TechPrufer
Get started
Cloudflare
Cloudflare logoCloudflare · Feature trail

Userspace VPN Implementation

8 posts · Sep 2017 – Jun 2026

What this trail covers

Cloudflare Mesh extends Cloudflare One's SASE and Zero Trust suite to provide secure, bidirectional private networking for users, nodes, and autonomous agents. It integrates with the Cloudflare Developer Platform, allowing Workers and Durable Objects to access private infrastructure directly. Mesh leverages existing WARP Connector and Client infrastructure, now rebranded as Mesh nodes and Cloudflare One Client respectively, to create a unified private network. Existing Gateway policies, Access r

All Cloudflare trails
  1. Route public traffic to private applications with CloudflareThis post introduces 'Application Services for Private Origins' in closed beta, allowing Enterprise customers to route public traffic to private origins without exposing them to the public internet. This leverages existing Cloudflare private networking layers (WAN, Mesh, Tunnel, One Client) to apply security, performance, and programmability services (WAF, bot management, rate limiting, caching, rewrites, Workers) to private applications. It extends Spectrum to support private origins via virtual networks and integrates Workers VPC bindings with the private routing layer. The API attribute `use_private_routing` is introduced for DNS records to signal this behavior.
  2. Secure private networking for everyone: users, nodes, agents, Workers — introducing Cloudflare MeshIntroduces Cloudflare Mesh, a new private networking solution designed for autonomous agents and traditional users/nodes. Mesh provides bidirectional, many-to-many connectivity, routing traffic through Cloudflare's global network. It integrates with the Cloudflare Developer Platform, enabling Workers and Durable Objects to access private infrastructure via a new `cf1:network` binding in `wrangler.jsonc`. Mesh leverages existing Cloudflare One components (WARP Connector/Client) and inherits its security controls (Gateway policies, Access rules, device posture checks). It offers high availability through active-passive connector setups and aims to solve NAT traversal challenges by routing all traffic through Cloudflare's edge.
  3. A QUICker SASE client: re-building Proxy ModeThis post details a re-architecture of the Cloudflare One Client's proxy mode, moving from a WireGuard-based L3 tunnel with smoltcp to direct L4 proxying using QUIC streams and MASQUE. This eliminates the smoltcp dependency, leverages native QUIC benefits (congestion control, flow control), and allows for tuneable QUIC parameters. Internal testing shows doubled download/upload speeds and significantly decreased latency. The update is available with client version 2025.8.779.0 and requires setting Service mode to Local proxy mode and Device tunnel protocol to MASQUE in the Cloudflare One dashboard.
  4. How to build your own VPN, or- the history of WARPThis post details the initial implementation of WARP as a Layer 3 VPN using the Linux networking stack, specifically focusing on the use of Netfilter, nftables, and conntrack for routing and NAT. It explains how packets are encapsulated, decapsulated, and rewritten, and how conntrack's stateful capabilities are leveraged for both firewalling and NAT. The post also discusses the use of TUN devices and packet marking for distinguishing WARP traffic from other network traffic.
  5. Zero Trust WARP: tunneling with a MASQUEThis post details the integration of the MASQUE protocol into Cloudflare's Zero Trust WARP service. It explains the limitations of WireGuard for extensibility and standard compliance, and highlights how MASQUE, built on HTTP/3 and QUIC, addresses these by enabling traffic to appear as standard HTTPS over port 443. The post also emphasizes the use of FIPS-compliant cipher suites within MASQUE and the proven reliability of the underlying QUIC and MASQUE technologies at Cloudflare's scale.
  7. Virtual networking 101: bridging the gap to understanding TAPThis post provides a deep dive into the Linux tap device interface, explaining its functionality for virtual networking in VMs and VPN clients. It details the setup process using `ioctl` calls like `TUNSETIFF` and `TUNSETOFFLOAD`, discusses the `IFF_TAP`, `IFF_TUN`, `IFF_VNET_HDR`, and `IFF_MULTI_QUEUE` flags, and explains the role of `virtio_net_hdr`. It also covers buffer size management, checksum offloads (`TUN_F_CSUM`), and segmentation offloads (`TUN_F_TSO4`, `TUN_F_TSO6`), highlighting potential issues like EIO errors when `TUN_F_CSUM` is not used with UDP segmentation.
  8. Cloudflare is now powering Microsoft Edge Secure NetworkThis post details Cloudflare's partnership with Microsoft Edge to power Edge Secure Network VPN. It introduces Cloudflare's Privacy Proxy Platform, which utilizes HTTP CONNECT for proxying, integrates with 1.1.1.1 for DNS, a Privacy Pass token proxy for client authentication, and Geo-egress for selecting an egress IP address. The platform aims to provide a fast and secure VPN experience within the browser, leveraging Cloudflare's global network for low latency and geolocation parity. Key components include a Token Proxy, Privacy API, and the Privacy Proxy itself, all designed to validate clients without collecting personal information. The post also highlights the use of Cloudflare's Oxy proxying framework for operational aspects and the benefits of Cloudflare's extensive network for minimizing latency and ensuring relevant search results.
  9. Donning a MASQUE: building a new protocol into Cloudflare WARPThis post introduces the integration of the MASQUE protocol into Cloudflare WARP for iOS. It details the technical rationale for adopting MASQUE over WireGuard, focusing on its use of HTTP/3 and QUIC for efficient IP and UDP proxying. The post explains the protocol's advantages, including faster connection establishment, elimination of head-of-line blocking, and agility through extension mechanisms. It also describes how MASQUE connections are established and visualized, and how it leverages Cloudflare's existing proxy framework and QUIC implementation. The article highlights the protocol's resilience due to its use of port 443 and the potential for future extensions like Multipath QUIC.
