Self-Hosted WARP on VPS: WireGuard Exit via Cloudflare

To bypass datacenter IP blocks and annoying CAPTCHAs, you can effectively redirect outgoing traffic from your VPS through Cloudflare WARP using just 3 wgcf commands to get the configuration and a few iptables rules for selective routing, allowing you to retain your primary IP for incoming connections while egressing traffic with a 'clean' Cloudflare IP.

What is Cloudflare WARP and why use it on a VPS?

Cloudflare WARP is a service developed by Cloudflare to optimize and secure internet connections, essentially a VPN solution leveraging the WireGuard protocol. It's designed to enhance privacy, security, and internet access speed for end-users. However, its functionality extends beyond a typical VPN, making it an extremely valuable tool for VPS owners.

A primary challenge faced by VPS users, especially when interacting with international services or attempting to automate requests, is the blocking of datacenter IP addresses. Many large websites and services actively combat bots and spam by automatically flagging IP addresses belonging to cloud providers as suspicious. This leads to constant CAPTCHA challenges, slowed operations, and in the worst cases, complete access blocks. For instance, when scraping data, registering accounts, or even making a simple HTTP request to an API, your VPS might encounter restrictions that prevent efficient task execution.

This is where Cloudflare WARP on VPS becomes crucial. By routing your server's outgoing traffic through Cloudflare WARP's infrastructure, you obtain an IP address that target services perceive as a regular residential user IP, not a datacenter IP. This significantly reduces the likelihood of CAPTCHAs and other blocks, opening new possibilities for automation and resource access. Meanwhile, incoming connections to your VPS remain on its 'native' IP address, allowing you to continue using it for hosting websites, game servers, or VLESS over Cloudflare CDN on your VPS: WebSocket, TLS, and Obfuscation without changes.

Benefits of using WARP for outgoing traffic

• Bypass Blocks and CAPTCHAs: Services see traffic originating from Cloudflare, not from a "suspicious" datacenter IP.
• Retain Primary IP: Your VPS continues to accept incoming connections on its original IP, which is critical for most hosting tasks.
• Enhanced Privacy: Outgoing traffic is masked, concealing the true source.
• Simple Setup: Thanks to the wgcf utility, obtaining and configuring WireGuard for WARP is straightforward.
• Free Tier Available: The basic WARP service is free, making it an accessible solution for many tasks. WARP+ is also available, offering access to faster routes.

How WARP+ on Your Server Solves Datacenter IP Blocking?

The issue of datacenter IP address blocking is becoming increasingly prevalent. Most major online services, from Google and Amazon to social networks and streaming platforms, actively employ heuristic algorithms to detect and restrict traffic originating from known IP ranges belonging to cloud providers. This is done to combat spam, DDoS attacks, automated scraping, and other forms of undesirable activity. As a result, even legitimate requests from your VPS can be flagged as suspicious, requiring identity verification via CAPTCHA or completely blocking access to the resource.

The solution with WARP+ on your server involves using Cloudflare WARP as a 'proxy' for outgoing traffic. Instead of directly sending requests from your VPS's IP address (e.g., 185.25.x.x), you route this traffic through a WireGuard tunnel that establishes a connection with Cloudflare WARP. Cloudflare then releases your traffic to the internet from its own 'clean' IP addresses, which are not associated with datacenters and are perceived as regular user IPs. This significantly reduces the likelihood of triggering target websites' protective mechanisms.

How WARP Routing Works

When you set up a WARP WireGuard server on your VPS, you essentially create an additional network interface. All traffic you wish to route through WARP is directed to this interface. The WireGuard client (part of the WARP configuration) then encrypts this traffic and sends it to Cloudflare's servers. Cloudflare decrypts the traffic and forwards it to the target service using its own IP address. The return traffic follows the reverse path: from the target service to Cloudflare, then through the WireGuard tunnel to your VPS, and from there to the application that initiated the request.

It's important to note that you can configure selective routing. This means not all traffic from your VPS will go through WARP. You can set up rules that send only traffic to specific domains or IP addresses through WARP, while all other traffic uses the standard route via your VPS's primary IP address. This approach provides flexibility and allows you to optimize resource usage, routing only the necessary traffic through WARP.

