The Multi-OS Installation Guide — macOS & Linux

Prerequisites & Pre-Flight Checklist
macOS Installation Path
Linux Installation Path
Cross-Platform Verification & Testing
Troubleshooting Common Installation Issues
Use Cases: Real-World Deployment Scenarios
Next Steps

1. Prerequisites & Pre-Flight Checklist

Before installing WARP on any platform, verify the following:

General Requirements

Internet connectivity without an active proxy (WARP will handle proxying after installation)
Administrator/root privileges — WARP requires installing system-level network extensions and daemons
No conflicting VPN software — Uninstall or fully disable other VPN clients (NordVPN, ExpressVPN, Cisco AnyConnect, Tailscale, etc.) before installation. WARP may conflict with other tunnel interfaces.
Firewall whitelist — If your network has strict outbound filtering, ensure the following destinations are allowed:
- IPv4 API endpoints: 162.159.137.105 and 162.159.138.105
- IPv6 API endpoints: 2606:4700:7::a29f:8969 and 2606:4700:7::a29f:8a69
- SNI hostnames: api.devices.cloudflare.com (client version 2026.6.0+)

macOS-Specific Requirements

macOS 11 (Big Sur) or later
Apple Silicon (M1/M2/M3/M4) or Intel Mac
~150 MB free disk space

Linux-Specific Requirements

A supported distribution (see sections below for version compatibility)
systemd (for service management)
For RHEL 9/CentOS Stream 9: EPEL repository must be enabled (mandatory for tray icon and captive portal webview dependencies)

2. macOS Installation Path

macOS users have two main ways to install WARP: the official GUI installer or Homebrew Cask. Both install the same app, but Homebrew is better for developers, automation, and fleet management.

2.1 Method A: GUI Installer (Recommended for Most Users)

This is the simplest path for individual users who prefer a visual, wizard-driven installation.

Step 1: Download the Installer

Navigate to the official Cloudflare WARP download page and download the macOS .pkg installer. As of July 2026, the current stable version is 2026.4.1350.0 (released May 11, 2026, 133 MB). Alternatively, use this direct terminal command:

bash

curl -L -o Cloudflare_WARP.pkg "https://downloads.cloudflareclient.com/v1/download/macos/Cloudflare_WARP.pkg"

Step 2: Run the Installer

Double-click the downloaded .pkg file, or install via terminal:

bash

sudo installer -pkg Cloudflare_WARP.pkg -target /

Step 3: Launch WARP

The installer places the application at /Applications/Cloudflare WARP.app. Launch it via Spotlight, Launchpad, or terminal:

bash

open "/Applications/Cloudflare WARP.app"

Step 4: Accept the Privacy Policy

On first launch, WARP will display Cloudflare’s privacy policy. Select Next and then Accept to proceed.

Step 5: Enable WARP

Click the toggle switch to enable WARP. The app connects to the nearest Cloudflare edge.

2.2 Method B: Homebrew Cask (Recommended for Developers & Automation)

Homebrew is the de facto package manager for macOS. Installing WARP via Homebrew Cask ensures version tracking, easy upgrades, and scriptable deployment.

Prerequisite: Install Homebrew

If Homebrew is not installed:

bash

/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"

Step 1: Install WARP via Homebrew Cask

bash

brew install --cask cloudflare-warp

As of July 2026, Homebrew serves version 2026.4.1390.0 (current stable). The Cask also tracks a beta channel (cloudflare-warp@beta) for users who want early access to new features.

Step 2: Verify Installation

bash

brew list --cask | grep cloudflare-warp

Expected output:

plaintext

cloudflare-warp

Step 3: Upgrade WARP

Homebrew makes updates trivial:

bash

brew upgrade --cask cloudflare-warp

Note: A known issue is that Homebrew-managed WARP may fail to auto-update via the app’s built-in updater. If you hit update failures, use brew upgrade --cask cloudflare-warp or brew upgrade --greedy to force a refresh. This is a Homebrew sandboxing limitation, not a WARP bug.

Step 4: Launch and Configure

bash

open "/Applications/Cloudflare WARP.app"

2.3 Post-Installation: System Extensions & Permissions

Modern macOS versions (Big Sur and later) require explicit user approval for system network extensions. WARP installs a network extension to intercept and encrypt traffic.

