Help · Operators

Cloudflare WARP

Sends users' TCP traffic out through Cloudflare WARP instead of your server's IP, so websites see a Cloudflare address. UDP and olcRTC still leave from your IP. You choose it when you register the node; after that ProofKit switches it, on request.

Open in the app All help topics
example
Off:  user → origin → internet            (sites see your IP)
On:   user → origin → WARP → internet     (TCP: sites see Cloudflare)

With WARP on, the agent runs Cloudflare's WARP client as a local SOCKS5 proxy on the origin (127.0.0.1:40000), and Xray sends users' TCP connections through it. Websites then see a Cloudflare address instead of yours.

What goes through WARP

  • TCP from Reality, Hysteria2 and XHTTP users: through WARP.
  • UDP from those users: straight from your IP, because the WARP proxy does not carry UDP.
  • olcRTC: straight from your IP; it does not pass through Xray.
  • Tunnels between edges and origins are not affected.

When it helps

  • Fewer abuse complaints to your hosting provider about web traffic.
  • Sites that block data-centre addresses but accept Cloudflare's.

When it hurts

  • Streaming services and some sites treat Cloudflare addresses as VPN traffic.
  • An extra hop adds some latency.
  • The country websites see may differ from your node's country.
You choose WARP when you register the node, and the install command then carries --warp. After that ProofKit switches it, exit by exit, from its own panel, and the exit follows that setting every time it connects: the Settings form can't change it, and installing again with or without the flag changes nothing. To have it switched, open a ticket under Support. The marketplace shows a WARP badge on nodes that use it.