Using WARP as a Proxy Egress on CentOS (Bypassing Netflix IP Restrictions)

WARP

Cloudflare WARP is a network privacy service from Cloudflare. Adding WARP as an egress can help bypass streaming services’ blocks on proxy IP addresses, such as Netflix’s. (Cloudflare’s official introduction)

WGCF

WGCF is an unofficial CLI client for WARP.

With WGCF, you can add IPv4 and IPv6 proxy egresses to a VPS to access Netflix.

Install wgcf

Run the following commands:

mkdir wgcf
cd wgcf
wget -O wgcf https://github.com/ViRb3/wgcf/releases/download/v2.2.4/wgcf_2.2.4_linux_amd64
chmod +x wgcf

On first use, register an account and generate the configuration files:

./wgcf register
./wgcf generate

The program directory will now contain two new files, wgcf-account.toml and wgcf-profile.conf.

Configure wgcf

wgcf-account.toml contains your WARP account details. If you have WARP+, replace these with the details for your own account. wgcf-profile.conf is the WireGuard configuration file; download a copy to your local machine.

Modify wgcf-profile.conf

WireGuard runs in the kernel and creates its own virtual network interface. WARP clients use private addresses behind NAT. If WireGuard takes over both IPv4 and IPv6 routing, the server may no longer be reachable at its original IP address. In this setup, we therefore leave one address family outside the tunnel to avoid losing access.

You can resolve engage.cloudflareclient.com to an IP address yourself, then use an IPv4 or IPv6 address for Endpoint and save the file.

There are two configuration options:

• Change the last line Endpoint=engage.cloudflareclient.com：2048 to 162.159.192.1:2408, and delete AllowedIPs = 0.0.0.0/0 so that WireGuard does not take over local IPv4 routing.
• Change the last line Endpoint=engage.cloudflareclient.com：2048 to [2606:4700:d0::a29f:c001]:2408, and delete AllowedIPs = ::/0 so that WireGuard does not take over local IPv6 routing.

Install the WireGuard client

CentOS 7:

sudo yum install epel-release elrepo-release
sudo yum install yum-plugin-elrepo
sudo yum install kmod-wireguard wireguard-tools

For installation commands on other systems, see the official website

After installation is complete, restart the VPS.

Configure WireGuard

Upload the modified wgcf-profile.conf file to /etc/wireguard, and rename it to wgcf.conf.

cp wgcf-profile.conf /etc/wireguard/wgcf.conf

Start wgcf

#加载内核模块
modprobe wireguard
#检查WG模块加载是否正常
lsmod | grep wireguard

Use these commands to bring the tunnel up or down:

#开启隧道
sudo wg-quick up wgcf
#关闭隧道
sudo wg-quick down wgcf

If the VPS is not using IPv6 for outbound connections, edit /etc/gai.conf (create the file if necessary) and use the following contents:

label ::1/128 0
label ::/0 1
label fd01::/16 1
label 2002::/16 2
label ::/96 3
label ::ffff:0:0/96 4
label fec0::/10 5
label fc00::/7 6
label 2001:0::/32 7
precedence ::1/128 50
precedence ::/0 40
precedence fd01::/16 40
precedence 2002::/16 30
precedence ::/96 20
precedence ::ffff:0:0/96 10

Check whether you can access Netflix:

wget -O nf https://github.com/sjlleo/netflix-verify/releases/download/2.6/nf_2.6_linux_amd64 && chmod +x nf && clear && ./nf

Test result: