11 ms·

Cloudflare: Warp for Linux and Proxy Mode

72 points by signa11 5y ago

preinheimer 5y ago
> ~$ sudo warp-diag feedback An app that requires me to use sudo to send feedback doesn't seem like the kind of app I want to be running with sudo.
- mbreese 5y ago
  I agree that seems like a lot of privileges for just feedback, but this is Linux... you can still run the command without sudo to see what works. I suspect it's pulling some kernel-side information that requires root. Remember -- you already need to use root access to install the package in the first place, so you either trust Cloudflare or you don't. But, from the docs, if you run > ~$ sudo warp-diag (without the "feedback" argument), you can see the logs that are created and attached to the support ticket if you use "feedback" [1]. [1] https://developers.cloudflare.com/warp-client/setting-up/linux#feedback https://developers.cloudflare.com/warp-client/setting-up/lin...
- deleted 5y ago
  [deleted]
newscracker 5y ago
This is nice, and having 95% of the code shared across platforms is no small task. One thing I miss with 1.1.1.1 and WARP is DNS based ad blocking and filtering. NextDNS has handled that part quite well, allowing multiple profiles (so you can have different rules for different devices) to be setup in a single account. One can choose different filter lists and manage custom allow/deny lists too. The simpler filter lists are what one would choose with something like uBlock Origin. The NextDNS app on iOS is also just a DoH DNS provider and not a “VPN” app. This allows using another VPN app (or VPN service) while simultaneously relying on NextDNS for DNS. I understand that Cloudflare wants users to use WARP+ for routing traffic too, but it would be useful to add more flexible DNS filtering capabilities (similar to NextDNS) and also provide for a non-VPN setup on iOS. As I understand it, the Cloudflare DNS service has a malware blocking/family mode and another (default) one that’s not.
- josephcsible 5y ago
  > One thing I miss with 1.1.1.1 and WARP is DNS based ad blocking and filtering. Isn't that a lot less useful today anyway, given the new trend of serving ads through the same domain as the content you want to see? Why not just go all in on uBlock Origin?
  - nullify88 5y ago
    Because DNS based adblocking goes further than ads blocked in the browser. Its also effective in mobile apps, and other devices such as Smart TVs where it is not possible to have uBlock do the filtering. I agree its effectiveness is wearing down as ads are served via the first party domain, but it still does make a difference.
  - handrous 5y ago
    Pihole still catches 95+% of ads for me.
ducktective 5y ago
It's not open-source right? What language is it written in?
- vlovich123 5y ago
  > To avoid these pitfalls, we wrote the core of the product in Rust, which allows for 95% of the code to be shared across platforms.
vbezhenar 5y ago
I'm surprised that they packaged CentOS/RHEL version, but didn't care to package fedora version. I tried to use RHEL8 on Fedora, but DNS did not work, I didn't investigate further. Also I'd love docker version just for socks proxy. I made one myself using RHEL UBI8 image, but official one would be perfect.
- sillystuff 5y ago
  WARP is wireguard under the covers. You can extract the keys, and just use real kernel-mode wireguard on any linux distribution with a sufficiently modern kernel. E.g., with: https://github.com/ViRb3/wgcf https://github.com/ViRb3/wgcf
  - vbezhenar 5y ago
    Unfortunately this approach was not reliable for me. I had like 50% success when establishing new connection, while Windows PC with official client always worked. I think that it's more than just getting keys once, may be it rotates a keys or something like that.
PaywallBuster 5y ago
no support for ubuntu 21?
blibble 5y ago
it would be nice if cloudflare attempted to get their various tools into the official Debian repositories (contrib, backports, whatever) after being bitten several times by questionably packaged third-party repositories I now refuse to use any third-party repos
sysadm1n 5y ago
> The WARP application uses BoringTun to encrypt traffic from your device and send it directly to Cloudflare’s edge, ensuring that no one in between is snooping on what you're doing I can see the use case here for when connecting to the local Starbucks wifi to thwart potential bad actors sniffing your data on the wire, but your traffic can still be seen by Cloudflare. Using this is just shifting your network data to Cloudflare who play the 'good guy' (I hope)
- jaywalk 5y ago
  Which is no different from any other VPN provider.
warner_of_doom 5y ago
It's only a matter of time before this freemium VPN gets kicked offline for all the illegal activity it will facilitate for free. Hacking, CSAM, Piracy, etc. will all be routed through Cloudflare's massive network -- and all for free. And, I don't think they keep serious logs on traffic. So, DMCA holders are going to throw a fit if this gets popular, which seems to be the aim?