Preparing Your VPS for Cloudflare WARP WireGuard Setup

Before you begin setting up a WARP WireGuard server on your VPS, you need to complete a few preparatory steps. Ensure your VPS meets the minimum requirements and has the necessary utilities installed. For most modern Linux distributions (Ubuntu, Debian, CentOS), these steps will be similar.

Minimum VPS Requirements and WireGuard Installation

For stable operation of WARP via WireGuard on a VPS, the following minimum specifications are recommended:

• Operating System: Ubuntu 20.04+, Debian 10+, CentOS 7+.
• RAM: Minimum 512 MB, but 1 GB or more is preferred for comfortable operation.
• vCPU: 1 core.
• Disk: 10-20 GB SSD/NVMe will be sufficient for the system and logs.
• Network Port: 100 Mbps or 1 Gbps.

Ensure you have SSH access to your VPS with root privileges or a user with sudo. Update your system and install WireGuard and necessary utilities:

sudo apt update && sudo apt upgrade -y
sudo apt install -y wireguard curl iproute2 resolvconf

For CentOS/RHEL:

sudo yum update -y
sudo yum install -y epel-release
sudo yum install -y wireguard-tools curl iproute

You may also need to install wgcf, a utility for obtaining the WARP configuration. Download the latest version of wgcf from GitHub and make it executable:

# Загрузка последней версии wgcf для Linux AMD64
wget -O wgcf https://github.com/ViRb3/wgcf/releases/latest/download/wgcf_linux_amd64
chmod +x wgcf
sudo mv wgcf /usr/local/bin/

Verify that wgcf is available:

wgcf -v

If you see a version number, the utility is installed correctly.

Step-by-Step wgcf Setup: Obtaining Your WARP Configuration for VPS

Obtaining the configuration for Cloudflare WARP on VPS using the wgcf utility is the simplest way to get started. This utility automates the process of registering with Cloudflare WARP and generating the WireGuard configuration.

Registering a WARP Account and Generating the WireGuard Configuration

1. Registering a WARP Account: Execute the following command to register a new WARP account. This will create the wgcf-account.toml file, which will store your WARP credentials.

wgcf register

You will be prompted to accept the terms of service. Type y and press Enter.

2023-10-27T10:00:00Z INF Registering with Cloudflare...
2023-10-27T10:00:00Z INF Successfully registered.
2023-10-27T10:00:00Z INF Saving account to wgcf-account.toml...

2. Generating the WireGuard Configuration: After successful registration, use the following command to generate the WireGuard configuration. This will create the wgcf-profile.conf file.

wgcf generate

You will see output similar to this:

2023-10-27T10:00:00Z INF Generating WireGuard configuration...
2023-10-27T10:00:00Z INF Saving configuration to wgcf-profile.conf...

You now have the wgcf-profile.conf file, which contains all the necessary parameters to connect to Cloudflare WARP via WireGuard. This file will need to be moved to the standard location for WireGuard configurations.

sudo mv wgcf-profile.conf /etc/wireguard/wgcf.conf

3. Enabling WARP+ (Optional): If you have a WARP+ key, you can add it to the wgcf-account.toml file. Open the file in a text editor:

sudo nano /usr/local/bin/wgcf-account.toml

Find the [Account] section and add or modify the license_key field:

[Account]
device_id = "YOUR_DEVICE_ID"
private_key = "YOUR_PRIVATE_KEY"
license_key = "YOUR_WARP_PLUS_KEY" # Добавьте сюда ваш ключ WARP+

Save the changes (Ctrl+O, Enter, Ctrl+X). Then, regenerate the configuration:

wgcf generate
sudo mv wgcf-profile.conf /etc/wireguard/wgcf.conf

Now your WARP+ server will utilize the benefits of WARP+.

Integrating WARP WireGuard with Your VPS: Traffic Routing

After obtaining the configuration, wgcf setup for the WireGuard interface and traffic routing is a crucial step. We will configure the WireGuard interface and then selectively direct outgoing traffic through it.

