WARP IPv6 issue with WARP+ key binded

[yang05051]

Lately, the newly wireguard profile generated from WGCF, with WARP+ license key binded, has a problem that, when I connect to it, WARP can assign an IPv4 for me, but no IPv6 address is assigned, and any connection to IPv6 only site would be timed out.

The profiles generated earlier this year, also with WARP+ license key binded, don't have such an issue, IPv6 would be assigned normally if connecting.

Also, newly generated profiles with license key unchanged (Meaning no WARP+ license), don't have this issue neither, IPv6 would be normally assigned.

I have read some discussions that this issue is caused by the wrong IPv6 tunnel address in the [Interface] section of the profile, which means the currently generated profile all has a wrong IPv6 address written in.
But I also noticed that, in the official WARP app, when you change the license key, only the private key will be refreshed, the IPv6 tunnel address remains the same, so the same IPv6 tunnel address should work before and after changing the license key.
This implies that the IPv6 tunnel address generated by WGCF should not be wrong, since before changing the license key, IPv6 address can be normally assigned.

So, I am guessing that something has changed with WARP's servers.
Maybe they are blocking profiles generated by WGCF with WARP+ license key binded from obtaining an IPv6 address, but old configs stay unaffected?
Or when WGCF is changing the license key, the program doesn't post a request, which is not required before, to inform WARP's servers to associate the IPv6 tunnel address with refreshed private key?

Would you look into it and work out a solution? Thanks.

[d-sushko]

The same is happening with the official WARP client on MacOS. The free mode passes ipv6 traffic, the warp+ mode doesn't pass ipv6 traffic. Although, the ip itself is the same. So, it seems to have nothing to do with the wgcf.

[galpt]

But I also noticed that, in the official WARP app, when you change the license key, only the private key will be refreshed, the IPv6 tunnel address remains the same, so the same IPv6 tunnel address should work before and after changing the license key.
This implies that the IPv6 tunnel address generated by WGCF should not be wrong, since before changing the license key, IPv6 address can be normally assigned.

I tried using the latest WGCF release and couldn't reproduce this issue.
Note that the attempt was using the latest release, generating new .toml and .conf files.
Both free & unlimited accounts were tested, and yes the PrivateKey was changed after using Warp+ license,
so we need to wgcf.exe generate a new .conf file after updating the license.

I have read some discussions that this issue is caused by the wrong IPv6 tunnel address in the [Interface] section of the profile, which means the currently generated profile all has a wrong IPv6 address written in.

Did you mean the #158 & #50 ?
The issue (#50) is quite old, so many random factors could be the cause(s), like:

• Cloudflare released Warp on September 25, 2019. So to scale a public service for worldwide users, they might had to make some changes, and probably those changes were causing the issue to happen.
• IPv6 must be unique, since this is how WireGuard works (1 IP = 1 device), well.. PrivateKey has to be unique too per device. WireGuard uses UDP (stateless), not TCP (stateful), so to make sure internet packets go to the correct device, there has to be a way or two to know where should Cloudflare send back the VPN traffic to. This is why removing the IPv6 might result in people can't connect to Warp.
• It could be as simple as people's devices failed to make DNS requests when trying to connect to Warp. Everything starts with a successful DNS request anyway.
• Could also be a problem with people's firewalls, who knows.

ℹ️ In Networking, 1 IP = 1 Device, that's the rule. In real life, you don't want to have 2 houses having the exact same address, but different owners & physical locations - that would just confuse anyone who uses Google Maps. IP addresses are the same, so that's why each has to be unique.

AFAIK for Warp, Cloudflare doesn't block anything except any connections to the HKG colo.

IPv4 & IPv6 had nothing to do with WGCF since all the tool does is simulating API requests to the Warp servers to generate a new account or updating the already existing one.

This tool is open source, so people could just inspect the source code first, and then make an educated guess from there.

From wgcf/cloudflare/api.go, starting at the UpdateLicenseKey goes up to MakeApiClient.
A quick look at wgcf/cmd/update/update.go might also help everyone gets the idea of how the tool works too.

[d-sushko]

Here's the description of the problem by other users: https://community.cloudflare.com/t/losing-ipv6-connectivity-with-warp/568971

[galpt]

They seem to be doing some big changes to their services lately, it seems that's affecting Argo-related services such as Warp.
Everyone can check their status page for latest updates.
https://www.cloudflarestatus.com/

[d-sushko]

Just to inform, IPv6 still not working for me. It works under the same conditions on the free mode, but immediately stops working once I apply the license key for unlimited mode. Also, the iOS app works just fine, providing both ipv4 and ipv6 on the same network.

[pccr10001]

I created #355 to resolve this issue and currently my IPv6 is working again.

[ViRb3]

Merged and released in v2.2.20. Sorry for the delay and thanks for the contribution!

[ihipop]

this will make it fail to change the plan to WARP PLUS after wgcf update/generate
you have to re-register, apply a WARP PLUS license key, and then run wgcf update/generate to make the WARP PLUS plan work, here: #85 (comment)