The program
WARP and changing your address
There are two different obstacles between you and a site. The provider that will not let you reach it — that is the bypass. And the site itself, which does not trust your address — that is WARP.
What it gives you
The first obstacle is your provider. It tears the connection down the moment the site's name becomes visible. That is the bypass's job: packets are rewritten so the name cannot be recognised, and the connection gets through. The address you arrive from stays yours.
The second obstacle is the site itself. The connection arrived, the site answered — and refused. The reason is not in the packets but in the address: the site looks at where you came from and checks that address's reputation.
Anti-fraud systems keep reputation for whole ranges, not for individual addresses. Russian home ranges score badly in those lists: a lot of bots, credential stuffing and abuse come from them, and the low score lands on the entire range at once rather than on the actual offender. From your side it looks like this:
- a captcha that never ends, however many you solve;
- "access restricted" or "we could not process your request" out of nowhere;
- a refusal at sign-up, at sign-in or at payment;
- the site opens, but some of its features stay unusable.
Your provider has nothing to do with it — it let you through, and the bypass is useless here: there is nothing left to push through.
Cloudflare gets you in because WARP's addresses are its own. A sizeable share of the whole web passes through its network, and in those reputation lists these addresses sit very differently from subscriber ones: this is not a "suspect home pool" but infrastructure that already carries an enormous flow of ordinary users. With the proxy on you arrive not from a bad range but as a Cloudflare client — and the very same check that refused you lets you through.
| What you see | What to turn on |
|---|---|
| The site does not open at all, the connection drops | The bypass |
| The site opens but will not let you in: captcha, refusal, "access restricted" | WARP |
| "Not available in your country or region" | Neither will help |
The bypass and WARP do not get in each other's way — they are needed together, because
Cloudflare has to be reached in the first place. Registering a device goes to
api.cloudflareclient.com, a name that is cut by SNI, and the MASQUE connection
itself is under pressure from the provider too. So the bypass has to be running.
What it does not
WARP does not change your country. What changes is the address's reputation, not the country. Free WARP is anycast: you land on the nearest Cloudflare node, not one you chose. From Russia the nearest node is Russian, and so is the exit address.
Measured, not assumed: every run came out on 104.28.x.x, country RU, city
Chelyabinsk, node DME. An independent geo database labels those addresses
Cloudflare WARP and flags them as a proxy. So a service closed to Russia will see
Russia, and a service that blocks VPNs will see the proxy flag.
No setting or entry point changes this: MASQUE has only two IPv4 entry points
(162.159.198.1 and 162.159.198.2) plus four over IPv6, and they all land
on the same nearest node. That is a Cloudflare limitation, not a limitation of this program.
Turning it on
Before you switch it on: along with the proxy, the bypass scope widens to every site — otherwise the connection to Cloudflare does not come up. The bypass then applies to all TLS/QUIC except the exclusion list, and an application or game that is not excluded may misbehave because of it. Your setting in Настройки (Settings) does not change and comes back as soon as the proxy is off.
-
Start the bypass
Registering a device is an ordinary HTTPS request to
api.cloudflareclient.com, and that name is cut by SNI. The engine covers it unconditionally, whatever the bypass scope — but only while it is running. Without the bypass the request may simply never arrive. -
Press «Create device»
The keys are made on your computer. Only the public key leaves — the private one never departs the machine. Cloudflare answers with a licence and an address inside its network.
-
Flip the «Proxy on» switch
The program starts a local proxy and checks that it works: it asks Cloudflare, through that same proxy, where it sees you. Success is not reported until the answer comes back. The status line then shows the exit address and its country.
Where to point it
The proxy intercepts nothing and changes nothing about the system. Only what you point at it goes through it — a deliberate choice: a failure here cannot leave you without internet.
The address is shown on the tab with a «Copy» button beside it. By default it is
127.0.0.1:1080 and the protocol is SOCKS5.
| Where | How |
|---|---|
| Firefox | Settings → General → Network Settings → «Manual proxy configuration» → SOCKS host
127.0.0.1, port 1080, SOCKS v5. |
| Chrome, Edge | They have no proxy settings of their own and take the system ones. Easier to launch with
--proxy-server="socks5://127.0.0.1:1080" or use a switcher extension. |
| Telegram | Settings → Data and Storage → Proxy → add a SOCKS5 entry with the same address and port. |
The proxy listens on 127.0.0.1 only — nothing on your local network can reach it.
