How to Set Up Cloudflare WARP on a Linux VPS - Evoxt
Login
Register
 We care about the Environmentstripe_climate_badge
EvoxtGuidesHow to Set Up Cloudflare WARP on a Linux VPS

How to Set Up Cloudflare WARP on a Linux VPS

This guide shows you how to set up Cloudflare WARP on a Linux VPS, from installing the client to choosing the right connection mode. WARP is a lightweight VPN/proxy tool built on WireGuard that routes your traffic through Cloudflare's network. Originally designed for mobile and desktop, it also runs on Linux servers via the warp-cli command-line tool, making it useful for VPS setups where you need better routing, an extra layer of privacy, or a way around IP-based restrictions.

What Is Cloudflare WARP and Why Use It on a VPS

WARP encrypts your VPS's outbound traffic and routes it through Cloudflare's global network instead of your provider's default route. On a server, this is typically used to:
  • Access services that block traffic from known VPS/datacenter IP ranges
  • Improve routing performance to certain destinations via Cloudflare's backbone
  • Add a local SOCKS5 proxy for specific applications without rerouting the whole server
  • Get a consistent, Cloudflare-assigned egress IP
It's free to use in its basic form and doesn't require a paid Cloudflare plan.

Prerequisites

  • A VPS running Ubuntu, Debian, or CentOS/RHEL
  • Root or sudo access
  • Basic comfort with the terminal
For the official documentation, see Cloudflare's WARP client Linux setup guide.

Step 1 — Add the Cloudflare WARP Repository

Ubuntu/Debian

curl -fsSL https://pkg.cloudflareclient.com/pubkey.gpg | sudo gpg --yes --dearmor --output /usr/share/keyrings/cloudflare-warp-archive-keyring.gpg
echo "deb [signed-by=/usr/share/keyrings/cloudflare-warp-archive-keyring.gpg] https://pkg.cloudflareclient.com/ $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/cloudflare-client.list

CentOS/RHEL

curl -fsSl https://pkg.cloudflareclient.com/cloudflare-warp-ascii.repo | sudo tee /etc/yum.repos.d/cloudflare-warp.repo

Step 2 — Install warp-cli

Ubuntu/Debian

sudo apt install cloudflare-warp -y

CentOS/RHEL

sudo yum install cloudflare-warp -y
Verify the installation: 
warp-cli --version

Step 3 — Register the Client

Before connecting, the client needs to register a device identity with Cloudflare. No Cloudflare account is required for the free tier. 
warp-cli registration new
This creates a local device registration tied to your server.

Step 4 — Choose a Connection Mode

WARP supports multiple modes. On a VPS, the mode you pick matters a lot.

Proxy Mode (Recommended for servers)

Runs WARP as a local SOCKS5 proxy instead of tunneling all system traffic. This is the safest option for a VPS because it won't interfere with your SSH session or other services. 
warp-cli mode proxy
warp-cli proxy port 40000

WARP Mode (Full tunnel)

Routes all outbound traffic through WARP. Use with caution on a remote VPS — if not configured correctly, this can route your SSH connection through the tunnel and lock you out if it drops. Before switching to this mode, exclude your own SSH IP from the tunnel so your session isn't affected. 
warp-cli tunnel ip add <your-ssh-ip>
Once the exclusion is set, switch to full tunnel mode: 
warp-cli mode warp

DNS-only Mode

Routes only DNS queries through Cloudflare's 1.1.1.1 resolver, without proxying traffic. Useful if you only want faster/private DNS. 
warp-cli mode doh

Step 5 — Connect and Verify

warp-cli connect
Check the connection status: 
warp-cli status
Verify traffic is routing through WARP: 
curl https://www.cloudflare.com/cdn-cgi/trace
Or if you're using Proxy Mode: 
curl -x socks5h://127.0.0.1:40000 https://www.cloudflare.com/cdn-cgi/trace
Look for warp=on in the output.

Optional — Disconnect WARP

When you no longer need WARP active, or if you need to troubleshoot connectivity, disconnect it with: 
warp-cli disconnect

Common Issues and Troubleshooting

SSH lockout after enabling WARP mode

If you switch to full WARP mode and lose SSH access, you'll need console access (via your VPS provider's control panel) to run warp-cli disconnect or switch back to proxy mode. Most VPS providers offer a browser-based VNC console for exactly this situation, log in to your provider's control panel, open the VNC/console session for the server, and you'll get direct terminal access even though SSH is unreachable. From there, run warp-cli disconnect to restore normal routing, then set up the SSH IP exclusion (see Step 4) before reconnecting to WARP mode.

Registration fails

Usually caused by outbound connectivity issues or a firewall blocking Cloudflare's endpoints. Confirm the VPS can reach pkg.cloudflareclient.com and Cloudflare's API endpoints.

warp=on not showing in trace output

Confirm warp-cli status shows "Connected," and that you're not behind a conflicting proxy or VPN already active on the same interface.

Conclusion

Setting up Cloudflare WARP on a Linux VPS is straightforward once you understand the difference between Proxy Mode and full WARP Mode, and for most server use cases, Proxy Mode is the safer, more practical choice. If you're looking for a reliable VPS to run this kind of setup on, Evoxt's plans are built to support configurations like this out of the box.

Quick Setup:

Ubuntu/Debian(Proxy Mode): 
curl -fsSL https://pkg.cloudflareclient.com/pubkey.gpg | sudo gpg --yes --dearmor --output /usr/share/keyrings/cloudflare-warp-archive-keyring.gpg
echo "deb [signed-by=/usr/share/keyrings/cloudflare-warp-archive-keyring.gpg] https://pkg.cloudflareclient.com/ $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/cloudflare-client.list
sudo apt install cloudflare-warp -y
warp-cli registration new
warp-cli mode proxy
warp-cli connect
warp-cli disconnect
CentOS/RHEL(Proxy Mode): 
curl -fsSl https://pkg.cloudflareclient.com/cloudflare-warp-ascii.repo | sudo tee /etc/yum.repos.d/cloudflare-warp.repo 
sudo yum install cloudflare-warp -y
warp-cli registration new
warp-cli mode proxy 
warp-cli connect
warp-cli disconnect

High CPU Frequency Virtual Machines

Available Globally

Starting at

$2.99

Deploy now