Connecting the WireGuard Interface and Verifying the Egress IP

1. Configuring the WireGuard Interface: The file /etc/wireguard/wgcf.conf already contains everything necessary. However, by default, wgcf generates a configuration that routes all traffic through WARP (AllowedIPs = 0.0.0.0/0). For our purposes, where we want to retain access to the VPS via its primary IP but only egress selective traffic through WARP, we will need to modify this parameter.

Open the configuration file:

sudo nano /etc/wireguard/wgcf.conf

Find the line AllowedIPs = 0.0.0.0/0 and change it to AllowedIPs = 0.0.0.0/0, ::/0. Important: for selective routing, we will need to manage this parameter via ip rule and iptables, rather than through AllowedIPs in the WireGuard configuration. If you want WARP to be used only for specific domains, then AllowedIPs in wgcf.conf should be left as is, and all routing logic should be handled using OS rules. However, for an initial test and to ensure the tunnel is working, you can temporarily leave AllowedIPs = 0.0.0.0/0, ::/0. Also, ensure that the file does not contain PostUp and PreDown lines, which might conflict with your custom routing. If they exist, comment them out or remove them. Add Cloudflare DNS servers for correct name resolution within the tunnel:

[Interface]
# ... существующие строки ...
DNS = 1.1.1.1, 1.0.0.1

Save the file.

2. Starting the WireGuard Interface:

sudo wg-quick up wgcf

Check the interface status:

sudo wg show wgcf

You should see connection information. If there are errors, check the logs or the configuration file.

3. Verifying the Egress IP: If you left AllowedIPs = 0.0.0.0/0, all outgoing traffic should go through WARP. Check your public IP:

curl https://cloudflare.com/cdn-cgi/trace

In the output, you should see warp=on and an IP address that differs from your VPS's primary IP. This confirms that geo-bypass via WARP is working.

To disable WARP (if you left AllowedIPs = 0.0.0.0/0):

sudo wg-quick down wgcf

Selective Routing: Directing Specific Domains Through WARP

For selective routing, where only a portion of traffic goes through WARP and the rest via the primary interface, we'll need a more advanced setup using routing tables and iptables (or nftables) rules. This allows you to use WARP instead of a VPN for specific tasks without affecting the server's core functionality.

1. Enabling IP Forwarding: Ensure IP packet forwarding is enabled:

sudo sysctl -w net.ipv4.ip_forward=1
sudo sysctl -w net.ipv6.conf.all.forwarding=1
sudo sysctl -p

2. Creating a Separate Routing Table for WARP: We will create a new routing table and add a default route through the WARP interface to it. Determine the IP address of the wgcf interface. It typically looks like 172.16.0.2/32 or similar.

ip a show wgcf

Let's assume your IP is 172.16.0.2. Add a new routing table (e.g., with ID 100):

sudo ip route add default dev wgcf table 100
sudo ip rule add fwmark 100 table 100

3. Marking Traffic for Redirection: Now we'll use iptables to mark packets that should go through WARP. For example, if you want traffic to example.com to go through WARP:

# Разрешаем исходящие соединения по WARP
sudo iptables -A FORWARD -i wgcf -j ACCEPT
sudo iptables -A FORWARD -o wgcf -j ACCEPT

# Маркируем трафик, идущий к определенному домену/IP
# Сначала получаем IP-адрес домена
TARGET_IP=$(dig +short example.com | head -n 1) # Замените example.com на нужный домен

# Маркируем пакеты, предназначенные для TARGET_IP
sudo iptables -t mangle -A OUTPUT -d $TARGET_IP -j MARK --set-mark 100
sudo iptables -t mangle -A PREROUTING -d $TARGET_IP -j MARK --set-mark 100

# Для IPv6 (если нужно)
# TARGET_IPV6=$(dig +short -t AAAA example.com | head -n 1)
# sudo ip6tables -t mangle -A OUTPUT -d $TARGET_IPV6 -j MARK --set-mark 100
# sudo ip6tables -t mangle -A PREROUTING -d $TARGET_IPV6 -j MARK --set-mark 100