That is deliberate: the client's own default is to listen on every address, which on a shared
network would be an open route to the internet under your account.
What happens inside
WARP speaks two transports. The first is plain WireGuard. The second is MASQUE, Cloudflare's own design: an IP tunnel over HTTP/3, falling back to HTTP/2 over ordinary TCP when QUIC does not get through. On port 443 it is indistinguishable from normal web traffic.
The program uses MASQUE, and not as a matter of taste. WireGuard to WARP is cut at the stream level on Russian networks: the handshake is let through and the data after it is dropped. A desync cannot mend that — it can only disguise a connection's first packet, and there is nothing to hide a continuous stream behind.
The program works out how to connect by itself and remembers what succeeded: HTTP/2 over TCP on 443 first, then 4443, 8443, 500, then QUIC with a capped initial packet. Measured on a Russian network: with the bypass running, 443 connects first try; with it stopped, 443 and 8443 are cut moments after connecting and only 4443 survives. One more reason to leave the bypass on.
The MASQUE entry-point addresses (162.159.198.1 and 162.159.198.2) are
covered by the engine unconditionally, whatever the bypass scope — through a separate
profile driven by lists\ipset-masque.txt. It has to be: without it the connection
only came up with the scope set to every site, and nobody would think to connect those two
things. The profile is aimed at exactly two addresses and touches nothing else.
That profile alone is still not enough: measured on a Russian network, the connection only came up when MASQUE was handled by the whole strategy. So for as long as the proxy runs, the bypass scope is widened to every site — with all the consequences set out under Turning it on. The saved setting is not rewritten: the program overrides it while the proxy is up and lets go once it is off.
Options
| Option | What it does |
|---|---|
| Proxy port | Which port to listen on. 1080 by default — the conventional SOCKS port, and
therefore often already taken by something else. If it is, the program says so plainly
instead of failing silently. A change applies after switching the proxy off and on. |
| Send all system traffic through it | Off by default. While WARP is on, the proxy address is written into Windows' own proxy settings, and Chrome, Edge and most ordinary applications pick it up — there is nothing to fill in. The setting is applied only after the connection has been verified, and is removed when WARP is switched off, when the program exits and on a settings reset; if the program crashed, the previous value is put back on the next launch. |
| Create device | Registers a device with Cloudflare. Available while no device exists. |
| Recreate | Forgets the current device and enrols a new one. Useful if Cloudflare stops serving the old one. |
Firefox does not read the system setting — it needs the address filled in by hand, as in the table above. And bear in mind that everything goes through Cloudflare: games, messengers, downloads. That is a detour where none is needed, which is why the switch is off by default.
Where things live
Everything sits in %LOCALAPPDATA%\Zapret2UI\masque: the unpacked
usque.exe client and config.json with the device key, its licence and
token. The folder is inside your own profile, alongside the program's other data.
The client runs as an ordinary child process under your account, with no elevation. If the program crashes, a proxy left behind is cleared away on the next start.
If it does not work
| What you see | What to do |
|---|---|
| The device could not be created | Registration goes to api.cloudflareclient.com, and that name is cut by SNI.
Start the bypass and try again: the engine covers that domain unconditionally, whatever the
scope. If it still fails, Cloudflare moves its client API version from time to time — check
for a newer build of the program. |
| «No way of reaching Cloudflare worked» | Every transport and port was tried. Make sure the bypass is running — without it only port 4443 gets through, with it 443 connects immediately. Check too whether another VPN is up. |
| «Port is already in use by another program» | Something else is sitting on 1080. Put a free port in «Options». |
| «Cloudflare answers but says the traffic is not going through WARP» | The request left the machine outside the proxy. That usually means another tunnel is up and capturing the routes. |
| The proxy is on but a site still says «not available in your region» | Expected: free WARP exits in Russia. See What it does not. |
| The browser ignores the proxy | Check that the address is entered as SOCKS5 and the port matches the one on the tab. Chrome and Edge have no proxy settings of their own — they need a launch flag or an extension. |
| Everything got slower | Expected: traffic takes a detour through Cloudflare. Keep the proxy on only when you need it. |