Browse Docs
ONLINE DOCUMENTATION

Using with Cloudflare WARP

Overview

Cloudflare WARP (part of Cloudflare One / Zero Trust) and DefensX can conflict when both are installed on the same device. Depending on the WARP configuration, this conflict can cause intermittent DNS failures and prevent WARP from establishing a stable connection.

Symptoms

  • WARP connectivity checks fail intermittently. The same device may connect successfully at one time and fail at another.

  • WARP reports DNS or connectivity errors even though the network connection is working.

  • The issue occurs only when both WARP and DefensX are active.

Cause

WARP and DefensX both use kernel-level drivers to intercept and handle DNS traffic. When both drivers are active, they interfere with each other:

  • When WARP starts a connection, it sends DNS queries for its own health-check hostnames, such as connectivity-check.warp-svc and connectivity.cloudflareclient.com.

  • The DefensX driver intercepts these queries. If the answer is not already in the DefensX DNS cache, DefensX performs its own upstream DNS lookup to resolve them.

  • WARP then intercepts that upstream lookup from DefensX but never returns a response.

  • The original WARP query fails, and the connectivity check does not complete.

Whether the check succeeds depends on whether DefensX already has the answer cached. This is why the problem appears intermittently rather than consistently.

Resolution

A full resolution requires configuring each product to exclude the other’s traffic, so that neither driver intercepts the other’s DNS queries. Contact DefensX Support for guidance on the exclusions required for your environment.

Workaround

Configure WARP to run in Traffic only mode instead of Traffic and DNS mode. In this mode, WARP no longer intercepts DNS traffic, which removes the conflict with the DefensX driver.

  • Managed deployments: In the Cloudflare One (Zero Trust) dashboard, update the device profile and set the service mode to Traffic only.

  • Unmanaged clients: Change the mode in the WARP client settings.

warp
Note
 In Traffic only mode, DNS filtering from Cloudflare Gateway no longer applies to the device. DNS-based protection is handled by DefensX instead. Confirm this meets your organization’s security requirements before applying the change.
Secure Industries, Inc 101 Avenue of The Americas, Floor 9 New York, NY 10013