WARP and HMS

What it gives you

The first obstacle is your provider. It tears the connection down the moment the site's name becomes visible. That is the bypass's job: packets are rewritten so the name cannot be recognised, and the connection gets through. The address you arrive from stays yours.

The second obstacle is the site itself. The connection arrived, the site answered — and refused. The reason is not in the packets but in the address: the site looks at where you came from and checks that address's reputation.

Anti-fraud systems keep reputation for whole ranges, not for individual addresses. Russian home ranges score badly in those lists: a lot of bots, credential stuffing and abuse come from them, and the low score lands on the entire range at once rather than on the actual offender. From your side it looks like this:

• a captcha that never ends, however many you solve;
• "access restricted" or "we could not process your request" out of nowhere;
• a refusal at sign-up, at sign-in or at payment;
• the site opens, but some of its features stay unusable.

Your provider has nothing to do with it — it let you through, and the bypass is useless here: there is nothing left to push through.

Cloudflare gets you in because WARP's addresses are its own. A sizeable share of the whole web passes through its network, and in those reputation lists these addresses sit very differently from subscriber ones: this is not a "suspect home pool" but infrastructure that already carries an enormous flow of ordinary users. With the proxy on you arrive not from a bad range but as a Cloudflare client — and the very same check that refused you lets you through.

What it does not

WARP by itself does not change your country. What changes is the address's reputation, not the country. Free WARP is anycast: you land on the nearest Cloudflare node, not one you chose. From Russia the nearest node is Russian, and so is the exit address.

No setting and no other entry point picks the country: MASQUE has only two IPv4 entry points (162.159.198.1 and 162.159.198.2) plus four over IPv6, and they all land on the same nearest node. But the exit country follows wherever the connection to Cloudflare came from — and HMS is built on that.

Turning it on

1. Start the bypass

   Registering a device is an ordinary HTTPS request to api.cloudflareclient.com, and that name is cut by SNI. The engine covers it unconditionally, whatever the bypass scope — but only while it is running. Without the bypass the request may simply never arrive.

2. Press «Create device»

   The keys are made on your computer. Only the public key leaves — the private one never departs the machine. Cloudflare answers with a licence and an address inside its network.

3. Flip the «Proxy on» switch

   The program starts a local proxy and checks that it works: it asks Cloudflare, through that same proxy, where it sees you. Success is not reported until the answer comes back. The status line then shows the exit address and its country.

Where to point it

The proxy intercepts nothing and changes nothing about the system. Only what you point at it goes through it — a deliberate choice: a failure here cannot leave you without internet.

The address is shown on the tab with a «Copy» button beside it. By default it is 127.0.0.1:1080 and the protocol is SOCKS5.

What happens inside

WARP speaks two transports. The first is plain WireGuard. The second is MASQUE, Cloudflare's own design: an IP tunnel over HTTP/3, falling back to HTTP/2 over ordinary TCP when QUIC does not get through. On port 443 it is indistinguishable from normal web traffic.

The program uses MASQUE, and not as a matter of taste. WireGuard to WARP is cut at the stream level on Russian networks: the handshake is let through and the data after it is dropped. A desync cannot mend that — it can only disguise a connection's first packet, and there is nothing to hide a continuous stream behind.

Options

HMS: changing the country

HMS is the tab between WARP and Settings; the community picked the name: Hide My Ass. It is a second connection to WARP, dialled not directly but through an entrance in another country. Measured: Cloudflare picks the exit country from wherever the connection came from — the device and the keys stay the same. Connect from Germany and the exit is German. That is what cures "not available in your region", against which both the bypass and plain WARP are powerless.

1. Your browser

   By a Windows rule only the listed sites go into the chain. Everything else goes as usual, at full speed.

2. Zapret2UI

   Takes these sites and passes them on. With Tor it also helps the bridges through with the bypass — the provider cuts them; your own proxy reaches its server by itself.

3. The entrance

   A bridge and Tor exiting in the chosen country — or your own SOCKS5 proxy (a VLESS or Shadowsocks client). This is the link that sets the country.

4. Cloudflare WARP

   An address that is trusted: the service sees a Cloudflare client, not a Tor exit it knows and refuses.

5. The site

   Sees the entrance's country, not yours.

Turning it on. Create a device on the WARP tab — one serves both tabs. On the HMS tab choose the entrance: "Свой прокси" (Your proxy — a SOCKS5 address such as 127.0.0.1:10808, with a login socks5://user:password@host:port) or "Tor" (a country code such as de). For Tor press "Получить мосты" (Get bridges) and "Проверить скорость" (Check speed), and optionally "Подобрать выход" (Choose an exit). Then turn on "Цепочка включена" (Chain on) and "Вести эти сайты через цепочку" (Send these sites through the chain).

Bridges and the exit node

Bridges come with one button or from the @GetBridgesBot bot in Telegram; a fast exit node is measured and pinned by the program itself.

"Получить мосты" asks the Tor Project for bridges — no captcha, the same request Tor Browser's "Connection Assist" makes — and also looks for ordinary Tor relays that answer from your network. Any relay can be named as a bridge (the ValdikSS/tor-relay-scanner idea). Such relays carry no obfuscation and are often faster than bridges: measured, 9 of 9 brought Tor up, median 5.4 Mbit/s, best 20.6 — against 3.2 for a live obfs4 bridge. Where the provider blocks Tor by protocol they will not get through, and obfs4 and webtunnel are the fallback.

"Проверить скорость" brings up every line of the box in turn, however many there are, and rewrites the box: the fast ones on top, each with a comment such as # 12.5 Mbit/s, first byte 1.2 s, the dead ones at the bottom with the reason. Nothing is deleted. Tor takes the first 12 lines of the box — which is why the fast ones move to the top. You can still paste your own lines — the @GetBridgesBot bot in Telegram hands them out, command /webtunnel.

"Подобрать выход" measures the country's ten widest exits by the consensus and pins the best one by address. Without a pin Tor takes a new node for every connection, and the WARP address moves with it — to a service that is a new visitor every time.

Which sites take the chain

The list is edited by hand, one domain per line. The shipped one is ChatGPT, Gemini and Grok: those are the ones that refuse by country. A domain covers everything under it: openai.com is also api.openai.com. The rule is written into Windows' settings while the chain is on; Chrome, Edge, Brave and anything built on them pick it up — that is what it was checked on; Firefox has not been tested.

• While the chain is on, these sites go through it and nowhere else. If the entrance drops they stop opening rather than leave from your own address. Switch the chain off and the rule is removed — they go out as usual, from your own address, so better stay out of an account tied to another country then.
• Exceptions go around the chain even when the list covers them. Measured: the grok.com page makes 219 requests, and 188 of them go to cdn.grok.com, where a country means nothing.
• Speed: through Tor it measured 2–6 Mbit/s with about a second of latency. Fine for a conversation, noticeable for files — which is why the list is kept short.

Where things live

The usque.exe client is unpacked into C:\Program Files\Zapret2UI\masque: it runs with administrator's rights, so it lives where it cannot be swapped. config.json with the device key, its licence and token is in your own profile, in %LOCALAPPDATA%\Zapret2UI\masque.

Tor for HMS lives in C:\Program Files\Zapret2UI\tor: tor.exe, the pt\lyrebird.exe transport with pt_config.json, the geoip and geoip6 databases and torrc. The data folder with the cached consensus — which is also where exits and ordinary relays are picked from — is in %LOCALAPPDATA%\Zapret2UI\tor\data. It is downloaded the first time the chain is switched on through Tor.

If it does not work