Skip to content
NodeKAT Documentation

WARP Device Onboarding

Cloudflare WARP is a secure, fast, and reliable way to connect devices to your network and access NodeKAT from anywhere.

What is WARP?

Section titled “What is WARP?”

WARP replaces traditional VPNs with a modern, zero-trust approach:

  • Automatic Connection: Devices connect securely without manual VPN configuration
  • Zero Trust Security: Every request is authenticated and authorized
  • Split Tunneling: Control which traffic goes through WARP
  • Device Posture: Enforce device compliance policies
  • Global Network: Leverage Cloudflare’s edge network for fast connections

Prerequisites

Section titled “Prerequisites”
  • Cloudflare Zero Trust account
  • Device enrollment permissions configured
  • WARP client installed on devices
  • Cloudflare Access policies set up (see Access Policies guide)

Setting Up WARP

Section titled “Setting Up WARP”

Step 1: Configure Device Enrollment

Section titled “Step 1: Configure Device Enrollment”
  1. Go to Zero Trust → Settings → WARP Client
  2. Under Device enrollment, click Manage
  3. Create an enrollment policy:
Rule name: Allow Company Devices
Action: Allow
Include:
  - Email domain: yourcompany.com
Require:
  - Device Posture: OS version (optional)
  1. Copy the Team name shown in the settings

Step 2: Configure Device Settings

Section titled “Step 2: Configure Device Settings”

Set WARP mode:

Gateway with WARP+ (Recommended):

  • All traffic encrypted and routed through Cloudflare
  • DNS filtering enabled
  • Additional DDoS protection

Gateway only:

  • Only DNS traffic goes through Cloudflare
  • Lighter resource usage

Configure in Zero Trust → Settings → WARP Client → Device settings

Step 3: Install WARP Client

Section titled “Step 3: Install WARP Client”

Download from App Store or install via Homebrew:

Terminal window
brew install --cask cloudflare-warp

Step 4: Enroll Device

Section titled “Step 4: Enroll Device”
  1. Open WARP client
  2. Click the gear/settings icon
  3. Select Account → Login with Cloudflare Zero Trust
  4. Enter your Team name (from Step 1)
  5. Authenticate with your identity provider
  6. Wait for “Connected” status

Device Posture Checks

Section titled “Device Posture Checks”

Configure requirements devices must meet to connect:

Create Posture Rules

Section titled “Create Posture Rules”
  1. Go to Zero Trust → Settings → Device posture
  2. Click Add new
  3. Select rule type:

Operating System Version:

Rule name: macOS Current
OS: macOS
Version: 13.0
Operator: Greater than or equal

Disk Encryption:

Rule name: Disk Encrypted
Check: Disk encryption

Firewall:

Rule name: Firewall Enabled
Check: Firewall

Apply to Access Policies

Section titled “Apply to Access Policies”

Use posture checks in Access policies:

Action: Allow
Include:
  - Email domain: yourcompany.com
Require:
  - Device Posture: macOS Current
  - Device Posture: Disk Encrypted

Split Tunnel Configuration

Section titled “Split Tunnel Configuration”

Control which traffic goes through WARP:

Include Mode (Default)

Section titled “Include Mode (Default)”

All traffic goes through WARP except excluded domains.

Exclude domains that don’t need WARP:

Domain: zoom.us
Domain: meet.google.com

Exclude Mode

Section titled “Exclude Mode”

Only specified traffic goes through WARP.

Include only internal domains:

Domain: internal.company.com
Domain: nodekat.company.com
IP range: 10.0.0.0/8

Configure in Zero Trust → Settings → WARP Client → Split Tunnels

Managed Network Detection

Section titled “Managed Network Detection”

Automatically disable WARP when on trusted networks:

  1. Go to Zero Trust → Settings → WARP Client
  2. Under Managed networks, click Add new
  3. Configure:
Network name: Office Network
Network mask: 192.168.1.0/24

When devices detect this network, WARP can automatically disconnect.

Advanced Configuration

Section titled “Advanced Configuration”

DNS Policies

Section titled “DNS Policies”

Block malicious domains with DNS filtering:

  1. Go to Zero Trust → Gateway → DNS policies
  2. Create policy:
Rule name: Block Malware
Action: Block
Selector: Security categories
Operator: in
Value: Malware, Phishing

HTTP Policies

Section titled “HTTP Policies”

Filter web traffic:

Rule name: Block Social Media
Action: Block
Selector: Application
Operator: in
Value: Facebook, Twitter, Instagram

Network Policies

Section titled “Network Policies”

Restrict network access:

Rule name: Allow Internal Only
Action: Allow
Selector: Destination IP
Operator: in
Value: 10.0.0.0/8, 172.16.0.0/12

Troubleshooting

Section titled “Troubleshooting”

WARP Won’t Connect

Section titled “WARP Won’t Connect”
  1. Check internet connectivity
  2. Verify enrollment policy allows your email
  3. Try switching WARP modes (Gateway vs Gateway with WARP+)
  4. Review WARP client logs

View Logs:

  • macOS: ~/Library/Logs/Cloudflare/
  • Windows: %LOCALAPPDATA%\Cloudflare\
  • Linux: /var/log/cloudflare-warp/

Slow Performance

Section titled “Slow Performance”
  1. Check if Gateway with WARP+ is needed, or if Gateway only suffices
  2. Add streaming services to split tunnel exclusions
  3. Test connection to Cloudflare edge: cloudflare.com/cdn-cgi/trace

Device Posture Failures

Section titled “Device Posture Failures”
  1. Verify device meets all requirements (OS version, encryption, etc.)
  2. Check WARP client is up to date
  3. Review posture check details in Access logs

Can’t Access Internal Resources

Section titled “Can’t Access Internal Resources”
  1. Verify split tunnel includes internal IPs/domains
  2. Check Access policies allow your device/email
  3. Ensure WARP shows “Connected” status

Monitoring Device Status

Section titled “Monitoring Device Status”

View Connected Devices

Section titled “View Connected Devices”
  1. Go to Zero Trust → My Team → Devices
  2. See all enrolled devices
  3. Filter by user, OS, or connection status

Device Analytics

Section titled “Device Analytics”

Track:

  • Unique devices per day
  • OS distribution
  • Version compliance
  • Failed posture checks

Best Practices

Section titled “Best Practices”
  1. Require latest client version in enrollment policies
  2. Enable device posture checks for security requirements
  3. Use managed networks to reduce VPN usage in office
  4. Configure split tunnels to optimize performance
  5. Monitor device compliance regularly
  6. Automate client updates where possible

Command Line Reference

Section titled “Command Line Reference”

macOS/Linux

Section titled “macOS/Linux”
Terminal window
# Check status
warp-cli status


# Connect
warp-cli connect


# Disconnect
warp-cli disconnect


# Enable/disable
warp-cli enable-wifi
warp-cli disable-wifi


# Reset
warp-cli disconnect && warp-cli connect


# Debug mode
warp-cli debug-dex

Windows (PowerShell)

Section titled “Windows (PowerShell)”
Terminal window
# Check status
& "$env:LOCALAPPDATA\Cloudflare\warp-cli.exe" status


# Connect
& "$env:LOCALAPPDATA\Cloudflare\warp-cli.exe" connect

Next Steps

Section titled “Next Steps”