kbenson 5y ago
> Enter our own WireGuard implementation called BoringTun. In retrospect, I guess it's obvious that when nerdy but extremely popular tech mogul globally popularizes a pun on tunneling and boring that we'd see it pop up other places. Still though, ugh.
- bityard 5y ago
  I doubt the reference to Musk's brand is intentional. It's more likely that it's a reference/homage to BoringSSL (https://github.com/google/boringssl https://github.com/google/boringssl) and "boring tech" in general that is purposefully designed to be minimalist, simple to use, and narrow in scope.
matthewaveryusa 5y ago
My bet on the next step: Port forwarding for NAT busting and zero open ports, with "smart edge cloudflare caching" -- like ngrok, but with edge features.
- jgrahamc 5y ago
  You mean like Cloudflare Tunnel? https://www.cloudflare.com/en-gb/products/tunnel/ https://www.cloudflare.com/en-gb/products/tunnel/
Youden 5y ago
If you want the kernel implementation of WireGuard instead, or you can't use the official packages for some reason, there's an unofficial CLI on GitHub [0] that just spits out a standard wg-quick configuration file for you to use. I started using it a few weeks ago while travelling and I've found it reliable and painless. [0]: https://github.com/ViRb3/wgcf https://github.com/ViRb3/wgcf
- warner_of_doom 5y ago
  This is the way.
xfalcox 5y ago
It's weird that this is not packaged in Arch.
- grafelic 5y ago
  Build the package yourself, PKGBUILDs are easy. I mean it in no condescendig way.
goodpoint 5y ago
> WARP keeps your traffic secure, private and fast Reminder: sending your traffic to Cloudflare means entrusting your privacy to them, the US government, the government of the countries where their datacenters are, the datacenter ISPs. Is it better than your local ISP? Difficult to tell. But creating a monopoly that controls most websites, DNS and VPNs is very dangerous for the world. If you care about privacy and freedom of information for everybody, please support Tor instead.
- warner_of_doom 5y ago
  i2p for files. tor for info. i2p + tor is a great combo.
slownews45 5y ago
"By routing all an enterprise's traffic from devices anywhere on the planet through WARP." The one massively annoying thing is their split tunnel config does not let you ONLY route your enterprise IP ranges through cloudflare for teams. Ie, you want users to have access to 10.15.XXX.XXX but the rest of their traffic is unmolested. You can only EXCLUDE some items from the routing, not just route some ranges. Weird isn't it? Most users at home want netflix, local printing etc to continue to work as it did before their employer has them stick cloudflare on machine. Routing all their private traffic through cloudflare seems like a big miss.
- jaywalk 5y ago
  That seems like something a company as technically-sophisticated as Cloudflare wouldn't screw up. Are you sure that's how it works? Even the crappy VPN software my employer uses does proper split tunneling.
  - slownews45 5y ago
    I know! I was all excited to push everyone over to WARP - but it's a no go - people don't want all their traffic being proxied through corp side (we reserve right to do what we need / want with corp traffice). Info here: https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/exclude-traffic/split-tunnels https://developers.cloudflare.com/cloudflare-one/connections... And yes, the junky folks have this solved - you drop the endpoint on client, set a split tunnel and just pick up your enterprise route. A basic split tunnel (normal style) or one that picked up accessible ranges based on the individual user permissions both would work fine. So if you had a single app on 10.15.54.120 and user had access to that app, split tunnel would put that into route. Key is to leave everything else out - so your computer can see your phone can see your lights etc etc on local network and netflix and friends work normally.
aaomidi 5y ago
Cloudflare arbitrarily and without notice starts throttling the bandwidth of various websites that use them for their proxy feature. This is ofcourse their prerogative, and they can do whatever they want, but doing this without notice is extremely concerning to me. Cloudflare has the ability, and has used the ability to speed gate most of the internet with no transparency. Can cloudflare please provide notice on when domains start getting speedgated? Until then I'm not sure it's a good idea to move any sort of remote access capabilities (e.g. Warp for teams) onto Cloudflare's infrastructure. Not until they get a better support team and are more transparent when your account starts getting limited. I've spent hours trying to debug this problem and it ended up being the proxy.
- slownews45 5y ago
  The issue is in part because WARP routes ALL user traffic over cloudflare - so you can be picking up huge volume for youtube video / netflix etc. Most companies don't want that on their networks.

