Skip to content

Commit

Permalink
PCX-14856 (#19036)
Browse files Browse the repository at this point in the history
  • Loading branch information
ranbel authored Jan 13, 2025
1 parent 014d56d commit 17e7206
Showing 1 changed file with 3 additions and 3 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -82,11 +82,11 @@ When `Enabled`, the WARP client will [automatically install](/cloudflare-one/con

Overrides the default IP address of WARP's [virtual network interface](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/warp-architecture/#ip-traffic) such that each device has its own unique local interface IP.

This setting is primarily used in conjunction with the [WARP Connector](/cloudflare-one/connections/connect-networks/private-net/warp-connector/) and for [MASQUE](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-settings/#device-tunnel-protocol). You can also use it when the default IP conflicts with other local services on your network.
This setting is primarily used as a prerequisite for [WARP Connector](/cloudflare-one/connections/connect-networks/private-net/warp-connector/) and [MASQUE](#device-tunnel-protocol). You can also use it when the default IP conflicts with other local services on your network.

**Value:**

- `Disabled`: (default) Sets the local interface IP to `172.16.0.2` on all devices.
- `Disabled`: (default) Sets the local interface IP to `172.16.0.2` on all devices. This configuration is only respected by devices using [WireGuard](#device-tunnel-protocol) and does not affect devices using [MASQUE](#device-tunnel-protocol).

- `Enabled`: Sets the local interface IP on each device to its <GlossaryTooltip term="CGNAT IP">CGNAT IP</GlossaryTooltip>. The change takes effect within 24 hours.

Expand Down Expand Up @@ -138,7 +138,7 @@ Configures the protocol used to route IP traffic from the device to Cloudflare G
**Value**:

- **WireGuard**: (default) Establishes a [WireGuard](https://www.wireguard.com/) connection to Cloudflare. The WARP client will encrypt traffic using a non-FIPs compliant cipher suite, `TLS_CHACHA20_POLY1305_SHA256`. When switching from MASQUE to WireGuard, users may lose Internet connectivity if their Wi-Fi network blocks the [ports and IPs](/cloudflare-one/connections/connect-devices/warp/deployment/firewall/#warp-ingress-ip) required for WireGuard to function.
- **MASQUE**: Establishes an HTTP/3 connection to Cloudflare. To use MASQUE, [Override local interface IP](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-settings/#override-local-interface-ip-) must be `Enabled`. The WARP client will encrypt traffic using TLS 1.3 and a [FIPS 140-2](https://csrc.nist.gov/pubs/fips/140-2/upd2/final) compliant cipher suite, `TLS_AES_256_GCM_SHA384`.
- **MASQUE**: Establishes an HTTP/3 connection to Cloudflare. The WARP client will encrypt traffic using TLS 1.3 and a [FIPS 140-2](https://csrc.nist.gov/pubs/fips/140-2/upd2/final) compliant cipher suite, `TLS_AES_256_GCM_SHA384`. [Override local interface IP](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-settings/#override-local-interface-ip-) is enabled by default for devices with MASQUE enabled.

For more details on WireGuard versus MASQUE, refer to our [blog post](https://blog.cloudflare.com/zero-trust-warp-with-a-masque).

Expand Down

0 comments on commit 17e7206

Please sign in to comment.