RedWARP over Relay.

[meizfl]

Hey everyone!

We have an idea for a fast, lightweight, and legally safe way to bypass blocking of Cloudflare IP addresses in restrictive countries.

We propose using Relay nodes for RedWARP.

A Relay node is NOT an exit node and NOT a proxy. It only forwards encrypted WARP (WireGuard/AmneizaWG) traffic to Cloudflare.

From the outside, a Relay server only establishes a VPN connection to Cloudflare. All user traffic exits exclusively from Cloudflare’s infrastructure, not from the Relay’s IP address.

This makes Relay nodes safe to run even on home routers, Raspberry Pi devices, mobile phones, or low-cost VPS instances with a public IP address. No “dirty” traffic ever leaves the Relay host.

Below are implementation examples using simple iptables rules.
Three Relay servers in popular locations (Warsaw, Frankfurt, Roubaix) are already available for testing.

If you'd like to be included in the Relay list, please contact us using the following format:

Location: Warsaw, Mazovia, PL
IP: 51.38.153.32
ZeroTrust: 5241
WARP: 5242
Provider: OVH
Free-to-use
Speed: 3 GbE

Access point list:

Location	IP	WARP	ZeroTrust	Provider	Access	Speed	MTU
Roubaix, FR	147.135.212.152	5242	5241	OVH Cloud	Free-to-use	3 GbE	1340
Warsaw, PL	51.38.153.32	5242	5241	OVH Cloud	Free-to-use	3 GbE	1340
Frankfurt, DE	51.38.107.252	5242	5241	OVH Cloud	Free-to-use	3 GbE	1340

[meizfl]

To set up Relay, you need to deploy a simple list of rules on your server:

sysctl -w net.ipv4.ip_forward=1
echo "net.ipv4.ip_forward=1" | sudo tee -a /etc/sysctl.conf
sysctl -p

iptables -t nat -A PREROUTING -i eno1 -p udp --dport 5241 -j DNAT --to-destination 162.159.193.1:4500
iptables -A FORWARD -p udp -d 162.159.193.1 --dport 4500 -j ACCEPT
iptables -t nat -A POSTROUTING -o eno1 -d 162.159.193.1 -p udp --dport 4500 -j MASQUERADE
iptables -t nat -A PREROUTING -i eno1 -p udp --dport 5242 -j DNAT --to-destination 162.159.192.1:4500
iptables -A FORWARD -p udp -d 162.159.192.1 --dport 4500 -j ACCEPT
iptables -t nat -A POSTROUTING -o eno1 -d 162.159.192.1 -p udp --dport 4500 -j MASQUERADE

netfilter-persistent save

[meizfl]

Another way to create a Relay:

Bash

mkdir /var/www/runers/

/var/www/runers/iptables-warp.sh

#!/bin/bash
sysctl -w net.ipv4.ip_forward=1

iptables -t nat -A PREROUTING -i eth0 -p udp --dport 5241 -j DNAT --to-destination 162.159.193.1:4500
iptables -A FORWARD -p udp -d 162.159.193.1 --dport 4500 -j ACCEPT
iptables -t nat -A POSTROUTING -o eth0 -d 162.159.193.1 -p udp --dport 4500 -j MASQUERADE

iptables -t nat -A PREROUTING -i eth0 -p udp --dport 5242 -j DNAT --to-destination 162.159.192.1:4500
iptables -A FORWARD -p udp -d 162.159.192.1 --dport 4500 -j ACCEPT
iptables -t nat -A POSTROUTING -o eth0 -d 162.159.192.1 -p udp --dport 4500 -j MASQUERADE

/etc/systemd/system/iptables-warp.service

[Unit]
Description=Custom iptables rules for WARP
After=network-online.target ufw.service
Wants=network-online.target

[Service]
Type=oneshot
ExecStart=/var/www/runers/iptables-warp.sh
RemainAfterExit=yes

[Install]
WantedBy=multi-user.target

Bash

chmod +x /var/www/runers/iptables-warp.sh && sudo systemctl enable iptables-warp && sudo systemctl start iptables-warp