72 points by signa11 5y ago

> ~$ sudo warp-diag feedback An app that requires me to use sudo to send feedback doesn't seem like the kind of app I want to be running with sudo.

mbreese 5y ago
I agree that seems like a lot of privileges for just feedback, but this is Linux... you can still run the command without sudo to see what works. I suspect it's pulling some kernel-side information that requires root. Remember -- you already need to use root access to install the package in the first place, so you either trust Cloudflare or you don't. But, from the docs, if you run > ~$ sudo warp-diag (without the "feedback" argument), you can see the logs that are created and attached to the support ticket if you use "feedback" [1]. [1] https://developers.cloudflare.com/warp-client/setting-up/linux#feedback https://developers.cloudflare.com/warp-client/setting-up/lin...
deleted 5y ago
[deleted]

newscracker 5y ago

This is nice, and having 95% of the code shared across platforms is no small task. One thing I miss with 1.1.1.1 and WARP is DNS based ad blocking and filtering. NextDNS has handled that part quite well, allowing multiple profiles (so you can have different rules for different devices) to be setup in a single account. One can choose different filter lists and manage custom allow/deny lists too. The simpler filter lists are what one would choose with something like uBlock Origin. The NextDNS app on iOS is also just a DoH DNS provider and not a “VPN” app. This allows using another VPN app (or VPN service) while simultaneously relying on NextDNS for DNS. I understand that Cloudflare wants users to use WARP+ for routing traffic too, but it would be useful to add more flexible DNS filtering capabilities (similar to NextDNS) and also provide for a non-VPN setup on iOS. As I understand it, the Cloudflare DNS service has a malware blocking/family mode and another (default) one that’s not.

josephcsible 5y ago
> One thing I miss with 1.1.1.1 and WARP is DNS based ad blocking and filtering. Isn't that a lot less useful today anyway, given the new trend of serving ads through the same domain as the content you want to see? Why not just go all in on uBlock Origin?
- nullify88 5y ago
  Because DNS based adblocking goes further than ads blocked in the browser. Its also effective in mobile apps, and other devices such as Smart TVs where it is not possible to have uBlock do the filtering. I agree its effectiveness is wearing down as ads are served via the first party domain, but it still does make a difference.
- handrous 5y ago
  Pihole still catches 95+% of ads for me.

ducktective 5y ago

It's not open-source right? What language is it written in?

vlovich123 5y ago
> To avoid these pitfalls, we wrote the core of the product in Rust, which allows for 95% of the code to be shared across platforms.

vbezhenar 5y ago

I'm surprised that they packaged CentOS/RHEL version, but didn't care to package fedora version. I tried to use RHEL8 on Fedora, but DNS did not work, I didn't investigate further. Also I'd love docker version just for socks proxy. I made one myself using RHEL UBI8 image, but official one would be perfect.

sillystuff 5y ago
WARP is wireguard under the covers. You can extract the keys, and just use real kernel-mode wireguard on any linux distribution with a sufficiently modern kernel. E.g., with: https://github.com/ViRb3/wgcf https://github.com/ViRb3/wgcf
- vbezhenar 5y ago
  Unfortunately this approach was not reliable for me. I had like 50% success when establishing new connection, while Windows PC with official client always worked. I think that it's more than just getting keys once, may be it rotates a keys or something like that.

PaywallBuster 5y ago

no support for ubuntu 21?

blibble 5y ago

it would be nice if cloudflare attempted to get their various tools into the official Debian repositories (contrib, backports, whatever) after being bitten several times by questionably packaged third-party repositories I now refuse to use any third-party repos

sysadm1n 5y ago

> The WARP application uses BoringTun to encrypt traffic from your device and send it directly to Cloudflare’s edge, ensuring that no one in between is snooping on what you're doing I can see the use case here for when connecting to the local Starbucks wifi to thwart potential bad actors sniffing your data on the wire, but your traffic can still be seen by Cloudflare. Using this is just shifting your network data to Cloudflare who play the 'good guy' (I hope)

jaywalk 5y ago
Which is no different from any other VPN provider.

warner_of_doom 5y ago

It's only a matter of time before this freemium VPN gets kicked offline for all the illegal activity it will facilitate for free. Hacking, CSAM, Piracy, etc. will all be routed through Cloudflare's massive network -- and all for free. And, I don't think they keep serious logs on traffic. So, DMCA holders are going to throw a fit if this gets popular, which seems to be the aim?

