Why won't Cloudflare WARP connect, or why is it slow, in Iran?

WARP is built on WireGuard, whose handshake has a fixed signature that DPI can fingerprint and then throttle or block; on top of that Cloudflare WARP's IP ranges are public, so a censor can disrupt them wholesale. That's why you see "handshake succeeds but no traffic" and "worked yesterday, won't connect today." It's not your device — WARP simply wasn't designed to beat censorship.

Which is better, WARP or VLESS+Reality?

They have different roles. WARP is free, one-tap, privacy-oriented, and fine for light use, but it uses fixed-signature WireGuard plus public IP ranges and is easily throttled in Iran. VLESS+Reality uses a dedicated node disguised as ordinary HTTPS, is harder for DPI to detect, and is more stable, but it needs a subscription and a client. Use VLESS+Reality as your primary for stability and keep WARP as a free backup — not either/or.

Do warp-plus and scanning for clean IPs fix this long term?

They only buy time; they don't fix the root cause. The very fact these tricks exist shows plain WARP keeps getting hit in Iran — you end up in a cat-and-mouse loop of scanning IPs, reconnecting, and getting throttled again. For stability, the more reliable move is switching to a dedicated channel that's hard for DPI to auto-detect, such as VLESS+Reality.

Should I keep WARP after switching to VLESS?

You can keep it as a free backup. When blocking loosens or for a quick emergency, one-tap WARP is still convenient. Just don't rely on it as your daily primary during heavy blocking — in that scenario it's usually unstable.

Почему Cloudflare WARP (1.1.1.1) режут или не подключается в Иране и чем его заменить (VLESS+Reality)

Обновлено 2026-07-03

Diagram: Cloudflare WARP is free and one-tap but built on WireGuard with public IP ranges, easily throttled in Iran; VLESS+Reality uses a dedicated node disguised as ordinary HTTPS — more stable and stealthier

What Cloudflare WARP actually is

Cloudflare WARP (the 1.1.1.1 app) is Cloudflare's free consumer product that routes your traffic into Cloudflare's network using the WireGuard protocol. It was built for privacy and speed (faster DNS, better routing) — it is not a tool designed to defeat nation-scale censorship. The paid WARP+ adds Argo smart routing, but its fundamental role is the same. That's exactly why treating it as your primary, reliable circumvention tool in Iran usually disappoints.

WARP's strengths (stated honestly)

Credit where it's due: WARP is completely free, one-tap, needs no configuration, is official Cloudflare software, and is well regarded. For everyday lookups, encrypted DNS, hiding your local IP, and light browsing it's genuinely convenient, and during periods of looser blocking it does work. So don't treat it as the enemy; understand its role: low barrier, privacy-oriented, fine for light use — but not built to keep punching through heavy DPI.

Why WARP is often throttled or won't connect in Iran

In Iran many people hit "WARP worked yesterday, won't connect today" and "the handshake succeeds but no traffic flows." It's not your device: WireGuard's handshake has a fixed signature that DPI can fingerprint relatively easily and then throttle or block; and Cloudflare WARP's IP ranges are public and well known, so a censor can disrupt them by the block. It's precisely because plain WARP keeps getting hit that the community relies on warp-plus, psiphon+warp, and scanning for "clean IPs" — which itself proves the point: WARP wasn't designed to beat censorship, and in Iran it's a cat-and-mouse game.

When you should move off WARP

If blocking is light and you only occasionally look things up or send messages, WARP is fine — and free. But when you need stable video, meetings, large downloads, or gaming, or you notice "WARP keeps failing to connect and I have to keep changing IPs," it's time to switch to a channel that is dedicated and hard for DPI to auto-detect — otherwise you'll burn time in a loop of "scan IP, reconnect, get throttled again."

