DEVICE DIAGNOSTICS

Check the route to Cloudflare One

Run these checks from the affected machine with WARP disconnected. Browser requests originate on this machine, not at the Worker. This page does not ask for passwords, service tokens, or machine identifiers.

Scope matters. Browsers cannot test WARP's UDP tunnel, pinned API IPs with SNI, process-specific firewall rules, service-token registration, or inside-tunnel DNS. A browser “reachable” result is only a coarse network signal. The downloadable Windows check covers more of the outside-tunnel requirements.

01 / BROWSER

Quick reachability

The browser cannot read cross-origin response codes. “Reachable” means the request was not reported as a network error; a captive portal, TLS inspection, or different DNS answer can still interfere. Failures can also be caused by browser privacy controls.

No checks run yet.

02 / WINDOWS

Local firewall preflight

Download PowerShell

The script checks DNS and TCP 443 to Cloudflare’s documented pinned API IPs, while verifying HTTPS with the right hostname. It also tests Kaplan Access, the outside-tunnel endpoint, captive portal sites and an NTP response. UDP tunnel ports are listed as unverified: sending a UDP packet cannot demonstrate that the protocol works.

Run it locally in PowerShell with powershell.exe -NoProfile -File .\cloudflare-one-preflight.ps1. No administrator rights required. Inspect the script first if your endpoint policy requires it. Output is not uploaded; redact public IPs/identifiers before sharing.

03 / NEXT

If these checks pass

Inspect warp-diag, client version, device clock, and the actual registration response. Cloudflare’s firewall requirements include MASQUE UDP 443 / WireGuard UDP 2408 and executable-scoped allowances that this website cannot validate. Do not interpret a successful browser check as proof of WARP enrollment.