kbenson 5y ago

> Enter our own WireGuard implementation called BoringTun. In retrospect, I guess it's obvious that when nerdy but extremely popular tech mogul globally popularizes a pun on tunneling and boring that we'd see it pop up other places. Still though, ugh.

bityard 5y ago
I doubt the reference to Musk's brand is intentional. It's more likely that it's a reference/homage to BoringSSL (https://github.com/google/boringssl https://github.com/google/boringssl) and "boring tech" in general that is purposefully designed to be minimalist, simple to use, and narrow in scope.

matthewaveryusa 5y ago

My bet on the next step: Port forwarding for NAT busting and zero open ports, with "smart edge cloudflare caching" -- like ngrok, but with edge features.

jgrahamc 5y ago
You mean like Cloudflare Tunnel? https://www.cloudflare.com/en-gb/products/tunnel/ https://www.cloudflare.com/en-gb/products/tunnel/

Youden 5y ago

If you want the kernel implementation of WireGuard instead, or you can't use the official packages for some reason, there's an unofficial CLI on GitHub [0] that just spits out a standard wg-quick configuration file for you to use. I started using it a few weeks ago while travelling and I've found it reliable and painless. [0]: https://github.com/ViRb3/wgcf https://github.com/ViRb3/wgcf

warner_of_doom 5y ago
This is the way.

xfalcox 5y ago

It's weird that this is not packaged in Arch.

grafelic 5y ago
Build the package yourself, PKGBUILDs are easy. I mean it in no condescendig way.

goodpoint 5y ago

> WARP keeps your traffic secure, private and fast Reminder: sending your traffic to Cloudflare means entrusting your privacy to them, the US government, the government of the countries where their datacenters are, the datacenter ISPs. Is it better than your local ISP? Difficult to tell. But creating a monopoly that controls most websites, DNS and VPNs is very dangerous for the world. If you care about privacy and freedom of information for everybody, please support Tor instead.

warner_of_doom 5y ago
i2p for files. tor for info. i2p + tor is a great combo.

slownews45 5y ago

"By routing all an enterprise's traffic from devices anywhere on the planet through WARP." The one massively annoying thing is their split tunnel config does not let you ONLY route your enterprise IP ranges through cloudflare for teams. Ie, you want users to have access to 10.15.XXX.XXX but the rest of their traffic is unmolested. You can only EXCLUDE some items from the routing, not just route some ranges. Weird isn't it? Most users at home want netflix, local printing etc to continue to work as it did before their employer has them stick cloudflare on machine. Routing all their private traffic through cloudflare seems like a big miss.

jaywalk 5y ago
That seems like something a company as technically-sophisticated as Cloudflare wouldn't screw up. Are you sure that's how it works? Even the crappy VPN software my employer uses does proper split tunneling.
- slownews45 5y ago
  I know! I was all excited to push everyone over to WARP - but it's a no go - people don't want all their traffic being proxied through corp side (we reserve right to do what we need / want with corp traffice). Info here: https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/exclude-traffic/split-tunnels https://developers.cloudflare.com/cloudflare-one/connections... And yes, the junky folks have this solved - you drop the endpoint on client, set a split tunnel and just pick up your enterprise route. A basic split tunnel (normal style) or one that picked up accessible ranges based on the individual user permissions both would work fine. So if you had a single app on 10.15.54.120 and user had access to that app, split tunnel would put that into route. Key is to leave everything else out - so your computer can see your phone can see your lights etc etc on local network and netflix and friends work normally.

aaomidi 5y ago

Cloudflare arbitrarily and without notice starts throttling the bandwidth of various websites that use them for their proxy feature. This is ofcourse their prerogative, and they can do whatever they want, but doing this without notice is extremely concerning to me. Cloudflare has the ability, and has used the ability to speed gate most of the internet with no transparency. Can cloudflare please provide notice on when domains start getting speedgated? Until then I'm not sure it's a good idea to move any sort of remote access capabilities (e.g. Warp for teams) onto Cloudflare's infrastructure. Not until they get a better support team and are more transparent when your account starts getting limited. I've spent hours trying to debug this problem and it ended up being the proxy.

slownews45 5y ago
The issue is in part because WARP routes ALL user traffic over cloudflare - so you can be picking up huge volume for youtube video / netflix etc. Most companies don't want that on their networks.