Blogs›Cloudflare›Userspace VPN Implementation
Cloudflare has developed BoringTun, a userspace implementation of the WireGuard protocol written in Rust, aiming for a fast, safe, and cross-platform VPN solution. WARP, a mobile app utilizing this technology, secures all of a phone's internet traffic. The technical challenges in building WARP involved addressing issues with diverse phone and operating system versions, varied network conditions, and Cloudflare's own infrastructure. Key technical hurdles included managing ECMP routing with dynami The Cloudflare agent, built with a shared Rust daemon and leveraging BoringTun for its WireGuard implementation, has achieved feature parity across Windows, macOS, ChromeOS, Linux, iOS, and Android. New deployment and configuration options include domain-based and include-only split tunneling, improved private domain DNS resolution, and upcoming posture-only mode. Deployment is further streamlined through APIs and Terraform provider integration, with future plans for user/group-specific settings and dashboard management.
12/10/2021
The Cloudflare agent now has feature parity across Windows, macOS, ChromeOS, Linux, iOS, and Android. Key new features include domain-based split tunneling, include-only split tunneling, and improved private domain DNS resolution. The agent is built with a shared Rust daemon for cross-platform code reuse and leverages BoringTun for its WireGuard implementation. Deployment and configuration can be automated via APIs and Terraform.
9/25/2019
This post details the technical challenges encountered during the development of Cloudflare WARP, focusing on its network infrastructure and the impact of dynamic IP and port changes on ECMP routing. It explains how Cloudflare's network uses Anycast IP addresses and ECMP routing, balancing traffic across servers based on a combination of source IP, source port, destination IP, and destination port. The post highlights how WARP's reliance on persistent TCP/TLS sessions was disrupted by frequent changes in source IP (due to cellular to Wi-Fi switches) and source port (due to NAT). It introduces Network Address Translation (NAT) as a mechanism that rewrites source ports, further contributing to the dynamic nature of traffic routing and the challenges faced by WARP in maintaining consistent server connections.
9/25/2019
This post announces the public release of WARP and WARP+, a mobile app that secures all of a phone's Internet traffic using Cloudflare's global network and the WireGuard protocol. It details the technical challenges encountered during development, including iOS network stack changes, the complexity of mobile carrier networks, and dynamic routing with Anycast. The post highlights the invention of new technologies to maintain session state under these conditions and introduces WARP+ as a premium offering leveraging Cloudflare's Argo network for enhanced speed and encryption. It also reiterates Cloudflare's commitment to user privacy.
3/27/2019
This post introduces BoringTun, a new userspace implementation of the WireGuard protocol written in Rust. It details the rationale for choosing Rust over Go and C/C++ for performance and safety, compares it to existing WireGuard implementations (kernel module, wireguard-go, TunSafe), and outlines the project's goals and licensing. The post also mentions the internal security review and welcomes community contributions.
11/14/2017
This post announces the acquisition of Neumob, whose technology speeds up mobile apps, reduces errors on challenging mobile networks, and increases conversions. Cloudflare plans to integrate this technology with its global network to provide global reach for mobile app acceleration and security. The Neumob software changes how mobile apps interact with APIs by sending requests across optimized protocols to the nearest Cloudflare data center, which then optimizes the route to the origin server. This acquisition is part of a larger plan to extend Cloudflare's network to devices and servers, securing and accelerating communication from any end device to origin servers.
9/28/2017
This post introduces Cloudflare Warp (later renamed Argo Tunnel), a tunneling protocol based on HTTP/2. It aims to provide an easier and more secure way to connect origin servers to the Cloudflare network, punching through firewalls and NAT. It leverages HTTP/2's multiplexing and HPACK header compression for efficiency and uses Go for cross-compilation of the agent. It integrates with Cloudflare's Anycast network via Argo for optimized routing to the origin and provides redundancy through multiple tunnel connections to different PoPs. It also integrates with Load Balancing for origin health monitoring.