4. Configuring NAT for Outgoing Traffic via WARP: Since the WARP interface receives a private IP, you need to configure NAT so that outgoing traffic has the WARP IP address:

sudo iptables -t nat -A POSTROUTING -o wgcf -j MASQUERADE

5. Saving iptables Rules: To ensure rules persist after reboot:

# Для Debian/Ubuntu
sudo apt install -y iptables-persistent
sudo netfilter-persistent save
sudo netfilter-persistent reload

# Для CentOS/RHEL
sudo yum install -y iptables-services
sudo systemctl enable iptables
sudo systemctl start iptables
sudo iptables-save > /etc/sysconfig/iptables

Now all traffic to example.com will go through Cloudflare WARP, while other traffic will go directly from your VPS. You can add more iptables rules for other domains or IP ranges. In this context, it's useful to explore AmneziaWG on VPS: WireGuard Obfuscation Against DPI in 2026 to understand general WireGuard principles.

Advanced Geo-Bypass: Combining WARP with VLESS/Hysteria2

For the most flexible and resilient bypass of blocks and geo-restrictions, you can combine Cloudflare WARP with other proxy protocols like VLESS, VLESS/XTLS, or Hysteria2. This approach allows the client to connect to your server using the chosen protocol, and the server then routes a portion of the traffic through WARP. This provides double obfuscation and increases resistance to blocking, effectively utilizing geo-bypass via WARP.

Client Connects to Your Server, Server Routes Traffic Through WARP

The core idea is that your VPS acts as an intermediary. The client device (computer, smartphone) connects to your VPS using the VLESS or Hysteria2 protocol, leveraging your VPS's IP address. Then, on the VPS, configured routing rules determine which client traffic should be directed through the WARP tunnel and which should go through the regular VPS internet connection. This is particularly useful when your primary IP is already blocked, but you want to provide access to a 'clean' Cloudflare IP for your users.

Example: Integrating VLESS with WARP

For VLESS (e.g., using Xray-core or Sing-box), the process would look like this:

1. VLESS Server Installation: You install and configure the VLESS server on your VPS as usual, using its primary IP and port (e.g., 443 with TLS). Masking VPN as a Regular Website: Nginx, Reality, and a Plausible Frontend on a Single VPS can be useful for additional obfuscation.
2. WARP Interface Configuration: You configure the WireGuard interface for WARP as described in previous sections, but without routing all traffic through it (i.e., AllowedIPs in wgcf.conf should be restricted, or you use ip rule for selective routing).
3. Routing VLESS Traffic Through WARP:

   To do this, you need to determine which traffic generated by the VLESS server (from clients) should go through WARP. This can be done in two main ways:

   • Based on UID/GID: If your VLESS server runs under a specific user (e.g., nobody or vlessuser), you can mark all outgoing traffic from that user via iptables and direct it to the WARP routing table.

   # Пример для UID
   sudo iptables -t mangle -A OUTPUT -m owner --uid-owner vlessuser -j MARK --set-mark 100
   sudo ip rule add fwmark 100 table 100
   

   • Based on Target IPs/Domains: In the VLESS server configuration (e.g., in Xray), you can set up routing so that traffic to specific domains or IP addresses (e.g., streaming services that block datacenter IPs) is sent through a Socks5 proxy, which, in turn, will only "see" the WARP interface. Alternatively, and simpler, use iptables on the VPS itself to mark the target traffic, as we did earlier.

Thus, the client connects to VLESS, the VLESS server on the VPS processes requests, and then, if the request is directed to a "problematic" resource, it is egressed through WARP. This allows for effective use of WARP instead of a VPN to bypass geo-restrictions, while maintaining the flexibility and obfuscation provided by VLESS.

Remember that for stability and speed, your VPS must have sufficient resources. VPN or VPS: What to Choose for Privacy and Bypass Blocks can help you make the basic choice, but for such advanced configurations, a VPS is the clear choice.

