Cloudflare offers a free VPN service called WARP. The official 1.1.1.1 client, however, is proprietary, unnecessarily bloated, and not even available on some platforms (Linux servers, Android TV). Fortunately, WARP can be used purely through WireGuard – a lightweight, open source VPN protocol.

What is WARP?

WARP is a VPN service by Cloudflare, launched in 2019. Unlike traditional VPNs that slow you down and drain your battery, WARP was designed to actually speed up your internet. It's built on the WireGuard protocol – modern, efficient, and open source.

Cloudflare described it as "a VPN for people who don't know what VPN stands for." It encrypts all traffic from your device, not just DNS queries. And unlike most VPN providers, Cloudflare:

• Doesn't log user-identifiable data
• Doesn't sell your data to advertisers
• Doesn't require any personal information – not even an email
• Gets regularly audited by independent firms

Why WARP?

I use it because:

• It's free with no data limits
• Unlimited speed – Cloudflare has servers worldwide
• Masks my IP from sketchy websites
• Encrypts traffic – useful on public Wi-Fi
• I can use it to download... Linux ISOs 😏

WARP won't put you in a different country like traditional VPNs – don't expect to bypass Netflix geo-blocks. It connects you to the nearest Cloudflare server, so instead of your exact location, you might appear to be browsing from a nearby city. It's not perfect anonymity, but it provides solid basic protection.

Is it actually private?

Let's be honest – WARP is not an anonymity tool. Instead of your ISP, Cloudflare sees your traffic. You're shifting trust from one company to another.

The difference is who you trust more. Your ISP:

• Knows exactly who you are (you're paying them)
• In many countries, is legally required to log your traffic
• Often sells data or shares it with ad networks
• Can block content at the DNS level

Cloudflare, on the other hand, claims to:

• Not log identifiable data to disk
• Not sell data or use it for ad targeting
• Get regularly audited (the latest audit confirmed they're keeping their promises)

Is it better than your ISP? Probably yes. Is it perfect privacy? No. If you need true anonymity, look into Tor or paid VPNs like Mullvad, which accept cash or cryptocurrency payments.

WARP is a good compromise – it's free, fast, and significantly better than browsing with no protection at all.

Why not the official app?

Cloudflare offers its own 1.1.1.1 client, but it's proprietary, fairly heavy, and doesn't even exist on some platforms. Since WARP runs on WireGuard, you can bypass the official app entirely and use a purely open source client. Benefits:

• WireGuard is lightweight – minimal battery impact
• Open source – you can verify what it does
• Works everywhere – including Linux, routers, and Android TV
• No bloatware – just a clean VPN config file

What you'll need

1. wgcf – CLI tool to register a WARP account
2. WireGuard – installed on your device

Step 1: Generate configuration using wgcf

wgcf registers a WARP account and creates a WireGuard configuration. Download the latest release for your system.

Windows

Open Command Prompt and navigate to the folder with the downloaded file:

cd Downloads

Register an account and generate the configuration:

wgcf.exe register
wgcf.exe generate

Linux / macOS

wgcf register
wgcf generate

The result is a file called wgcf-profile.conf – a complete WireGuard configuration ready to import.

Tip: If you have a WARP+ key, you can enter it during registration for faster speeds.

Alternative: Generator on this page

Don't want to install anything? Use the generator below – it registers a WARP account and creates the configuration right in your browser. No data leaves your computer.

Step 2: Import into WireGuard

Windows / macOS / Android / iOS

1. Open the WireGuard app
2. Click Import tunnel(s) from file
3. Select wgcf-profile.conf
4. Activate the tunnel

Linux

# Copy the configuration
sudo cp wgcf-profile.conf /etc/wireguard/wgcf-profile.conf
 
# Enable the tunnel
sudo wg-quick up wgcf-profile
 
# Disable the tunnel
sudo wg-quick down wgcf-profile

Android TV

WireGuard isn't in the Play Store on Android TV, but you can sideload it:

1. Download the APK from F-Droid or the official website
2. Transfer to your TV – I recommend LocalSend (open source, works over local network)
3. Install the APK and import the configuration

Note: If internet disconnects after activating the VPN on your TV, set a proxy in system settings: IP 127.0.0.1, port 56000. Also keep in mind that remote control via local network (e.g. from your phone) won't work while the VPN is active.

Step 3: Verification

After connecting, verify that WARP is working:

curl https://cloudflare.com/cdn-cgi/trace

Look for the line warp=on in the response – that means you're connected through WARP.

Bonus: Cloudflare DNS

Even without full WARP, you can use Cloudflare DNS – just change the DNS on your device or directly on your router:

Changing DNS on your router affects all devices on the network – it usually works seamlessly, devices pick up the new DNS via DHCP. But if you have something that depends on your ISP's DNS (some IPTV services, etc.), be careful.

Why change DNS?

Cloudflare DNS is fast (often faster than your ISP's DNS) and more private – Cloudflare claims to delete logs within 24 hours. As a bonus: many blocks on school and corporate networks work through DNS. When you swap your DNS, you might find that previously blocked sites become accessible. Not that I'd recommend that... 😏

Other DNS providers

Cloudflare isn't the only option. Here's an overview of popular DNS resolvers:

If privacy is your main concern, Mullvad or Quad9 are great choices. If you want to block ads at the DNS level, try AdGuard.

Conclusion

WARP through WireGuard is a simple, free, and open source path to better internet privacy. No proprietary app, no limits. Works on anything that supports WireGuard – from your phone to a laptop, Raspberry Pi, or Android TV.

If you want to learn more about this topic, Linus Tech Tips has a good video on WARP.