What You Will See:

After launching WARP for the first time, macOS shows a security dialog: “Cloudflare WARP” wants to add VPN configurations. Click Allow and authenticate with your system password or Touch ID.

If the Dialog Was Missed or Blocked:

Open System Settings (or System Preferences on older macOS)
Go to Privacy & Security → Security
Look for a message about blocked system extensions from “Cloudflare, Inc.”
Click Allow
You may need to restart WARP or your Mac for the extension to activate

Verifying the Network Extension:

bash

systemextensionsctl list | grep -i cloudflare

You should see an active extension entry for com.cloudflare.1dot1dot1dot1.macos.network-extension.

2.4 First-Time Configuration & Verification

Set the Operating Mode

WARP supports two primary modes on macOS:

WARP Mode (default): Full-tunnel encryption — all traffic goes through Cloudflare’s network, including DNS.
1.1.1.1 Mode (DNS-only): Only DNS queries are encrypted and sent to Cloudflare. Regular traffic bypasses the tunnel.

To switch modes:

Click the WARP icon in the menu bar
Select the cog icon → Preferences
Under Connection, choose your preferred mode

Verify the Connection

Open a terminal and run:

bash

curl https://www.cloudflare.com/cdn-cgi/trace

Look for warp=on in the output. If you see warp=off, the tunnel is not active.

Check Your Public IP

bash

curl -s https://api.ipify.org

The returned IP should belong to Cloudflare’s network, not your ISP.

3. Linux Installation Path

Linux deployment is more nuanced than macOS because the ecosystem is fragmented across distributions, package managers, and desktop environments. This section covers the three major families: Debian/Ubuntu (apt), RHEL/CentOS (dnf/yum), and Fedora.

3.1 Understanding the Linux Landscape: CLI vs. GUI

As of 2026, Cloudflare has significantly improved the Linux experience:

CLI-First: The warp-cli command-line interface is the primary Linux interface. It provides full control over registration, connection, modes, and advanced settings.
New GUI (2026): Starting with version 2025.8.779.0 (October 2025), Cloudflare introduced the Cloudflare One Client UI for Linux — a native graphical interface with a system tray icon, right-click context menu, and built-in captive portal support. This is now available in stable releases 2026.2+.
Daemon Architecture: Regardless of GUI or CLI usage, the core engine is the warp-svc systemd service (/bin/warp-svc). The GUI (/bin/warp-taskbar) is merely a frontend that communicates with this daemon.

Important: If you previously installed WARP via the old repository method and want the new GUI, you may need to uninstall the old package and install the new Cloudflare One Client package. The old cloudflare-warp CLI-only package and the new cloudflare-one-client package may coexist or conflict depending on your distribution.

3.2 Ubuntu & Debian (apt-based) — Step-by-Step

Supported Versions (as of July 2026):

Debian 13 (Trixie), Debian 12 (Bookworm), Debian 11 (Bullseye)
Ubuntu 24.04 LTS (Noble Numbat), Ubuntu 22.04 LTS (Jammy Jellyfish), Ubuntu 20.04 LTS (Focal Fossa)
Non-LTS Ubuntu versions (23.04+, 25.04+) may require repository alias workarounds

Step 1: Add the Cloudflare GPG Key

CRITICAL: If you added the GPG key before September 12, 2025, you MUST update it. The old key was deprecated and will be removed on April 30, 2026. Packages signed with the old key will fail to install or update after December 4, 2025.

bash

# Ensure the keyrings directory exists
sudo mkdir -p --mode=0755 /usr/share/keyrings

# Download and install the current GPG key
curl -fsSL https://pkg.cloudflareclient.com/pubkey.gpg | \
  sudo gpg --yes --dearmor --output /usr/share/keyrings/cloudflare-warp-archive-keyring.gpg

Step 2: Add the APT Repository

For supported LTS versions (recommended):

bash

echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/cloudflare-warp-archive-keyring.gpg] https://pkg.cloudflareclient.com/ $(lsb_release -cs) main" | \
  sudo tee /etc/apt/sources.list.d/cloudflare-client.list

For non-LTS Ubuntu versions (e.g., 23.04 Lunar, 25.10 Questing Quokka):

Cloudflare’s official repository only provides builds for LTS releases. If lsb_release -cs returns a codename with no matching repository, you’ll get a 404 error. The workaround is to alias the repository to the nearest LTS:

bash

# For Ubuntu 23.04/25.10 (based on Debian Bookworm), use the Noble (24.04) repository:
echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/cloudflare-warp-archive-keyring.gpg] https://pkg.cloudflareclient.com/ noble main" | \
  sudo tee /etc/apt/sources.list.d/cloudflare-client.list

Why this works: WARP has minimal system dependencies. Using a nearby LTS repository is generally safe because the package is largely self-contained. However, you will not receive automatic updates specific to your non-LTS release — monitor the official repository for new LTS support.

