Cloudflare: Warp for Linux and Proxy Mode | Hacker News Reader

Cloudflare: Warp for Linux and Proxy Mode

blog.cloudflare.com

72 pointssigna1131 comments

Cloudflare arbitrarily and without notice starts throttling the bandwidth of various websites that use them for their proxy feature. This is ofcourse their prerogative, and they can do whatever they want, but doing this without notice is extremely concerning to me.

Cloudflare has the ability, and has used the ability to speed gate most of the internet with no transparency. Can cloudflare please provide notice on when domains start getting speedgated? Until then I'm not sure it's a good idea to move any sort of remote access capabilities (e.g. Warp for teams) onto Cloudflare's infrastructure. Not until they get a better support team and are more transparent when your account starts getting limited. I've spent hours trying to debug this problem and it ended up being the proxy.

The issue is in part because WARP routes ALL user traffic over cloudflare - so you can be picking up huge volume for youtube video / netflix etc. Most companies don't want that on their networks.

"By routing all an enterprise's traffic from devices anywhere on the planet through WARP."

The one massively annoying thing is their split tunnel config does not let you ONLY route your enterprise IP ranges through cloudflare for teams. Ie, you want users to have access to 10.15.XXX.XXX but the rest of their traffic is unmolested.

You can only EXCLUDE some items from the routing, not just route some ranges. Weird isn't it?

Most users at home want netflix, local printing etc to continue to work as it did before their employer has them stick cloudflare on machine. Routing all their private traffic through cloudflare seems like a big miss.

That seems like something a company as technically-sophisticated as Cloudflare wouldn't screw up. Are you sure that's how it works? Even the crappy VPN software my employer uses does proper split tunneling.

I know! I was all excited to push everyone over to WARP - but it's a no go - people don't want all their traffic being proxied through corp side (we reserve right to do what we need / want with corp traffice).

Info here: https://developers.cloudflare.com/cloudflare-one/connections...

And yes, the junky folks have this solved - you drop the endpoint on client, set a split tunnel and just pick up your enterprise route.

A basic split tunnel (normal style) or one that picked up accessible ranges based on the individual user permissions both would work fine. So if you had a single app on 10.15.54.120 and user had access to that app, split tunnel would put that into route. Key is to leave everything else out - so your computer can see your phone can see your lights etc etc on local network and netflix and friends work normally.

If you want the kernel implementation of WireGuard instead, or you can't use the official packages for some reason, there's an unofficial CLI on GitHub [0] that just spits out a standard wg-quick configuration file for you to use.

I started using it a few weeks ago while travelling and I've found it reliable and painless.

[0]: https://github.com/ViRb3/wgcf

This is the way.

This is nice, and having 95% of the code shared across platforms is no small task.

One thing I miss with 1.1.1.1 and WARP is DNS based ad blocking and filtering. NextDNS has handled that part quite well, allowing multiple profiles (so you can have different rules for different devices) to be setup in a single account. One can choose different filter lists and manage custom allow/deny lists too. The simpler filter lists are what one would choose with something like uBlock Origin. The NextDNS app on iOS is also just a DoH DNS provider and not a “VPN” app. This allows using another VPN app (or VPN service) while simultaneously relying on NextDNS for DNS.

I understand that Cloudflare wants users to use WARP+ for routing traffic too, but it would be useful to add more flexible DNS filtering capabilities (similar to NextDNS) and also provide for a non-VPN setup on iOS. As I understand it, the Cloudflare DNS service has a malware blocking/family mode and another (default) one that’s not.

> One thing I miss with 1.1.1.1 and WARP is DNS based ad blocking and filtering.

Isn't that a lot less useful today anyway, given the new trend of serving ads through the same domain as the content you want to see? Why not just go all in on uBlock Origin?

Because DNS based adblocking goes further than ads blocked in the browser. Its also effective in mobile apps, and other devices such as Smart TVs where it is not possible to have uBlock do the filtering.