  10. Cloudflare Agent — Seamless Deployment at ScaleThe Cloudflare agent now has feature parity across Windows, macOS, ChromeOS, Linux, iOS, and Android. Key new features include domain-based split tunneling, include-only split tunneling, and improved private domain DNS resolution. The agent is built with a shared Rust daemon for cross-platform code reuse and leverages BoringTun for its WireGuard implementation. Deployment and configuration can be automated via APIs and Terraform.
  11. Building a Pet Cam using a Raspberry Pi, Cloudflare Tunnels and TeamsThis post details the setup of a personal pet cam using a Raspberry Pi, Motion (webcam software), Cloudflare Tunnel for secure external access, and Cloudflare Teams for authentication. It covers installing Motion, configuring it as a service, installing cloudflared on ARM architecture, creating and configuring a Cloudflare Tunnel to forward traffic to the Motion server, routing DNS, and finally securing access with Cloudflare Teams and Google authentication.
  12. Announcing WARP for Linux and Proxy ModeThis post announces the release of Cloudflare WARP for Linux, enabling users to control WARP via a command-line interface (warp-cli). It also introduces a new 'proxy mode' for all desktop clients, allowing WARP to encrypt traffic only for configured applications (HTTPS or SOCKS5) rather than the entire device. The post details installation instructions for Linux distributions (Ubuntu, RHEL, CentOS) and provides examples of using the warp-cli for registration, connection, mode setting, and diagnostics.
  13. Introducing WARP for Desktop and Cloudflare for TeamsThis post announces the general availability of Cloudflare WARP for desktop users and its integration with Cloudflare Gateway. It details how WARP encrypts all user traffic using BoringTun (a WireGuard implementation) and sends it to Cloudflare's edge. For enterprise customers, WARP client enables advanced web filtering and security policies through Cloudflare Gateway, protecting remote workers without backhauling traffic. It highlights features like encrypted traffic, WARP+ speed benefits, L7 firewall, user-based policies, and device/user auditing. Deployment options (self-install, scripted, managed) are also provided.
  14. Announcing the Beta for WARP for macOS and WindowsThis post announces the beta release of WARP for macOS and Windows, extending the mobile WARP technology to desktop platforms. It highlights the continued use of the WireGuard protocol for security and speed, and the free basic service offering. Plans for WARP+ integration with Argo Smart Routing are mentioned, along with a waitlist for users and a commitment to developing a Linux client.
  15. The Technical Challenges of Building Cloudflare WARPThis post details the technical challenges encountered during the development of Cloudflare WARP, specifically focusing on issues related to maintaining persistent connections with ECMP routing. It explains how frequent changes in source IP and port, caused by network switches and NAT, led to connection failures. The post also provides background on Cloudflare's network architecture, including Anycast IP addresses and ECMP routing, and explains the roles of IP and TCP in packet transmission. It introduces Network Address Translation (NAT) as a solution to IPv4 address exhaustion and its implications for WARP's connection stability.
  16. WARP is here (sorry it took so long)This post announces the public release of WARP and WARP+, detailing the technical challenges encountered during development, including iOS network stack changes, diverse mobile carrier/OS/device issues, and maintaining long-lived sessions with Anycast routing. It highlights the use of WireGuard protocol and Argo network for WARP+. It also discusses bug reporting mechanisms and privacy principles.
  17. Introducing WARP: fixing mobile Internet performance and securityThis post introduces WARP, a new mobile application that extends Cloudflare's network to mobile devices. WARP acts as a VPN for all internet traffic, securing and optimizing it using a UDP-based protocol built on Neumob's technology and Cloudflare's global network. It aims to improve performance and reliability over traditional mobile internet and VPNs, while also enhancing security and privacy by encrypting unencrypted connections. The basic version is free, with a premium WARP+ offering.
  18. BoringTun, a userspace WireGuard implementation in RustCloudflare has developed and open-sourced BoringTun, a userspace implementation of the WireGuard protocol written in Rust. This project was initiated to address the performance limitations of wireguard-go and the platform restrictions of the Linux kernel module, aiming for a cross-platform, fast, and safe VPN solution. The choice of Rust was driven by its memory safety and performance characteristics, offering an alternative to C/C++ and Go for this use case. BoringTun is licensed under the 3-Clause BSD License.
  19. Cloudflare’s Super Secret Plan, or why we acquired NeumobThis post announces the acquisition of Neumob, a company with technology to speed up mobile apps, reduce errors on mobile networks, and increase conversions. Cloudflare plans to integrate Neumob's technology with its global network to provide global reach for mobile app connectivity. The Neumob software changes how mobile apps interact with APIs, using optimized protocols to connect to the nearest Cloudflare data center. This technology can also function as a VPN for mobile devices, securing and accelerating all HTTP traffic. The Neumob service is being discontinued as its server components are moved to the Cloudflare network, with plans to relaunch under a new name. This acquisition is part of Cloudflare's long-term strategy to extend its network benefits to mobile applications.
  20. Down the Rabbit Hole: The Making of Cloudflare WarpThis post introduces Cloudflare Warp (later renamed Argo Tunnel), a tunneling protocol based on HTTP/2. It aims to provide an easier and more secure way to connect origin servers to the Cloudflare network, punching through firewalls and NAT. It leverages HTTP/2's multiplexing and HPACK header compression for efficiency and uses Go for cross-compilation of the agent. It integrates with Cloudflare's Anycast network via Argo for optimized routing to the origin and provides redundancy through multiple tunnel connections to different PoPs. It also integrates with Load Balancing for origin health monitoring.