The more reliable alternative: VLESS + Reality

VLESS is a lean transport protocol and Reality is its TLS camouflage layer, disguising your traffic as an ordinary HTTPS visit to a real public website. Unlike WARP's fixed-signature WireGuard plus public IP ranges, VLESS+Reality uses a dedicated node and is hard for DPI to fingerprint automatically — which is exactly why it's more stable than WARP in Iran. The trade-off is that it isn't zero-barrier like WARP: you need a subscription and a client (sing-box / v2rayN / Shadowrocket, etc.). And to be honest: no approach can guarantee it always works — exit-IP reputation, SNI, and keys still matter, and during a regional blackout no cross-border channel connects at all.

How to migrate from WARP: step by step

Copy your subscription link from the dashboard (prefer VLESS+Reality nodes in Iran).
Install a mature client: Shadowrocket on iOS, sing-box or v2rayN on Android / desktop, and import the subscription URL (don't add a single node by hand).
Update the subscription, run a latency test, and enable a low-latency node.
Use Rule mode: send Iranian bank / government apps direct (they reject foreign IPs) and route only blocked services through the tunnel.
Keep WARP as a free backup — when blocking loosens or for a quick emergency, one-tap WARP is still a convenient second option.

Honest expectations

No tool can guarantee it always works everywhere; Reality lowers the odds of automatic detection, but the real outcome depends on node quality and operations.
During a regional blackout, any cross-border channel (VLESS and WARP alike) may fail to connect — that's unrelated to the protocol.
The recommendation is "use VLESS+Reality as your primary for stability, keep WARP as a free backup" — not either/or.
For a comparison of the free emergency tools see why Psiphon slows down and its alternative and why Lantern slows down and its alternative; for the protocol primer see What is VLESS Reality; for client setup see sing-box setup for Persian users; for the overall comparison see what still works in Iran in 2026.

Follow local laws and third-party service terms; this is a technical explainer, responsibility for safe and lawful use rests with the user, and we cannot guarantee the long-term availability of any third-party service (including Cloudflare WARP).

Частые вопросы

Why won't Cloudflare WARP connect, or why is it slow, in Iran?: WARP is built on WireGuard, whose handshake has a fixed signature that DPI can fingerprint and then throttle or block; on top of that Cloudflare WARP's IP ranges are public, so a censor can disrupt them wholesale. That's why you see "handshake succeeds but no traffic" and "worked yesterday, won't connect today." It's not your device — WARP simply wasn't designed to beat censorship.
Which is better, WARP or VLESS+Reality?: They have different roles. WARP is free, one-tap, privacy-oriented, and fine for light use, but it uses fixed-signature WireGuard plus public IP ranges and is easily throttled in Iran. VLESS+Reality uses a dedicated node disguised as ordinary HTTPS, is harder for DPI to detect, and is more stable, but it needs a subscription and a client. Use VLESS+Reality as your primary for stability and keep WARP as a free backup — not either/or.
Do warp-plus and scanning for clean IPs fix this long term?: They only buy time; they don't fix the root cause. The very fact these tricks exist shows plain WARP keeps getting hit in Iran — you end up in a cat-and-mouse loop of scanning IPs, reconnecting, and getting throttled again. For stability, the more reliable move is switching to a dedicated channel that's hard for DPI to auto-detect, such as VLESS+Reality.
Should I keep WARP after switching to VLESS?: You can keep it as a free backup. When blocking loosens or for a quick emergency, one-tap WARP is still convenient. Just don't rely on it as your daily primary during heavy blocking — in that scenario it's usually unstable.

Канал Univista в Telegram

В канале — свежие рабочие конфиги, статус узлов и разбор частых проблем.

Перейти в канал

Сервис, который вам нужен, заблокирован? Верните доступ — бесплатно.

Снова онлайн примерно за 2 минуты, без банковской карты. Рабочее подключение по VLESS + Reality на iOS, Android, Windows и macOS.

Бесплатно 1 ГБ в день
·
Банковская карта не нужна
·
VLESS + Reality за 60 секунд

Когда друг начнёт пользоваться сервисом, вы оба получите по +30 бонусных дней и бонусный трафик.

Восстановить доступ — бесплатно