I agree its effectiveness is wearing down as ads are served via the first party domain, but it still does make a difference.

Pihole still catches 95+% of ads for me.

> ~$ sudo warp-diag feedback

An app that requires me to use sudo to send feedback doesn't seem like the kind of app I want to be running with sudo.

I agree that seems like a lot of privileges for just feedback, but this is Linux... you can still run the command without sudo to see what works. I suspect it's pulling some kernel-side information that requires root. Remember -- you already need to use root access to install the package in the first place, so you either trust Cloudflare or you don't.

But, from the docs, if you run

> ~$ sudo warp-diag

(without the "feedback" argument), you can see the logs that are created and attached to the support ticket if you use "feedback" [1].

[1] https://developers.cloudflare.com/warp-client/setting-up/lin...

> The WARP application uses BoringTun to encrypt traffic from your device and send it directly to Cloudflare’s edge, ensuring that no one in between is snooping on what you're doing

I can see the use case here for when connecting to the local Starbucks wifi to thwart potential bad actors sniffing your data on the wire, but your traffic can still be seen by Cloudflare. Using this is just shifting your network data to Cloudflare who play the 'good guy' (I hope)

Which is no different from any other VPN provider.

> WARP keeps your traffic secure, private and fast

Reminder: sending your traffic to Cloudflare means entrusting your privacy to them, the US government, the government of the countries where their datacenters are, the datacenter ISPs.

Is it better than your local ISP? Difficult to tell.

But creating a monopoly that controls most websites, DNS and VPNs is very dangerous for the world.

If you care about privacy and freedom of information for everybody, please support Tor instead.

i2p for files.

tor for info.

i2p + tor is a great combo.

I'm surprised that they packaged CentOS/RHEL version, but didn't care to package fedora version. I tried to use RHEL8 on Fedora, but DNS did not work, I didn't investigate further.

Also I'd love docker version just for socks proxy. I made one myself using RHEL UBI8 image, but official one would be perfect.

WARP is wireguard under the covers. You can extract the keys, and just use real kernel-mode wireguard on any linux distribution with a sufficiently modern kernel.

E.g., with:

https://github.com/ViRb3/wgcf

Unfortunately this approach was not reliable for me. I had like 50% success when establishing new connection, while Windows PC with official client always worked. I think that it's more than just getting keys once, may be it rotates a keys or something like that.

It's weird that this is not packaged in Arch.

Build the package yourself, PKGBUILDs are easy. I mean it in no condescendig way.

> Enter our own WireGuard implementation called BoringTun.

In retrospect, I guess it's obvious that when nerdy but extremely popular tech mogul globally popularizes a pun on tunneling and boring that we'd see it pop up other places.

Still though, ugh.

I doubt the reference to Musk's brand is intentional. It's more likely that it's a reference/homage to BoringSSL (https://github.com/google/boringssl) and "boring tech" in general that is purposefully designed to be minimalist, simple to use, and narrow in scope.

My bet on the next step: Port forwarding for NAT busting and zero open ports, with "smart edge cloudflare caching" -- like ngrok, but with edge features.

You mean like Cloudflare Tunnel?

https://www.cloudflare.com/en-gb/products/tunnel/

it would be nice if cloudflare attempted to get their various tools into the official Debian repositories (contrib, backports, whatever)

after being bitten several times by questionably packaged third-party repositories I now refuse to use any third-party repos

It's not open-source right? What language is it written in?

> To avoid these pitfalls, we wrote the core of the product in Rust, which allows for 95% of the code to be shared across platforms.

no support for ubuntu 21?

It's only a matter of time before this freemium VPN gets kicked offline for all the illegal activity it will facilitate for free.

Hacking, CSAM, Piracy, etc. will all be routed through Cloudflare's massive network -- and all for free.

And, I don't think they keep serious logs on traffic. So, DMCA holders are going to throw a fit if this gets popular, which seems to be the aim?

Reply on news.ycombinator.com