Navigate to Dashboard home page
Support
English
Profile
Back to
[email protected]'s Account
[email protected]'s Account
Switch Account
Zero Trust overview
Analytics
Gateway
Access
Networks
My team
Logs
CASB
DLP
DEX
Email Security
New
Settings
Collapse sidebar
Please complete this two-question survey on your current endpoint security provider.
Take survey
← Back to WARP Client
Kevo L
Name the profile
Name(Required)
Description
Build an expression
Selector(Required)
User group names
Operator(Required)
in
Value
beatindablock.org
×
Remove
OR
Selector(Required)
User email
Operator(Required)
matches
Value
[email protected]
×
Remove
OR
Selector(Required)
User group emails
Operator(Required)
in
Value
[email protected]
×
Remove
AND condition
OR condition
Configure settings
Captive portal detection
Allow the WARP client to turn off for a set amount of time when a captive portal is detected. This enables users to connect to hotel, airplane, or other public WiFi networks.
ON
Timeout:
3 minutes
Edit
Mode switch
Allow users to manually switch between Gateway with WARP and Gateway with DNS. This enables users to turn off the WARP mode while still being protected by DNS filtering.
ON
Device tunnel protocol
Choose how device traffic routes to Cloudflare for policy enforcement and private network access.
Learn more about device tunnel protocols
This link opens in a new tab
WireGuard
Reliable and modern protocol designed to create secure point-to-point connections.
MASQUE
Protocol using a FIPS 140-2 compliant cipher suite that resembles standard HTTPS traffic. Recommended for use cases requiring broad network compatibility or a specific encryption technology.
Lock WARP switch
Prevent users from turning off the WARP switch and disconnecting the client.
ON
Allow device to leave organization
If enabled, users who manually join their device to the organization are allowed to leave the organization.
ON
Allow updates
Allow local administrators to receive notifications on available updates for the client, and to initiate the updates.
ON
Auto connect
Allow the WARP client to turn on automatically after a specified amount of time.
ON
Timeout:
3 minutes
Edit
Support URL
Add a URL that lets your users get in contact with support when clicking the Send Feedback button in the WARP client. If this value is not set, the Send Feedback button will be disabled.
github.com/oneseco-media
Edit
Service mode
WARP mode documentation
This link opens in a new tab
Choose how you want the WARP Client to be configured.
Gateway with WARP
All traffic is encrypted by Gateway. This mode is required if you want to enable HTTP rules, Browser Isolation, Anti-Virus scanning and DLP.
Gateway with DoH
Only DNS traffic is encrypted by Gateway. This mode only allows for DNS policies to be enforced.
Secure Web Gateway without DNS Filtering
Provides only WARP Tunnel and posture functionality. Does not enforce DNS policies or DNS resolution
Device Information Only
Only provide posture state for Access backend applications. This mode does not allow any DNS, Network or HTTP Policies to be enforced.
Proxy mode
Gateway only encrypts traffic sent to the localhost proxy. Does not process DNS traffic.
Local Domain Fallback
Add domains to route DNS queries to resolvers locally connected to your device. Domains added to the Local Domain Fallback list bypass Cloudflare’s filtering and logging.
To apply filtering and logging to DNS queries,
create Resolver policies
to route to custom resolvers on your Zero Trust network.
Manage
Split Tunnels
Configure Cloudflare Zero Trust to exclude or include traffic to a given set of IP addresses or domains. Any traffic directed to an excluded destination will be handled by the local machine. Use wildcards to match against multiple subdomains at the same time.
Include IPs and domains
Exclude IPs and domains
Include IPs
Exclude IPs
Manage
Directly route Microsoft 365 traffic
Exclude Microsoft 365 traffic from going through Cloudflare Zero Trust. To enable, Split Tunnels must be set to exclude IPs and domains. Microsoft 365 entries are automatically appended every hour but will not be visible in the UI.
View IPs from Microsoft's official list.
This link opens in a new tab
ON
Allow users to enable local network exclusion
Allow users to opt-in to temporarily access local network resources like printers. For a duration you select, opting-in excludes a user's local network from the tunnel. Configured policies and Gateway log visibility will be unavailable.