Navigate to the Cloudflare Dashboard and sign up for a Zero Trust account (the free tier covers up to 50 users).
This is Cloudflare's official method for providing a static IP. It's exclusively available for on the Zero Trust plan . These are unique, static IP addresses dedicated solely to your account and not shared with any other customer. At minimum, you receive two dedicated egress IPs (an IPv4 address and an IPv6 range) tied to different data centers for resilience.
To understand how to get a static IP with WARP, it helps to first understand how Cloudflare’s consumer and enterprise networks operate. How Consumer Cloudflare WARP Works
Cloudflare WARP is a popular, fast, and secure VPN service built on the WireGuard protocol. It secures internet traffic by encrypting connections from user devices to the Cloudflare network. However, a common challenge for businesses and power users is that standard Cloudflare WARP does not provide a . Every time you connect, your public-facing IP address can change.
: When you connect to WARP, your original IP is replaced with a Cloudflare IP address that corresponds to the data center closest to your physical location. This IP is shared among many users and can change frequently. cloudflare warp static ip
Because thousands of people share these IPs, some websites might flag your traffic as a "bot" or show extra CAPTCHAs. 🛠️ The Professional Fixes
Enter . It is a subtle but profound shift in how we approach Zero Trust security, turning a chaotic variable into a permanent asset.
Buy a Virtual Private Server (from providers like DigitalOcean, Linode, or Hetzner) which comes with a dedicated static IPv4 address.
. Every time he toggled the switch, he was assigned a new address from Cloudflare’s massive global pool. To the office firewall, he was a stranger every five minutes. Navigate to the Cloudflare Dashboard and sign up
: Your partners and services will see a single, predictable IP address, making whitelisting simple again.
: This is typically an Enterprise-level feature that requires contacting the Cloudflare account team. Cloudflare Docs 2. The "WARP-to-Tunnel" Workaround
The Quest for a Static IP: Understanding Cloudflare WARP In a world where remote work is the norm, "IP whitelisting" has become a major headache for security teams. You need to access a sensitive database or a partner’s portal, but they only allow connections from a specific, trusted IP address. If you’re using , you might find yourself asking: Can I get a static IP?
The official solution for dedicated egress IPs is powerful, but the Enterprise plan requirement places it beyond reach for many individuals and smaller businesses. However, there are several viable workarounds to achieve a static IP or effectively solve the allowlisting problem. These solutions range from leveraging other Cloudflare products to DIY configurations. These are unique, static IP addresses dedicated solely
The consumer version of Cloudflare WARP (including WARP+) is built for privacy and speed, not persistent hosting or strict access control.
If you don't have an Enterprise plan but still have an existing static IP on a server or cloud provider (e.g., AWS, Google Cloud), you can "anchor" your egress traffic to that IP using a Cloudflare Tunnel. This method allows you to route your WARP traffic through your own infrastructure to egress with its IP.
Set up WireGuard or OpenVPN on that VPS.
Create to route specific traffic (e.g., access to your database) through the dedicated egress IP.
This is one of the most popular "DIY" methods. You run a lightweight Cloudflare Tunnel daemon ( cloudflared ) on a server with a static IP (e.g., an AWS EC2 instance with an Elastic IP). You then route traffic from your local WARP client through that tunnel before it egresses to the internet. From the perspective of an external service, all traffic appears to come from the server's static IP, bypassing WARP's dynamic egress pool entirely.
However, users frequently ask a critical question: