Cloudflare WARP does not naturally provide a static public IP address for standard or free users; instead, it assigns dynamic IPs from a shared pool to enhance privacy. However, organizations using Cloudflare Zero Trust can obtain Dedicated Egress IPs, which are static, exclusive IP addresses assigned to their account to satisfy allowlisting requirements. Understanding Cloudflare WARP IP Behavior
The Cloudflare WARP client is designed as a security and speed optimization tool rather than a traditional static-IP VPN.
Consumer WARP (Free/Plus): Devices typically receive a dynamic IPv4 address from the 162.159.192.0/24 range. These addresses change frequently to mask the user's actual location and identity.
Cloudflare One (Zero Trust): Organizations can enroll devices in a Zero Trust environment, where each device is assigned a persistent Virtual IP (VIP) or Mesh IP from the 100.96.0.0/12 range for internal private networking. How to Get a Static Public IP with WARP
For users who require a fixed public-facing IP for allowlisting (e.g., accessing a secure database or third-party SaaS), there are two primary methods: 1. Dedicated Egress IPs (Enterprise)
This is the official method for obtaining a static public IP.
Availability: Only available as an add-on for Zero Trust Enterprise plans.
Functionality: Cloudflare provisions at least two static IPs in different data centers. These are exclusive to your account and never shared with other customers.
Setup: Once provisioned, admins go to Zero Trust > Traffic policies > Traffic settings to enable the Secure Web Gateway proxy for TCP and UDP traffic. 2. Egress via Cloudflare Tunnel (Workaround) Cloudflare One Client with firewall
Cloudflare WARP is a powerful tool for privacy and speed, but it does not naturally provide a static IP address. Because WARP is built on a consumer-grade VPN framework, it assigns addresses from a shared pool that changes frequently.
For users who need to whitelist an IP for server access or remote work, this can be a major hurdle. Here is a comprehensive guide on how Cloudflare WARP handles IP addresses and the specific ways you can achieve a "static" experience within the Cloudflare ecosystem. How Cloudflare WARP Manages IP Addresses
When you connect to Cloudflare WARP, your traffic is routed through the nearest Cloudflare data center. To keep your browsing private, Cloudflare uses a system called Carrier-Grade NAT (CGNAT).
Dynamic Assignment: Every time you toggle WARP on or off, you likely get a new IP.
Shared Identity: Hundreds of other users might be sharing the same exit IP at any given time. cloudflare warp static ip
Geographic Accuracy: Cloudflare attempts to give you an IP that matches your general city or region so local websites still work correctly. Can You Get a Static IP on a Standard WARP Account?
The short answer is no. Standard WARP and WARP+ accounts are designed for individual privacy, not for fixed networking. Cloudflare does not offer an "Add-on" for a dedicated static IP for its free or $4.99/month consumer tiers. Solutions for a Fixed IP Experience
If you absolutely require a static IP while using Cloudflare’s technology, you have to move beyond the consumer app and into their business-oriented "Zero Trust" suite.
Cloudflare Zero Trust (Gateway)By setting up a free Cloudflare Zero Trust dashboard, you can enroll your devices in a managed WARP organization. While this still uses dynamic IPs by default, it allows you to see and manage your traffic more effectively.
Fixed Egress IPs (Enterprise Only)The only way to get a truly dedicated, static exit IP through WARP is via a Cloudflare Enterprise plan with the "Dedicated Egress IP" feature. This allows an organization to ensure all employees using WARP appear to come from one specific, unchanging IP address. This is typically used by large corporations to secure their internal firewalls.
Using Cloudflare Tunnels (The "Reverse" Static IP)If your goal is to access a home server or a specific machine without a static IP, you don't actually need a static IP. You can use Cloudflare Tunnel (formerly Argo Tunnel).
It creates a secure link between your server and Cloudflare.
You access your server via a domain name (e.g., yourdomain.com).
No IP whitelisting is required because the connection is outbound. Alternatives for Users Who Need a Static IP
If the Cloudflare Enterprise price tag is out of reach, but you still want the security of a VPN with a fixed address, consider these alternatives:
Dedicated IP VPNs: Services like NordVPN or Surfshark offer "Dedicated IP" add-ons for a few dollars extra per month.
Self-Hosted WireGuard: You can set up a VPS (on AWS, DigitalOcean, or Linode) for $5/month, install WireGuard, and enjoy your own private static IP.
