By default, Cloudflare WARP does not provide a static IP address
. WARP is designed as a consumer VPN/DNS service that assigns dynamic IP addresses from Cloudflare's shared edge network to improve privacy and performance.
If your development workflow requires a static IP while using the Cloudflare network, you must use Cloudflare Zero Trust
(specifically the Gateway and Zero Trust Client) rather than the standard consumer WARP application. 1. The Zero Trust Approach (Recommended) cloudflare warp static ip
To achieve a fixed egress IP for your development environment or team, you need to configure Dedicated Egress IPs , which is an Enterprise-level feature. Requirements : A Cloudflare Zero Trust account and an Enterprise plan.
Onboard your devices to the Cloudflare Zero Trust dashboard. Purchase a dedicated IPv4/IPv6 range from Cloudflare. Navigate to Gateway > Egress Policies
Create a policy that assigns your specific "Dedicated IP" to traffic originating from your developer's identity or device group. 2. The "Fixed IP" Workaround for Developers By default, Cloudflare WARP does not provide a
If you are on a Free or Team plan and simply need a way to allowlist your WARP traffic on a remote server (like an AWS EC2 instance or a database), use Cloudflare Access instead of IP allowlisting: Step 1: Install cloudflared
: Run the Cloudflare Tunnel daemon on your destination server. Step 2: Create a Tunnel
: Connect your server to the Cloudflare edge without opening any inbound firewall ports. Step 3: Define Access Policies Onboard your devices to the Cloudflare Zero Trust dashboard
: In the Zero Trust dashboard, create an application for your server. Step 4: Authenticate : When you turn on WARP, your device is identified by your User Identity
(email/SAML), not its IP. Your server will recognize your identity and grant access, rendering the "Static IP" requirement obsolete. 3. Verification Commands
To check your current egress IP and see if it remains consistent during your dev session, use the following terminal commands: Check WARP Status warp-cli status Check Egress IP curl https://cloudflare.com Look for the line to see your current edge address. to confirm the tunnel is active. Summary of Differences Standard WARP Cloudflare Zero Trust Shared Dynamic Dedicated Static (Optional) Primary Use Privacy/Encryption Secure Corporate Access Free / $4.99 (WARP+) Free tier available; Static IP requires Enterprise Cloudflare Tunnel to bypass the need for a static IP entirely?
Simply owning the IP isn't enough; you must tell Cloudflare who gets to use it.
If you host your own server at home with a dynamic IP, you can use cloudflared to create a Tunnel. That tunnel will give you a static Cloudflare hostname, but not a static IP for outgoing requests. This helps inbound connections, not outbound egress.