Cloudflare WARP Static IP: Does It Exist & How to Get a Fixed Egress IP

If you use Cloudflare WARP (the free VPN/proxy service), you’ve probably noticed that your public IP address changes frequently. For many users, that’s a privacy feature. But for others—like developers, sysadmins, or remote workers—a static IP is a necessity for whitelisting, accessing restricted servers, or maintaining consistent API connections.

So, can you get a static IP with Cloudflare WARP?

Short answer: Not with the free WARP or WARP+ plans. However, yes, you can achieve a static egress IP using Cloudflare’s paid offering: Cloudflare Zero Trust (formerly Gateway) with a dedicated egress IP.

Let’s break it down.

Best Practices

• Geo-Location Awareness: If your team is global, provision multiple static IPs in different regions (e.g., one in North America, one in Europe). This ensures a user in London doesn't have to route through a static IP in Virginia, which would add unnecessary latency.
• Least Privilege: Only assign the Static IP policy to the users who actually need it. General internet traffic can often go out via standard WARP IPs for better privacy.
• Fallback: Configure a "fallback" policy. If the Static IP pool is unavailable or congested, decide whether traffic should drop or route through standard WARP.

Step 2: Assign the Static IP to a Gateway Policy

Static IPs are enforced via Gateway network policies:

1. Go to Zero Trust → Gateway → Policies.
2. Create a new policy or edit an existing one.
3. Under Action, choose Egress.
4. In Egress IP, select your allocated static IP from the dropdown.
5. Set traffic matching rules (e.g., source user, device, destination network).
   • Example: Any traffic from Engineering group → static IP 198.51.100.45.

How It Works

1. You deploy the Cloudflare WARP client (same app) but enroll your device into a Zero Trust organization.
2. In the Cloudflare Dashboard, you configure an Egress Policy that assigns a dedicated IPv4 or IPv6 address to that device (or group of devices).
3. All traffic from that device egresses Cloudflare’s network from that fixed IP.

1. What is Cloudflare WARP Static IP?

Cloudflare WARP creates a secure, encrypted tunnel from a user’s device (laptop, phone, or server) to the Cloudflare global network. By default, WARP assigns users dynamic IP addresses from Cloudflare’s massive pool. These IPs change frequently to enhance privacy and anonymity.

WARP Static IP allows an organization to reserve a specific set of IP addresses (IPv4 or IPv6) exclusively for their account. When a user in your organization connects via WARP, they appear to the internet as coming from one of your reserved static IPs, rather than a generic Cloudflare IP.

The Problem with "Dynamic"

To understand why a Static IP add-on is so valuable, you have to look at the traditional method of securing servers: IP Whitelisting.

Imagine you are a database administrator for a company. You have a production database that holds sensitive user data. You want to lock it down so that only you can access it. The standard way to do this is to set a firewall rule: "Only allow connections from IP address 203.0.113.55."

If you are working from home on a standard ISP connection, your IP might change. If you are using a standard VPN, your IP is shared with thousands of other users and rotates constantly. You cannot whitelist a moving target.

Consequently, IT teams often resort to fragile solutions—opening ports to entire geographic regions or relying solely on passwords. This is where breaches happen.

8. Conclusion

Cloudflare WARP Static IP is a critical tool for organizations transitioning to a Zero Trust model but hampered by legacy infrastructure requirements. It removes the need for brittle, hardware-centric VPNs by providing a reliable, low-latency, and secure "fixed address" for your remote workforce.

By combining the performance of Cloudflare’s global network with the certainty of a dedicated IP address, businesses can maintain strict security postures without sacrificing the user experience.

Step 1: Provisioning the IPs

1. Log in to the Cloudflare Zero Trust Dashboard.
2. Navigate to Settings > Network.
3. Scroll to the Static IPs section.
4. Click Purchase/Allocate (depending on your plan).
5. You will be prompted to select the region for your IPs. Note: You can provision IPs in different regions for global teams.
6. Cloudflare will assign you a dedicated IPv4 and IPv6 block (usually /64 for IPv6).