Step 3: Update Package Lists and Install

bash

sudo apt-get update
sudo apt-get install cloudflare-warp

Step 4: Enable and Start the Service

bash

sudo systemctl enable --now warp-svc

Verify the service is running:

bash

sudo systemctl status warp-svc

Expected output shows Active: active (running).

Step 5: Register and Connect

bash

# Accept Terms of Service and register a new identity
warp-cli registration new

# Set mode to full WARP tunnel (default is often Zero Trust mode, which requires an org)
warp-cli mode warp

# Connect
warp-cli connect

# Verify status
warp-cli status

You should see output like:

plaintext

Status update: Connected
Success

Step 6: Verify the Tunnel

bash

curl https://www.cloudflare.com/cdn-cgi/trace | grep warp

Expected: warp=on

3.3 RHEL 9 & CentOS Stream 9 (dnf/yum-based) — Step-by-Step

RHEL 9 represents a significant shift in the Linux enterprise landscape. Cloudflare added official RHEL 9 support in late 2025, but with a critical caveat: the EPEL repository is mandatory.

The EPEL Requirement Explained

RHEL 9’s minimal base installation lacks several GUI and web rendering libraries that WARP’s new Linux UI depends on — specifically, components for the system tray icon and the captive portal webview window. The Extra Packages for Enterprise Linux (EPEL) repository provides these dependencies.

Without EPEL enabled:

The cloudflare-warp package may fail to install due to missing dependencies
The tray icon will not appear
The captive portal detection (used on hotel/airport Wi-Fi) will not function

Step 1: Enable EPEL Repository

bash

# For RHEL 9
sudo dnf install https://dl.fedoraproject.org/pub/epel/epel-release-latest-9.noarch.rpm

# For CentOS Stream 9, EPEL is typically already available or can be enabled via:
sudo dnf config-manager --set-enabled crb
sudo dnf install epel-release

Step 2: Update the GPG Key (If Previously Installed)

If you had WARP installed before September 2025, remove the old key and import the new one:

bash

sudo rpm -e 'gpg-pubkey(4fa1c3ba-61abda35)' && \
sudo rpm --import https://pkg.cloudflareclient.com/pubkey.gpg

Step 3: Add the Cloudflare Repository

bash

curl -fsSL https://pkg.cloudflareclient.com/cloudflare-warp-ascii.repo | \
  sudo tee /etc/yum.repos.d/cloudflare-warp.repo

Step 4: Install WARP

bash

sudo dnf update
sudo dnf install cloudflare-warp

Step 5: Enable, Register, and Connect

bash

sudo systemctl enable --now warp-svc
warp-cli registration new
warp-cli mode warp
warp-cli connect
warp-cli status

Step 6: Verify

bash

curl https://www.cloudflare.com/cdn-cgi/trace | grep warp

3.4 Fedora Linux — Step-by-Step

Fedora has excellent native support for WARP. The process is similar to RHEL but without the EPEL requirement because Fedora’s repositories are already comprehensive.

Supported Versions: Fedora 43, Fedora 44 (as of July 2026)

Step 1: Update GPG Key (If Needed)

bash

sudo rpm -e 'gpg-pubkey(4fa1c3ba-61abda35)' && \
sudo rpm --import https://pkg.cloudflareclient.com/pubkey.gpg

Step 2: Add Repository

bash

curl -fsSL https://pkg.cloudflareclient.com/cloudflare-warp-ascii.repo | \
  sudo tee /etc/yum.repos.d/cloudflare-warp.repo

Step 3: Install

bash

sudo dnf update
sudo dnf install cloudflare-warp

Step 4: Start and Register

bash

sudo systemctl enable --now warp-svc
warp-cli registration new
warp-cli mode warp
warp-cli connect

3.5 The New Linux GUI: Cloudflare One Client UI (2026)

The biggest Linux breakthrough in 2025–2026 is the official graphical interface. Previously, Linux users relied entirely on warp-cli or unofficial third-party Python wrappers. Now, Cloudflare provides a first-party GUI.

