Selective Cloudflare WARP routing for Linux VPSs.
Route only the services you choose through Cloudflare WARP while everything else continues using your server's public IP.
No Docker • Pure Bash • Zero changes to your tunnel or proxy configuration
Telegram: @BlackProtocols
- Route only selected services through Cloudflare WARP
- Keep all other traffic on the server's native IP
- Domain-based routing using TLS SNI and QUIC ClientHello
- 100+ built-in providers across multiple categories
- Custom domains
- Global ad blocker (uBlock Origin filter lists + sing-box rules)
- Automatic WARP IP health monitoring
- Automatic route refresh and scheduled restart
- WARP+ license support
- Import / Export presets
- Interactive CLI
- Fail-open protection
- HTTP/3 (QUIC) support
- Pure Bash
- No Docker
- No changes to Xray, Marzban, Hiddify, OpenVPN, WireGuard or your existing tunnel
Ubuntu / Debian
sudo bash -c "$(curl -fsSL https://raw.githubusercontent.com/AminMGMT/WARP-Manager/main/setup.sh)"The installer downloads everything, prepares WARP, installs all required components and opens the interactive menu automatically.
Or install manually:
git clone https://github.com/AminMGMT/WARP-Manager.git
cd WARP-Manager
sudo bash install.shInstallation progress:
Installing Dependencies [################################] 100%
Copying Files [################################] 100%
Preparing WARP [################################] 100%
Generating Profile [################################] 100%
WARP is Ready → sudo wm
After installation a small AI preset is enabled automatically, allowing services such as ChatGPT, Gemini, Claude, Copilot, Grok and Perplexity to work immediately. Everything else can be enabled from the menu with a few keystrokes.
Many VPS providers are unable to access certain services such as Gemini, while others may be rate-limited or geo-restricted. Sending all traffic through Cloudflare WARP solves this, but it also changes the server's exit IP for everything, which is often undesirable.
WARP Manager solves this by routing only the services you choose through Cloudflare WARP while every other connection continues to use the VPS's normal public IP.
Your existing tunnel, proxy and panel remain completely untouched.
Client
│
(Tunnel / VPN / Proxy)
│
▼
┌────────────────────────────── VPS ──────────────────────────────┐
│ │
│ Outbound TCP 80/443 + UDP 443 │
│ │ │
│ ▼ │
│ nftables TPROXY │
│ │ │
│ ▼ │
│ sing-box Engine │
│ (TLS SNI + QUIC Inspection) │
│ │ │
│ ┌─────────────┴─────────────┐ │
│ │ │ │
│ Selected Services Everything Else │
│ │ │ │
│ ▼ ▼ │
│ Cloudflare WARP Native Server IP │
│ │
└─────────────────────────────────────────────────────────────────┘
WARP Manager intercepts only the VPS's outbound HTTPS traffic using nftables TPROXY and forwards it to sing-box running locally.
Instead of routing by IP address, sing-box inspects the real destination domain from the TLS Server Name Indication (SNI) and QUIC ClientHello. This makes routing reliable even for modern applications that frequently change IP addresses or use CDNs.
When a connection matches one of the selected providers, it is forwarded through the Cloudflare WARP WireGuard interface. Every other connection bypasses WARP and leaves through the VPS's normal network interface.
Because routing is based on domains rather than destination IPs, applications continue to work correctly even when their backend infrastructure changes.
Application
│
▼
Is the destination selected?
│
┌───┴──────────────┐
│ │
▼ ▼
Yes No
│ │
▼ ▼
Cloudflare WARP Direct Internet
- Route only the traffic that actually needs WARP.
- Leave existing tunnels, proxies and panels untouched.
- No Docker containers.
- No DNS hijacking.
- No public listening ports.
- Fully automatic installation.
- Safe fail-open behavior if the routing engine becomes unavailable.
- Support both HTTP/2 and HTTP/3 (QUIC).
- Keep the configuration simple enough to migrate between servers.
