Cloudflare WARP

English | 简体中文

What is WARP?

Cloudflare WARP provides a WireGuard-based outbound through Cloudflare's network. In m-ui it is a Mihomo wireguard outbound, not a system-wide VPN client. It changes the selected proxy traffic's egress path without replacing the server's default route.

WARP can be useful when a destination rejects the server address or when you need a separate Cloudflare egress. It is not a guarantee of a fixed IP, region, or access to every service.

Create a WARP account

1. Open Mihomo Settings → Outbounds.
2. Click WARP. The same dialog is available from Basics → WARP Routing.
3. Click Create and accept the Cloudflare terms.
4. m-ui generates the WireGuard private key locally and sends only the public key to Cloudflare.

The account record is stored in data/state.json and included in normal m-ui backups. Keep backups private.

Add the WARP outbound

After an account exists, click Add Outbound from the WARP dialog. m-ui creates a Mihomo WireGuard outbound using the account endpoint, tunnel addresses, peer public key, and client ID.

Save the Mihomo Settings draft and restart Mihomo. The outbound name is then available as a Routing Rule target.

The WARP button can also be used from Basics. Before a WARP outbound exists it opens the account dialog; after one exists, the WARP Routing field becomes an editable domain-match list.

Route selected domains through WARP

In Mihomo Settings → Basics → Basic Routing → WARP Routing, add values such as:

example.com
full:api.example.com
keyword:stream
geosite:google

m-ui generates rules that target the detected WARP outbound. The rules run below Block IPs and Block Domains and below IPv4 Routing.

For more control, add a rule under Routing Rules and select the WARP outbound as its target.

WARP+ license key

Use More Information or the account's license-key action to update a WARP+ license. The operation uses Cloudflare's consumer API and depends on Cloudflare reachability from the server.

Refresh, reset, and delete

• More Information refreshes the device information from Cloudflare.
• Reset Outbound rebuilds the Mihomo WireGuard entry from the latest account data while preserving its name and references.
• Delete removes the local account record and schedules removal of the WARP outbound and WARP Basic Routing entries from the draft. It does not unregister the device at Cloudflare.

If a policy group or rule still references the WARP outbound, remove that reference before applying the deletion.

Troubleshooting WARP

• If registration times out, verify outbound Internet access and DNS.
• If the UI reports a missing WireGuard configuration, refresh the account and inspect the Cloudflare response.
• If a WARP rule fails validation, add a WARP outbound first or clear the WARP domain list.
• WARP changes require Save and Restart Mihomo.
• WARP does not alter the system route, firewall, or the panel's own connections.

Cloudflare DNS certificates

The Linux management script also uses acme.sh for Cloudflare DNS validation. This is separate from the WARP account. It is useful when a provider blocks port 80 or when you need a wildcard certificate.

Run:

m-ui ssl cloudflare

Choose Cloudflare API Token (recommended) or Global API Key + account email. Scope the token to the target zone with Zone:DNS:Edit and Zone:Zone:Read. The script issues the domain and wildcard certificate, installs it under /root/cert/<domain>/, configures m-ui, and enables renewal.