Limitations and Considerations for Using WARP Instead of a VPN on VPS

While Cloudflare WARP offers excellent capabilities for bypassing datacenter IP blocks, it's important to understand its limitations and potential issues. Using WARP instead of a VPN is not a universal solution and has its own characteristics, especially concerning performance and stability.

Speed, Stability, and Handling Connection Interruptions

1. Speed: Connection speed through WARP can vary. The free WARP service doesn't always guarantee maximum throughput, as Cloudflare may prioritize traffic from paid users (WARP+). If speed is critical, consider activating WARP+. Even with WARP+, adding an extra hop (your VPS -> WARP -> Internet) always introduces some latency and potentially reduces overall speed compared to a direct connection. For critical tasks requiring high bandwidth, such as large volumes of traffic or many simultaneous connections, a more powerful VPS or dedicated server for VPN might be needed when 100 Mbps is no longer enough.

# Пример теста скорости через WARP (после включения WARP для всего трафика)
curl -s https://raw.githubusercontent.com/sivel/speedtest-cli/master/speedtest.py | python3 -

2. Stability: A WARP connection, like any VPN connection, can be subject to temporary disconnections. This could be due to Cloudflare server overload, network issues on your VPS or Cloudflare's side, or even active blocking by your VPS's internet provider (though less likely for WireGuard). In case of a disconnection, traffic intended for WARP might either stop routing entirely or (depending on your rules) begin routing through your VPS's primary IP, potentially leading to the exposure of your real IP or renewed blocks.

3. What to do upon connection loss:

• Automatic Restart: Ensure the WireGuard interface is configured to start automatically on system boot (sudo systemctl enable wg-quick@wgcf).
• Monitoring and Scripts: Develop a script that periodically checks WARP's availability (e.g., by pinging a known IP address through the wgcf interface) and restarts it if the connection drops.
• Kill Switch: For critical tasks where IP leakage is unacceptable, configure iptables rules that will completely block traffic if the WARP interface is inactive. This acts as a "kill switch."

# Пример Kill Switch (для Ubuntu/Debian)
# Создаем цепочку для блокировки трафика
sudo iptables -N WARP_KILL_SWITCH
sudo iptables -A WARP_KILL_SWITCH -j DROP

# Если wgcf не поднят, весь исходящий трафик, который должен идти через WARP, будет дропаться
# Добавьте это правило ПЕРЕД правилами маркировки трафика для WARP
# sudo iptables -A OUTPUT -o ! wgcf -m mark --mark 100 -j WARP_KILL_SWITCH
# Однако, это сложно реализовать корректно без глубокой интеграции в скрипт запуска/остановки wgcf
# Проще всего - просто не создавать правила маршрутизации, если интерфейс не поднят.

• Backup Channel: Consider setting up a backup VPS for VPN or another bypass method that can be quickly activated.

4. Proxy Detection: Some services may attempt to detect if you are using a proxy or VPN. While WARP masks itself as a "regular user," this doesn't guarantee 100% bypass of the most advanced detection systems. However, for most tasks, it will work effectively.

Choosing the Optimal VPS for WARP Routing

Choosing the right VPS is a crucial aspect for successful and stable operation with Cloudflare WARP on VPS, especially when actively routing traffic and using additional protocols like VLESS or Hysteria2. While WARP itself doesn't demand exorbitant resources, the overall server load, number of simultaneous connections, and traffic volume play key roles.

VPS Specifications and Estimated Pricing for This Setup

For 50 concurrent players or active users generating up to 1 TB of traffic per month, 4 vCPU, 8 GB RAM, and an 80 GB NVMe disk are sufficient.