Start WARP Manager:
sudo wm
# or
sudo warp-managerMain menu:
1. WARP ● ON
1. Choose Services
2. Custom Domains
3. White Lists
4. Connection
1. Change IP
2. Auto IP Health
3. QUIC Handling
5. Automation
1. Auto Restart
2. Refresh Routes
6. Presets
1. Export Preset
2. Import Preset
3. Import WARP Account
7. WARP+ License
8. Status
9. Restart WARP
2. Ad Blocker ○ OFF
3. Restart All Services
4. Update
5. Uninstall
6. Exit
All WARP-related features are grouped under a single menu.
Select which services should use Cloudflare WARP.
Over 100 providers are available across multiple categories, including AI, Streaming, Social Media, Gaming, Developer Tools and more.
Example:
Choose Services 21 of 105 selected
1. ◐ AI
2. ○ Music
3. ○ Social Media
4. ○ Messaging
5. ○ Streaming
...
a Select All
n Select None
i Invert Selection
0 Apply & Back
Supported input formats:
3
1 5 9
2-7
Categories containing a single provider (such as All Google Services) toggle immediately without opening a submenu.
Add any domain that is not included in the built-in provider database.
Example:
example.com
api.example.com
Domains that should never be blocked by the Ad Blocker.
Useful when a website or application requires a tracking or analytics domain to function correctly.
Manage the WARP tunnel itself.
- Change WARP IP
- Automatic IP Health Monitoring
- QUIC (HTTP/3) Handling
Automate common maintenance tasks.
- Scheduled WARP restart
- Route refresh
These features help keep long-running servers healthy without manual intervention.
Move your entire configuration between servers.
A preset includes:
- Selected services
- Custom domains
- White list
- Ad Blocker settings
- QUIC mode
- Auto Restart
- Auto IP Health
- Optional WARP+ license
Export a preset on one server and import it on another to recreate the same configuration within seconds.
Apply or replace your Cloudflare WARP+ license.
The license is preserved when changing WARP IPs.
Display the current system status, including:
- WARP state
- WARP IP
- Location
- Selected services
- Engine status
- Ad Blocker status
Restarts only the WARP interface and rebuilds the routing engine.
Blocks ads and trackers using uBlock Origin's filter lists - the same catalogue uBlock ships, with the same nine lists enabled by default, plus its optional and regional lists (71 in total, selectable from the menu).
Only the domain-expressible rules are used. sing-box sees the domain of each
connection (TLS SNI / QUIC) and never the URL path or the page DOM, so cosmetic
filters (##selector) and scriptlets (##+js) cannot apply server-side. That
still captures 85% of uBlock's network filters - about 105,000 domains from
the default set, or ~128,000 with the optional lists on.
A domain a selected service needs is never blocked: every provider domain is subtracted from the block list at build time, and the ad rule is evaluated after the routing rules.
Runs locally with no DNS server and no additional services.
Restarts every WARP Manager component, including:
- WARP
- sing-box
- nftables rules
- Background timers
Downloads and installs the latest version while preserving your existing configuration.
Completely removes WARP Manager, WARP, configuration files and system services.
WARP Manager includes more than 100 predefined services organized into practical categories.
Simply select the services you want from the interactive menu — no manual routing rules are required.
| Category | Providers |
|---|---|
| 🤖 AI | ChatGPT, Gemini, Claude, Cursor, Copilot, Grok, Perplexity, Midjourney, ElevenLabs, Runway, Suno, Udio, Windsurf and more |
| 🎵 Music | Spotify, Apple Music, YouTube Music, SoundCloud, Tidal, Deezer, Bandcamp, Amazon Music and more |
| 🌐 Social Media | X, Instagram, Threads, TikTok, Facebook, Reddit, Pinterest, Bluesky and more |
| 💬 Messaging | Telegram, Discord, WhatsApp, Signal, LINE, WeChat |
| 🎬 Streaming | Netflix, Disney+, HBO Max, Apple TV+, Amazon Prime Video, Twitch, Kick and more |
| 💻 Developer | GitHub, GitLab, Docker Hub, Hugging Face, npm, PyPI, Railway, Render, Vercel and more |
| 🎮 Gaming | Steam, Epic Games, Riot Games, Battle.net, Xbox, PlayStation Network and more |
| ☁️ Cloud | AWS, Cloudflare, Azure, DigitalOcean, Google Cloud |
| 📈 Productivity | Notion, Slack, Zoom, Figma, Canva, Linear, Airtable, Miro |
| 💳 Payment | PayPal, Stripe, Wise, Revolut |
| All Google services (except YouTube) | |
| 🔵 Microsoft | All Microsoft services |
| 🟣 Adobe | All Adobe services |
Some providers appear in more than one category.
For example:
are listed under both Messaging and Social Media.
Changing either entry updates the same underlying rule.
Need a service that isn't included?
Simply add your own provider definition and it becomes available inside the menu.
Provider definitions are stored in:
data/providers/
Categories are defined in:
data/groups.conf
No source code changes are required.
WARP Manager routes traffic by domain, not by IP address.
Domains are extracted directly from:
- TLS Server Name Indication (SNI)
- QUIC ClientHello (HTTP/3)
This allows applications to continue working even when their backend IP addresses or CDNs change.
WARP Manager never modifies your existing tunnel or proxy configuration.
It works entirely on the VPS by intercepting outbound HTTPS traffic before it leaves the server.
If the routing engine becomes unavailable, a fail-open watchdog automatically removes the redirect rules so traffic continues through the VPS's normal connection instead of breaking existing tunnels.
After every reboot, WARP Manager automatically restores:
- WARP
- sing-box
- nftables redirect rules
- Scheduled background services
No manual intervention is required.
The built-in Ad Blocker combines:
- uBlock Origin's filter lists (
Ad Blocker -> Filter Liststo choose them) - sing-box rule sets
The lists are updated automatically every week.
Failed downloads never replace a previously working list.
Auto IP Health periodically verifies that the current WARP exit is still usable.
A new WARP IP is requested only when:
- WARP is connected
- The VPS has normal Internet connectivity
- The current exit is unavailable or located in a blocked region
To avoid Cloudflare rate limits, IP rotations are automatically limited.
Connectivity-check domains used by operating systems remain routed directly.
This prevents Android, Windows, iOS and other clients from reporting false "No Internet" warnings.
Updating WARP Manager preserves:
- Selected services
- Custom domains
- White lists
- WARP account
- WARP+ license
- Ad Blocker settings
- Automation settings
Simply run:
sudo warp-manager --updateor run the installer again.
Some VPS providers temporarily receive HTTP 429 during WARP registration.
If this happens:
- wait a few minutes and restart WARP, or
- import an existing
wgcf-account.tomlfrom another server.
The installer completes successfully even when registration is temporarily rate-limited.
sudo bash uninstall.sh
# or
sudo warp-manager --purgeRemoves:
- WARP
- sing-box
- nftables rules
- Configuration
- WARP account
- Systemd services
WARP account registration is powered by wgcf. Special thanks to ClassicDarkPack for helping compile and maintain the YouTube advertising domain lists used by the Ad Blocker feature.
If WARP Manager helps you, a star or a small tip is appreciated. 🙏
Telegram channel: @BlackProtocols
| Coin | Address |
|---|---|
| Tron (TRX) | TTzuUAtsEsrLgNpFVLNTyLVJVRRFNWESYc |
| USDT (BEP20) | 0xc112AE9bfF7c59dEcFb34E988A397848D3093E82 |
| Toncoin (TON) | UQD9g40QubAICJ6zPqegtCY7s-joMx2DB8aIqA0xF1aHoCDs |
Copyright © 2026 Amin Mohammadi (AminMGMT). Released under the MIT License — see LICENSE and NOTICE.