Preface

For many people in China, cloudlfare is mainly a boon for individual webmasters (such as me): for new webmasters with a certain technical foundation, if they don’t have a record but want to publish their own sites on the public Internet, using cloudflare is just a matter of minutes (access is slow by default, but most of the reasons for the slowness are not actually cloudflare, you know~). I will have a series of tutorials on cloudflare website building and security optimization later, but these are not the points I want to talk about today. What I want to talk about today is actually cloudflare’s WARP.

Cloudflare's global presence

WARP is actually just a result of technology. Before that, we need to mention that Cloudflare has already set up its own private backbone network covering the world. According to the current data on the official website: "Cloudflare has a huge global network, with data centers covering 310 cities in 120 countries." (Of course, "except China and North Korea"). Precisely because it cannot officially enter China, Cloudlfare cooperates with some domestic cloud providers in China (such as Baidu Cloud and JD Cloud). However, this limited cooperation is definitely much worse than other countries where Cloudflare directly establishes data centers and directly connects with multiple Internet exchange centers and multiple ISPs, and even establishes physical dedicated lines for multiple regions. In addition, Cloudflare's return to the source is directly based on the data center assigned to the user when accessing (domestic users are usually assigned to the data center in San Jose in the western United States). Not to mention the long distance and high latency, the line quality to China is also poor. It is natural that this kind of return to the source leads to a poor access experience.

Precisely because of the global private backbone network (equivalent to the global "big intranet"), cloudflare can use its own multiple algorithms to optimize the path of traffic entering its own "big intranet", thereby reducing access delays and improving access experience. The problem at this time is, how to enter cloudflare's "big intranet"? In order to solve this problem, the concept of "preferred IP" has been mentioned from a few years ago to now. In essence, it is the fastest IP address for users to access in the CDN address pool. In the past two years, some domestic CDN manufacturers were able to achieve the effect of preferred IP for free through the functions provided by cloudflare's official API, but since cloudflare disabled the API function and launched the Argo paid service:

Now the free plan can no longer get the "preferred IP" for free. Instead, you can only use it by customizing the host name + manually using software to regularly test the preferred domain name, and then manually modifying the domain name resolution IP after obtaining the IP with the lowest latency (you can also use the worker script to indirectly use the preferred IP function, such as the com main domain name of this blog).

WARP

The "preferred IP" mentioned in the previous section refers to site configuration. When a user's browser accesses a site domain name hosted on cloudflare, it will first resolve the domain name to obtain the IP address of the cloudflare CDN corresponding to the domain name and then enter the cloudflare "intranet" based on this address. If it is a "preferred IP", the access experience is good, but if it is not a "preferred IP", the access experience is not good.

Whether there is a "preferred IP" is a question of whether the webmaster has money or technology, and has nothing to do with the visiting users. However, for the visiting users themselves, is there a way to actively improve the speed of accessing the website? Of course there is, and this is the focus of today's talk: Cloudflare's WARP.

In short, WARP is a VPN client provided by Cloudflare that is theoretically free for use worldwide (if it doesn't work, there must be some non-theoretical reasons). This VPN is based on the most popular Wireguard VPN technology (Tailscale mentioned in many of my previous articles is also based on Wireguard VPN). Its main purpose is to connect the user's host traffic directly to Cloudflare's "big intranet" through Wireguard technology, so as to prevent the user's DNS request from being hijacked by the operator or others, and to prevent the user's host traffic from "taking a long detour" to reach Cloudflare's "big intranet". Of course, because Cloudflare does not have a domestic data center, even if WARP can connect, it is hard to say what the speed will be. It has a lot to do with the user's region and the broadband operator used. So whether it can be used in the end, and whether it works well after using it, all depends on luck.

Having said so much, what are the benefits of being able to connect to Cloudflare's "big intranet"?

Of course, there are many advantages. First of all, the speed of visiting sites also set up on Cloudflare is definitely faster than not connecting. Secondly, all access traffic (this can be set, which traffic goes locally and which traffic goes through Cloudflare's "big intranet", the default is all access traffic) directly enters the Cloudflare "big intranet" in an encrypted manner, and will not be hijacked by the DNS of local operators, and they cannot see which websites you visit, and even cannot see that you use http and https because you use Wireguard's VPN. Finally, to visit other websites, you must go through Cloudflare's private backbone network instead of the traditional local operator's routing. If it is a website set up on Cloudflare, you can access it directly with the real IP (because Cloudflare will pass your real IP to the visited website). If it is not a website set up on Cloudflare, what you see is Cloudflare's own IP address, which has passed through Cloudflare's source address NAT (what's the use of this? You guess).

So how do you connect to a warp? This article will not go into detail, but there are many tutorials online. Generally speaking, there are two ways:
1. Science or Magic
When registering for the first time, use science or magic and it is required to be in global mode, such as the tun mode of clash. After successful registration, you don't need to use science or magic in the future and can directly use the normal network connection.
2. Use Cloudflare’s Zero Trust
If there is no scientific or magical environment, you can use this method, but this method requires cloudflare's zero trust to be configured in advance (see article:Home Data Center Series: Use cloudflare to build a website quickly with no public IP in your home broadband (general purpose)), initialize the teams account and configure WARP Client in Settings:

After configuration, simply add zero trust teams in "Preferences"-"Account" in the WARP client. After success, the WARP interface will become like this:

Simply click the connection button in the middle of the interface to connect successfully:

If you succeed, then congratulations, accessing many websites will become faster.

Note 1: In fact, WARP can also manually select the optimal IP.
Note 2: You can install the warp client on both iPad and iOS (foreign zone ID is required), but please note that you cannot connect to it when using cellular network. I guess it is because iPhone or iPad prioritizes IPv6 in cellular state, because I have no problem using the same device with my home wifi. The difference is that I directly blocked the resolution result of the AAAA record of IPv6 in DNS on my home router. So if you want to use science or magic through WARP in cellular state, you may need to use a description file to disable IPv6 (or prioritize ipv4). I haven't tried it, so I don't know. I really don't want to install any strange description files on iPhone or iPad.
Note 3: In fact, isn’t it better to use tailscale’s exit-node in honeycomb?

Afterword

Cloudflare is really a conscientious company. Many of the functions it provides for free are very practical. The free plan has helped many individual webmasters build websites (those with public IP can use the public network to return to the source, and those without a public IP can use the tunnel method to directly connect to the intranet), and the free WARP can solve many problems (for example, WARP can provide dual-stack access for IPv4-only and IPv6-only hosts). I hope that more people can understand and use the free solutions provided by Cloudflare.

This article is about the desktop version of warp deployment. For the Linux CLI version of warp deployment, please refer to the article:Deploy cloudflare warp on the home data center series cloud host to improve network access speed (Linux cli version).