How to build your own VPN, or: the history of WARP

Cloudflare’s post on 29 October 2025 recounts how WARP began as a high-performance VPN built into the Linux networking stack to securely egress arbitrary user packets from edge machines for millions of mobile clients. The initial solution resembled a Layer 3 VPN, with IP packets tunneled to a VPN server, and it relied on Linux’s Netfilter with nftables or iptables to implement NAT and routing between the VPN client and the Internet.

A key step was using a TUN device, Linux’s virtual network device, to bring IP packets into the kernel’s networking stack, while conntrack managed a stateful firewall and helped apply NAT rules. The article describes how the team marked packets and wrote rules in nftables to distinguish WARP traffic from local traffic, enabling separate firewall policies and routing decisions. It notes that the code powering WARP was written in Rust, and that boringtun and MASQUE were important components in the implementation.

Finally, to scale beyond a single IPv4 address per machine, the piece explains the cost and operational drivers behind moving away from one-address-per-machine designs, foreshadowing a follow-up post.