Load (Concurrent Users / Traffic)	vCPU	RAM	Disk	Port	Estimated Valebyte Price ($/month, Oct. 2023)
Up to 10 users / 200 GB	1	1 GB	20 GB NVMe/SSD	100 Mbps	From $5
Up to 25 users / 500 GB	2	2 GB	40 GB NVMe/SSD	200 Mbps	From $10
Up to 50 users / 1 TB	4	4 GB	80 GB NVMe	500 Mbps	From $20
Up to 100+ users / 2 TB+	6-8+	8-16 GB+	160 GB+ NVMe	1 Gbps	From $40

When choosing a VPS for your WARP WireGuard server, pay attention to the following parameters:

• Processor (vCPU): Even for basic routing, 1 vCPU is sufficient. However, if you plan to use VLESS/Hysteria2 with many connections or high load (e.g., traffic encryption), 2-4 vCPUs will be preferable for smooth, low-latency operation.
• RAM: For WireGuard+WARP, 512 MB is the absolute minimum. For comfortable system operation, and if you're running additional services (VLESS, Nginx, Docker), 1-2 GB RAM will be the optimal choice. If you have many clients or anticipate active caching, consider 4 GB.
• Disk Subsystem: NVMe drives are significantly faster than traditional SSDs and HDDs. While WireGuard and WARP don't require intensive disk I/O, a fast disk subsystem improves overall system responsiveness and speeds up work with logs or temporary files. 20-40 GB NVMe will be perfectly sufficient.
• Network Bandwidth: This is one of the most critical parameters. Cloudflare WARP can provide high speeds, and to avoid becoming a bottleneck, your VPS must have sufficient network bandwidth. A minimum of 100 Mbps, but preferably 500 Mbps or even 1 Gbps, especially if you plan to actively use WARP+ on your server for high traffic volumes.
• Server Location: Although traffic will egress through Cloudflare, the initial connection to your VPS will pass through its datacenter. Choose a datacenter geographically closer to you or your end-users to minimize latency to the VPS.

Valebyte.com offers various VPS plans that are ideally suited for such tasks. Our servers are equipped with fast NVMe drives and high-speed network ports, ensuring excellent performance for working with WARP, WireGuard, and other protocols. You can always find current prices and detailed specifications on our website.

Frequently Asked Questions

Here we've compiled answers to the most common questions regarding the use of Cloudflare WARP on a VPS.

1. Can WARP be used for incoming connections on a VPS?

No, Cloudflare WARP is designed for routing outgoing traffic. It does not provide you with a public IP address for incoming connections. Your VPS will continue to receive incoming traffic on its primary IP address, allowing you to host websites, VPN servers, and other services without conflicts.

2. How do I activate WARP+ on a VPS after installing wgcf?

To activate WARP+, you will need a license key. Open the file /usr/local/bin/wgcf-account.toml (or wherever you saved it) and add your key to the field license_key = "YOUR_WARP_PLUS_KEY" under the [Account] section. Afterward, regenerate the WireGuard configuration with the wgcf generate command and restart the WireGuard interface (sudo wg-quick down wgcf && sudo wg-quick up wgcf).

3. How secure is using WARP to bypass blocks?

WARP uses the WireGuard protocol with modern encryption algorithms, providing a high level of security and privacy for your outgoing traffic. Cloudflare is a large and reputable company. For maximum security, it is recommended to use WARP in conjunction with other protocols, such as VLESS, to add another layer of obfuscation and masking.

4. Will WARP affect the speed of my website hosted on the same VPS?

No, WARP should not directly affect your website's loading speed if you have configured selective routing. Incoming traffic to your website will still arrive directly at your VPS's primary IP. Outgoing traffic from your website (e.g., requests to external APIs) may be routed through WARP, which could slightly increase latency, but this is usually not critical for most web applications.

5. What alternatives to WARP exist for bypassing datacenter IP blocks?

Besides WARP, other methods exist, such as using residential proxy servers or VPN services that offer obfuscation. However, WARP is often one of the simplest and most cost-effective solutions for selective block bypassing, especially when you need Cloudflare WARP on VPS without the expense of costly proxies.

Conclusion

Setting up your own WARP on a VPS using WireGuard through Cloudflare is an effective and flexible solution for bypassing datacenter IP blocks and persistent CAPTCHAs. This approach allows you to retain your VPS's core functionality while providing a 'clean' egress IP address for specific traffic. For most tasks requiring block circumvention, a VPS with 2 GB RAM, 2 vCPU, and an NVMe disk will be an optimal choice, offering good performance at an estimated price from $10 per month.