What the New GUI Includes:

System Tray Icon: A cloud icon in your desktop panel (GNOME, KDE, XFCE, etc.) showing connection status
Right-Click Context Menu: Quick access to Connect, Disconnect, Preferences, and Quit
Built-in Captive Portal Detection: Automatically opens a browser window when hotel/airport Wi-Fi requires login
Connection Health Indicator: Displays tunnel and DNS health status messages when the network is unstable
Mode Switching: Toggle between WARP, 1.1.1.1 (DNS-only), and Zero Trust modes from the GUI

Installing the GUI Version

The GUI is included in cloudflare-warp packages. After installation, the GUI binary is at /bin/warp-taskbar.

Launching the GUI:

bash

# Method 1: Launch from terminal
warp-taskbar &

# Method 2: Add to autostart (GNOME example)
cp /usr/share/applications/cloudflare-warp.desktop ~/.config/autostart/

# Method 3: For systemd user services (advanced)
systemctl --user enable --now warp-taskbar

Known Limitations of the Linux GUI (as of July 2026):

Split Tunnel Configuration: Managing split tunnel entries (excluding specific IPs or domains from the tunnel) is currently only possible via CLI using warp-cli tunnel ip and warp-cli tunnel host. UI support is planned for a future release.
Registration Hangs: Some users report registration hanging at “Checking your organization configuration” due to IPC errors. A system reboot typically resolves this.
Desktop Environment Compatibility: The tray icon works best on GNOME (with AppIndicator support), KDE Plasma, and XFCE. Pure Wayland environments may require libappindicator or ayatana-indicator compatibility layers.

If You Prefer the CLI Only

You can disable the GUI tray icon and use only warp-cli:

bash

systemctl --user mask warp-taskbar.service
systemctl --user stop warp-taskbar.service

The warp-svc daemon continues running, and warp-cli remains fully functional.

3.6 Headless/Server Deployment: warp-cli Automation

For servers, containers, and CI/CD environments where no GUI is available or desired, warp-cli provides complete programmatic control.

Essential Server Commands:

bash

# Registration (one-time per machine)
warp-cli registration new

# Enable always-on (auto-connect on boot)
warp-cli enable-always-on

# Check current settings
warp-cli settings

# View detailed status
warp-cli status

# Switch protocols (MASQUE is default; WireGuard is alternative)
warp-cli tunnel protocol set MASQUE
warp-cli tunnel protocol set WireGuard

# Enable DNS family filtering
warp-cli dns families malware      # Block malware only
warp-cli dns families full         # Block malware + adult content
warp-cli dns families off          # Disable filtering

# Generate diagnostic bundle
sudo warp-diag

Automated Deployment Script (Bash)

Save this as deploy-warp.sh for unattended server installation:

bash

#!/bin/bash
set -euo pipefail

# Detect distribution
if [ -f /etc/os-release ]; then
    . /etc/os-release
    DISTRO=$ID
else
    echo "Cannot detect distribution. Exiting."
    exit 1
fi

echo "[WARP Deploy] Detected distribution: $DISTRO"

