20
[SOLVED] Is there any (known) way to use warp-cli without blocking incoming connections? (sh.itjust.works)
submitted 1 week ago* (last edited 1 week ago) by testaccount789@sh.itjust.works to c/selfhosted@lemmy.world
4 comments fedilink hide all child comments

Edit: Even with 0.0.0.0/0 split tunnel the interface stays active, which can be verified using curl --interface CloudflareWARP ipinfo.io.
So I can just set-up PBR and NAT:

iptables -t nat -A POSTROUTING -s VPN_IP_RANGE ! -d VPN_IP_RANGE -j SNAT --to-source 172.16.0.2
ip rule add from VPN_IP_RANGE table TABLE_ID
ip route add default dev CloudflareWARP table TABLE_ID
ip route add VPN_IP_RANGE dev VPN_INTERFACE # to keep connection between devices

warp-cli is Cloudflare's program to use their Warp VPN/DNS thingy. Since it only allows for closest server being used, I thought about putting it on my VPS.

So I did. I enabled the connection, and oh, SSH froze. No worries, I'll reconnect.
Unless... Yeah, it blocks incoming connections.
Tailscale comes to rescue.

But anyway, the warp-cli settings only allow excluding IP ranges for both directions, so 0.0.0.0/0 makes it pointless.
My only current idea is caveman solution - another VPS (for static IP) as first hop, excluding just that IP on second hop, for third hop to Warp.
Sadly, RackNerd has finally removed all the old offers, so no more $10.29/year VPSs.

Oh, and Tailscale will only work over relay when Warp is connected, so that's not an option.

top 4 comments
sorted by: hot top new old
[-] irmadlad@lemmy.world 3 points 1 week ago

Dumbass here....why would a VPN block incoming connections? Seems counter to what a VPN does.

[-] testaccount789@sh.itjust.works 3 points 1 week ago

The Cloudflare bit, at least their consumer product in question only works as a public VPN (such as Mullvad, IVPN, etc...), meaning it's more of an encrypted proxy. So it doesn't counter anything.
Why it blocks incoming connections on other interfaces ¯⁠\⁠_⁠(⁠ツ⁠)⁠_⁠/⁠¯
It only makes sense for it to capture all outgoing connections not destined to split-tunneled IP ranges, as to prevent leaks.

[-] irmadlad@lemmy.world 1 points 1 week ago

Weird

[-] Dran_Arcana@lemmy.world 1 points 1 week ago

Microvms or containers could give you external control of the networking. Then you would put whatever you want behind warp inside the warp container/vm.

this post was submitted on 06 May 2026
20 points (91.7% liked)

Selfhosted

59249 readers
1199 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

  1. Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.

  2. No spam posting.

  3. Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.

  4. Don't duplicate the full text of your blog or github here. Just post the link for folks to click.

  5. Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).

  6. No trolling.

  7. No low-effort posts. This is subjective and will largely be determined by the community member reports.

Resources:

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 2 years ago
MODERATORS
ruud@lemmy.world
Loki@lemmy.world
CannaVet@lemmy.world
devve@lemmy.world
HybridSarcasm@lemmy.world
HybridSarcasm@lemmy.hybridsarcasm.xyz