiple Internet Exchange Points (IXPs) and ISPs, and even sets up physical dedicated lines for multiple regions. Additionally, Cloudflare's origin-pull starts directly from the data center assigned to the user at the time of access (domestic users are usually assigned to the San Jose data center in the western United States). Not only is the distance far and the latency high, but the line quality to China is also poor, making a subpar access experience from this origin-pull quite natural.

Precisely because of this global private backbone network (equivalent to a global "large intranet"), Cloudflare can optimize the path of traffic entering its "large intranet" using various proprietary algorithms, thereby reducing access latency and improving the user experience. The question then becomes: how do you enter Cloudflare's "large intranet"? To solve this problem, the concept of "Preferred IP" (优选IP) emerged, which has been discussed from a few years ago until now. Essentially, it refers to the fastest IP address in the CDN address pool for a user to access. A couple of years ago, some domestic CDN providers could still achieve the "Preferred IP" effect for free through functions provided by Cloudflare's official API. However, since Cloudflare disabled that API function and launched the paid Argo service:

WARP

The "Preferred IP" mentioned in the previous section is configured for the website. When a user's browser accesses a domain hosted on Cloudflare, it first resolves the domain to obtain the corresponding Cloudflare CDN IP address, and enters Cloudflare's "large intranet" based on this address. If it is a "Preferred IP", the access experience is good; if it is not a "Preferred IP", the access experience is poor.

Whether there is a "Preferred IP" is a matter of whether the webmaster has money or technical skills, and has nothing to do with the visiting user. However, for the visiting users themselves, is there a way to actively speed up their access to the website? Of course there is, and that is the focus of today's discussion: Cloudflare's WARP.

In short, WARP is a VPN client provided by Cloudflare that theoretically can be used for free worldwide (if it doesn't work, there are certainly non-theoretical reasons). This VPN is based on WireGuard, currently the most popular VPN technology (Tailscale, which I mentioned in several previous articles, is also based on WireGuard VPN). Its main purpose is to directly connect the user host's traffic to Cloudflare's "large intranet" using WireGuard technology. This prevents the user's DNS requests from being hijacked by ISPs or others, and avoids the user host's traffic taking a "detour" to reach Cloudflare's "large intranet". Of course, because Cloudflare has no data centers in mainland China, even if WARP can connect, it is hard to say what the speed will be like. It depends heavily on the user's region and the broadband ISP they use. Therefore, whether it can ultimately be used and how well it performs after connecting is purely down to luck.

Having said all this, what are the benefits if you can connect to Cloudflare's "large intranet"?

There are plenty of benefits. First, accessing sites that are also hosted on Cloudflare will definitely be faster than without a connection. Second, all access traffic (this can be configured to determine which traffic goes locally and which goes through Cloudflare's "large intranet", with the default being all access traffic) enters Cloudflare's "large intranet" directly in an encrypted manner. This prevents local ISPs from performing DNS hijacking, and they cannot see which websites you visit, or even whether you are using HTTP or HTTPS, because it runs over the WireGuard VPN. Finally, when accessing other websites, you do so through Cloudflare's private backbone network rather than traditional local ISP routing. If the website is hosted on Cloudflare, you access it directly with your real IP (as Cloudflare passes your real IP to the visited website). If the website is not hosted on Cloudflare, what they see is Cloudflare's own IP address, which means it has gone through Cloudflare's Source NAT (what is this useful for? Take a guess).

So how do you connect to WARP? This will not be introduced in detail in this article, as there are many tutorials online. Generally speaking, there are two ways:
"Science" or "magic" (VPN/Proxy tools)
When registering for the first time, use "science" or "magic" and require it to be in global mode, such as Clash's TUN mode. After successful registration, you can use it in the future without "science" or "magic", connecting directly using a normal network.
Use Cloudflare's Zero Trust
If you do not have a "science" or "magic" environment, you can use this method. However, this method requires configuring Cloudflare's Zero Trust in advance (see article:Home Data Center Series: Getting Cloudflare for Free via Home Broadband Without Public IP to Achieve Fast Website Building (Universal)), initialize a Teams account, and configure the WARP Client in Settings:

Note 1: Actually, WARP can also manually perform Preferred IP selection.
Note 2: The WARP client can be installed on iPad and iOS (requires an off-region Apple ID). However, please note that it cannot connect when using cellular networks. I suspect this is because iPhones or iPads prioritize IPv6 under cellular status, as the same devices work fine with my home Wi-Fi. The difference is that on my home router, I directly blocked the resolution results of IPv6 AAAA records in DNS. Therefore, if you want to use "science" or "magic" through WARP under cellular status, you might need to use a configuration profile to disable IPv6 (or prioritize IPv4). I haven't tried this specifically, so I don't know, and I really don't want to install any strange configuration profiles on my iPhone or iPad.
Note 3: Actually, isn't using Tailscale's exit-node under cellular networks much better?

Afterword

Cloudflare is truly a conscientious company. Many of the free features it provides are highly practical. The Free plan has helped many individual webmasters build websites (those with public IPs can use public origin-pull, while those without public IPs can use the Tunnel method to directly connect to the intranet), and the free WARP can solve many problems (for example, WARP can provide dual-stack access capabilities for IPv4-only and IPv6-only hosts). I hope more people can learn about and use the free solutions provided by Cloudflare.

This article is about deploying WARP on the desktop version. For deploying WARP on the Linux CLI version, please refer to the article:Home Data Center Series: Deploy Cloudflare WARP on Cloud Servers to Improve Network Access Speed (Linux CLI Version)。