# Install based on distro
case "$DISTRO" in
    ubuntu|debian|linuxmint|pop)
        echo "[WARP Deploy] Installing via apt..."
        sudo mkdir -p --mode=0755 /usr/share/keyrings
        curl -fsSL https://pkg.cloudflareclient.com/pubkey.gpg | \
          sudo gpg --yes --dearmor --output /usr/share/keyrings/cloudflare-warp-archive-keyring.gpg
        echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/cloudflare-warp-archive-keyring.gpg] https://pkg.cloudflareclient.com/ $(lsb_release -cs) main" | \
          sudo tee /etc/apt/sources.list.d/cloudflare-client.list
        sudo apt-get update
        sudo apt-get install -y cloudflare-warp
        ;;
    fedora)
        echo "[WARP Deploy] Installing via dnf..."
        sudo rpm -e 'gpg-pubkey(4fa1c3ba-61abda35)' 2>/dev/null || true
        sudo rpm --import https://pkg.cloudflareclient.com/pubkey.gpg
        curl -fsSL https://pkg.cloudflareclient.com/cloudflare-warp-ascii.repo | \
          sudo tee /etc/yum.repos.d/cloudflare-warp.repo
        sudo dnf install -y cloudflare-warp
        ;;
    rhel|centos|rocky|almalinux)
        echo "[WARP Deploy] Installing via dnf (RHEL/CentOS)..."
        echo "[WARP Deploy] Ensuring EPEL is available..."
        sudo dnf install -y epel-release || \
          sudo dnf install -y https://dl.fedoraproject.org/pub/epel/epel-release-latest-9.noarch.rpm
        sudo rpm -e 'gpg-pubkey(4fa1c3ba-61abda35)' 2>/dev/null || true
        sudo rpm --import https://pkg.cloudflareclient.com/pubkey.gpg
        curl -fsSL https://pkg.cloudflareclient.com/cloudflare-warp-ascii.repo | \
          sudo tee /etc/yum.repos.d/cloudflare-warp.repo
        sudo dnf install -y cloudflare-warp
        ;;
    *)
        echo "[WARP Deploy] Unsupported distribution: $DISTRO"
        exit 1
        ;;
esac

# Enable and start service
sudo systemctl enable --now warp-svc

# Register and connect
warp-cli registration new
warp-cli mode warp
warp-cli connect

# Enable auto-connect
warp-cli enable-always-on

# Verify
echo "[WARP Deploy] Verification:"
curl -s https://www.cloudflare.com/cdn-cgi/trace | grep warp

echo "[WARP Deploy] Installation complete."

Make it executable and run:

bash

chmod +x deploy-warp.sh
sudo ./deploy-warp.sh

4. Cross-Platform Verification & Testing

After installation on any platform, run this verification checklist:

4.1 Basic Connectivity Test

bash

curl https://www.cloudflare.com/cdn-cgi/trace

Expected output includes:

warp=on (tunnel active)
gateway=off (unless using Zero Trust)
ip=xxx.xxx.xxx.xxx (a Cloudflare IP, not your ISP)

4.2 DNS Resolution Test

bash

# Test DNS-over-HTTPS resolution
dig @1.1.1.1 cloudflare.com

# Verify DNS is going through WARP
warp-cli mode --help
# Ensure you are in 'warp' or 'warp+doh' mode

4.3 IP Leak Test

Visit https://1.1.1.1/help in your browser. The page should report:

Connected to 1.1.1.1: Yes
Using DNS over WARP: Yes
Using DNS over HTTPS: Yes (if in DoH mode)
Your IPv4/IPv6 resolvers should NOT be your ISP’s addresses

4.4 Protocol Verification

bash

# Check which tunnel protocol is active
warp-cli tunnel protocol

# Expected: MASQUE (default) or WireGuard

4.5 Service Health Check (Linux)

bash

# View real-time logs
sudo journalctl -u warp-svc -f

# Check for errors
sudo warp-diag
# This generates a ZIP file with logs, config, and diagnostics for support tickets

5. Troubleshooting Common Installation Issues

Issue 1: “404 Not Found” on apt update (Ubuntu/Debian)

Cause: Your distribution codename is not supported by Cloudflare’s repository.
Fix: Alias to the nearest LTS codename (see Section 3.2, Step 2).

Issue 2: GPG Key Errors on apt/dnf

Cause: The old GPG key (pre-September 2025) is still installed.
Fix: Follow the key update steps in Sections 3.2 and 3.3. The old key is deprecated and will be fully removed on April 30, 2026.

Issue 3: RHEL 9 Missing Dependencies (tray icon/webview fails)

Cause: EPEL repository is not enabled.
Fix: sudo dnf install epel-release before installing WARP.

Issue 4: “Registration Failed” or “Already Registered”

Cause: A previous WARP registration exists on the machine.
Fix:

bash

warp-cli registration delete
warp-cli registration new

Issue 5: WARP Connects but `warp=off` in Trace

Cause: The tunnel is established but DNS is not routing through WARP.
Fix:

bash

warp-cli mode warp+doh
warp-cli reconnect

Issue 6: macOS “System Extension Blocked”

Cause: macOS security settings prevented the network extension from loading.
Fix: System Settings → Privacy & Security → Security → Allow Cloudflare, Inc. → Restart WARP.

Issue 7: Conflicting VPN Software

Cause: Another VPN client is holding the tunnel interface.
Fix: Completely uninstall or disable other VPN clients. On Linux, check for existing WireGuard interfaces:

bash

ip link show | grep wg
sudo ip link delete wg0  # if exists

6. Use Cases: Real-World Deployment Scenarios

Use Case 1: The Developer Workstation (macOS + Homebrew)

Scenario: A software engineer manages multiple projects across different cloud providers and needs a consistent, scriptable network security layer.

Deployment:

Install via brew install --cask cloudflare-warp
Add warp-cli connect to .zshrc or a launchd plist for auto-connect
Use warp-cli mode warp+doh to ensure DNS privacy during API development
Leverage warp-cli tunnel host exclude to bypass the tunnel for local Kubernetes clusters (covered in Article 4)

Why This Matters: The Homebrew path integrates with the developer’s existing toolchain. brew bundle can include WARP in a Brewfile, ensuring new team members get identical environments.

Use Case 2: The Linux Server Farm (Ubuntu LTS Headless)

Scenario: A DevOps team runs 50+ Ubuntu 24.04 LTS servers across AWS, GCP, and on-premise. They need encrypted egress and DNS filtering without GUI overhead.

Deployment:

Use the automated deploy-warp.sh script (Section 3.6) via Ansible/Puppet/Chef
Enable warp-cli enable-always-on for persistent protection
Use warp-cli dns families malware for baseline threat filtering
Collect warp-diag outputs centrally for monitoring

Why This Matters: Servers are prime targets for data exfiltration. WARP ensures all outbound DNS and HTTP/S traffic is encrypted and filtered, even on compromised networks. The headless CLI approach means zero GUI resource overhead.

Use Case 3: The Enterprise RHEL 9 Workstation

Scenario: A financial services firm deploys RHEL 9 workstations to traders and analysts. They require WARP for Zero Trust access but also need the GUI for user-friendly operation.

Deployment:

Mandate EPEL activation in the base image
Install WARP via dnf during imaging
Configure the GUI to auto-start via /etc/xdg/autostart/
Enroll into Zero Trust using warp-cli teams-enroll <org-name> (covered in Article 5)

Why This Matters: RHEL 9’s security-hardened environment benefits from WARP’s encrypted tunnel, but the EPEL dependency is non-negotiable for GUI functionality. Pre-configuring this in the golden image prevents helpdesk tickets.

Use Case 4: The Hybrid Cloudflare One Client Migration

Scenario: An organization is migrating from the old cloudflare-warp CLI-only package to the new Cloudflare One Client with GUI.

Deployment:

bash

# 1. Uninstall old package
sudo apt remove cloudflare-warp
sudo rm /etc/apt/sources.list.d/cloudflare-client.list

# 2. Install new Cloudflare One Client
# (Download .deb from official releases page or use updated repository)

# 3. The new package includes both warp-cli and warp-taskbar GUI
# Launch GUI: warp-taskbar &

Why This Matters: The new unified client simplifies support. Users get a visual indicator of connection status, while administrators retain full CLI access for scripting and automation.

7. Next Steps

You now have WARP installed and running on macOS or Linux. In Article 3, we will demystify the four client operation modes — DNS-Only, WARP, Secure Web Gateway, and Posture-Only — explaining what each does, when to use it, and how to switch between them without breaking your network.

Quick Reference: Essential Commands

Command	Purpose
`warp-cli registration new`	Create a new WARP identity
`warp-cli connect`	Activate the tunnel
`warp-cli disconnect`	Deactivate the tunnel
`warp-cli status`	Check connection state
`warp-cli mode warp`	Full tunnel mode
`warp-cli mode doh`	DNS-only mode
`warp-cli mode warp+doh`	Full tunnel + encrypted DNS
`warp-cli tunnel protocol set MASQUE`	Use MASQUE/QUIC (default)
`warp-cli tunnel protocol set WireGuard`	Use WireGuard
`warp-cli enable-always-on`	Auto-connect on boot
`warp-cli dns families malware`	Enable malware filtering
`sudo warp-diag`	Generate diagnostic bundle
`sudo systemctl status warp-svc`	Check daemon health (Linux)