Tailscale: This is a "mesh" VPN that lets you access your devices from anywhere. While it doesn't give you a static public IP for the whole internet, it gives every device a static internal IP that never changes. Cloudflare WARP does not naturally provide a static
Cloudflare WARP is excellent for encrypting your connection and bypassing local censorship, but it is fundamentally built on dynamic IP architecture. To get a static IP, you must either upgrade to an Enterprise Zero Trust environment or use a traditional VPN provider that specializes in dedicated IP addresses. To help you find the right setup, let me know:
Are you trying to access a home server or a company database? Is this for personal use or a business team? What is your monthly budget for a fixed IP?
Cloudflare WARP is a consumer-focused, privacy-oriented VPN that uses a shared, dynamic pool of IP addresses, meaning it does not provide a dedicated static IP. While it offers geolocation-based IPs for speed, users requiring a fixed IP for whitelisting or security should look to Cloudflare Zero Trust Enterprise plans, which offer dedicated egress IPs. You can find more details in the Cloudflare blog post regarding Cloudflare Zero Trust.
By default, Cloudflare WARP does not provide a static IP address
. Most users on the consumer version (1.1.1.1) share dynamic public IP addresses from a large pool that changes frequently. Cloudflare Community
However, for organizations that require a fixed IP for allowlisting or accessing restricted third-party services, Cloudflare offers solutions through its Zero Trust Static IP Solutions for Cloudflare WARP 1. Dedicated Egress IPs (Enterprise) The most direct way to get a static IP with WARP is through Dedicated Egress IPs Enterprise-tier feature How it works
: Cloudflare assigns static IPv4 and IPv6 addresses exclusively to your account. Customization : Administrators can use Egress Policies
to control exactly which traffic uses these static IPs based on user identity, application, or destination.
: Allows remote workers to access third-party tools (like a partner's database or a secure banking portal) that require a known, fixed IP for security. The Cloudflare Blog 2. Fixed IP via Cloudflare Tunnel (Workaround)
For teams not on an Enterprise plan, a common workaround involves routing specific traffic through a Cloudflare Tunnel Cloudflare Community : You set up a cloudflared tunnel on a server that
has a static public IP (e.g., a VPS in AWS or DigitalOcean).
: You configure the Zero Trust dashboard to route traffic for specific destination IPs through that tunnel.
: When a WARP user visits those destinations, the destination sees the static IP of your server instead of a random Cloudflare IP. Cloudflare Community Key Differences at a Glance Static outbound IP address with WARP for Team - Gateway Alternative: Proxy with Dedicated IP (no WARP) If
Standard versions of Cloudflare WARP, such as the free tier and WARP+, do not provide a static IP. Instead, they use dynamic IP addresses from a shared pool that can change frequently.
For businesses or power users who require a consistent IP for allowlisting or secure remote access, Cloudflare offers specific solutions through its Zero Trust platform. How to Get a Static IP with Cloudflare WARP
If you need a "static" experience with WARP, you must use one of the following Enterprise or Zero Trust methods: Static outbound IP address with WARP for Team - Gateway
If you don’t need full WARP but only a static egress IP, consider:
cloudflared access with --ingress-ip (limited).Last updated: 2025. Features subject to Cloudflare’s commercial terms.
Here’s a concise, balanced review of Cloudflare WARP specifically regarding its static IP capabilities.
To understand why a Static IP add-on is so valuable, you have to look at the traditional method of securing servers: IP Whitelisting.
Imagine you are a database administrator for a company. You have a production database that holds sensitive user data. You want to lock it down so that only you can access it. The standard way to do this is to set a firewall rule: "Only allow connections from IP address 203.0.113.55."
If you are working from home on a standard ISP connection, your IP might change. If you are using a standard VPN, your IP is shared with thousands of other users and rotates constantly. You cannot whitelist a moving target.
Consequently, IT teams often resort to fragile solutions—opening ports to entire geographic regions or relying solely on passwords. This is where breaches happen.
A static IP address is a fixed IP address that is assigned to a device or a user account. Unlike dynamic IP addresses, which can change frequently, static IP addresses remain the same over time. This provides a stable and predictable IP address that can be used for various purposes, such as:
Cloudflare WARP is not designed to give consumers a static IP—it’s built for dynamic, anycast routing at scale. But for professionals, Cloudflare Zero Trust bridges that gap with a true static egress IP that works seamlessly inside the same WARP client.
If you need one fixed IP, stop looking for a hack and enable Gateway Egress Policies today.
Are you an individual developer or small business owner who needs a reliable egress IP while using WARP? You have two practical options, though neither is pure Cloudflare WARP.