The myth of a "static IP for WARP" persists because users want the best of both worlds: Cloudflare’s speed with the stability of a dedicated address. Today, that hybrid exists—but only in the paid, enterprise-focused Zero Trust product.
Cloudflare WARP creates a secure, encrypted tunnel from a user’s device (laptop, phone, or server) to the Cloudflare global network. By default, WARP assigns users dynamic IP addresses from Cloudflare’s massive pool. These IPs change frequently to enhance privacy and anonymity.
| Feature | Free WARP | WARP+ | Zero Trust (Dedicated IP) | |---------|-----------|-------|----------------------------| | Static IP | ❌ No | ❌ No | ✅ Yes | | Cost | Free | ~$5/mo (limited) | $7+/user/mo | | Ease of setup | Easy | Easy | Moderate | | Use case | Privacy, speed | Speed | Enterprise allowlisting |
Onboard your devices to the Cloudflare Zero Trust dashboard. Purchase a dedicated IPv4/IPv6 range from Cloudflare. Navigate to Gateway > Egress Policies cloudflare warp static ip
: When a WARP user visits those destinations, the destination sees the static IP of your server instead of a random Cloudflare IP. Cloudflare Community Key Differences at a Glance Static outbound IP address with WARP for Team - Gateway
The combination of Cloudflare WARP and a static IP address is beneficial for various use cases, including:
(email/SAML), not its IP. Your server will recognize your identity and grant access, rendering the "Static IP" requirement obsolete. 3. Verification Commands The myth of a "static IP for WARP"
: Your partners and services will see a single, predictable IP address, making whitelisting simple again.
A static egress IP via WARP is crucial for scenarios requiring strict network security, specifically:
In its default configuration, the public IP address assigned to your traffic is shared and dynamic. This is a core part of its design. However, this doesn't mean a static configuration is impossible for enterprise users. This article will clarify the default architecture, explore the official solution for a dedicated static address, and look at the methods used to achieve a form of a static egress. By default, WARP assigns users dynamic IP addresses
If your goal is to expose a local server or application to the internet via a static domain without opening firewall ports, you do not need a static IP. You need a .
# Register device with your team cloudflared tunnel login
Instead of sharing an IP address with a random pool of users, you are assigned a dedicated IP address (or a block of them). This IP is yours. It doesn't change, and it isn't shared with anyone else.
Another misconception: Using a Cloudflare Tunnel ( cloudflared ) with WARP. While a Tunnel creates a static endpoint on Cloudflare’s edge, your local WARP IP remains dynamic. The tunnel acts as a reverse proxy, masking your dynamic IP from the outside world, but your outbound IP from WARP is still shared.