← Back to Blog
Engineering Notes VPN

Cloudflare WARP via Dante SOCKS5: A Netflix Routing Experiment

• Vadim Smirnov • 7 min read
Classical ferry cutout integrated with a proxy transfer point and packet routes.

A familiar Netflix title disappearing while you are travelling is a good illustration of regional licensing. It also raises an interesting networking question: what happens if Cloudflare WARP reaches the Internet through a proxy in another country?

This article explores that arrangement with a US-hosted Dante SOCKS5 proxy and WireSock Secure Connect on Windows. WireSock carries the WARP tunnel through Dante; Cloudflare then carries the traffic to its destination. We will configure that path and check what each part is actually doing.

The extra hop can change the route into Cloudflare, but it does not make WARP a country selector or guarantee a particular Netflix catalog. A working tunnel, a geolocation result and successful playback are three different things. In my original US VPS experiment, I reported access to the US Netflix catalog through this setup. That was one observed result; the same route and catalog are not assured on other networks or at other times.

What the Proxy Changes

Applications on Windows
  -> WireSock (WireGuard tunnel)
  -> Dante SOCKS5 UDP relay
  -> Cloudflare WARP
  -> Destination site

Dante is the intermediate relay, not the final exit seen by Netflix. The destination normally sees a Cloudflare egress address, not the VPS address. Hosting the proxy in the US changes where the tunnel approaches Cloudflare; it does not establish where every connection leaves Cloudflare or how Netflix classifies that address.

Cloudflare explains that WARP may use a data center other than the physically closest one and that location-sensitive services may not work properly. Its replacement addresses are Cloudflare addresses, not residential ISP addresses; they should not be treated as a guarantee that a streaming service will accept the connection.

Start with the Dante setup from the previous article. It needs working SOCKS5 UDP ASSOCIATE, not just a reachable TCP port 1080. The relay address and UDP port returned by Dante must also be reachable through the VPS and provider firewalls. Keep the allowed WARP destination address, port and address family consistent with the profile you actually use.

Generating a WARP Configuration

wgcf is an unofficial tool that registers a WARP device and generates a WireGuard profile. From the project’s releases page, download the Windows binary matching your PC’s architecture. Save it in a private working directory, rename it to wgcf.exe and open PowerShell in that directory. Run:

.\wgcf.exe register
.\wgcf.exe generate

The .\ prefix runs the executable from the current directory; it does not require adding it to PATH. Registration contacts Cloudflare and asks you to accept its terms. It saves account data in wgcf-account.toml; generation uses that account to request the device configuration and write wgcf-profile.conf. Both steps depend on the service accepting the requests. Creating a profile is not yet evidence that the tunnel can connect.

Keep both files private: they contain credentials or private-key material. Import wgcf-profile.conf into WireSock Secure Connect. Retain its keys, assigned addresses, DNS servers, WARP Endpoint and initial MTU. This is a third-party WireGuard setup, not the official WARP application.

Configuring WireSock Secure Connect

In the imported profile, configure your Dante proxy and its username/password. For the traffic path shown above, enable all tunnel traffic through SOCKS5. WireSock also supports proxying only the WireGuard handshake; that is a different path and is not enough to send the whole WARP tunnel through the VPS.

If you edit the configuration file, add the following lines inside its existing [Peer] section. Do not create a second peer or replace the WARP Endpoint with the Dante address:

# Add inside the existing [Peer] section:
#@ws:Socks5Proxy = 203.0.113.20:1080
#@ws:Socks5ProxyUsername = warpuser
#@ws:Socks5ProxyPassword = REPLACE_WITH_PROXY_PASSWORD
#@ws:Socks5ProxyAllTraffic = true

203.0.113.20 is an example address. Replace it and the credentials with your reachable Dante server details. The WireSock parameter reference documents these options. WireSock reads the #@ws: lines as settings; ordinary WireGuard clients treat them as comments.

There are two separate choices here: which application traffic enters the VPN, and whether WireSock sends the resulting tunnel packets through SOCKS5. For an initial whole-device test, check that the effective profile/global settings cover IPv4 and IPv6 (0.0.0.0/0, ::/0) without application or network exclusions. Review global overrides and split-tunneling settings, then reconnect. Test the actual browser or player you intend to use, not a different application with different routing rules.

Netflix Testing

Start by separating a routing problem from a streaming restriction. A country shown by an IP lookup is a useful observation, but it is not a catalog entitlement or a playback test.

  1. Establish a baseline. With the tunnel disconnected, note the public IPv4/IPv6 addresses seen from the test browser. After connecting, repeat the checks in that same browser. Record the observed Cloudflare egress and reported country; do not assume the US VPS guarantees a US exit.
  2. Confirm the tunnel path. Check for a recent WireGuard handshake and traffic in both directions. Check WireSock and Dante logs for the proxy connection and UDP relay. A handshake alone does not prove that all later data is relayed, so confirm the all-traffic setting too. If IP checks still show the ordinary ISP route, inspect the effective split-tunneling rules and each address family.
  3. Measure performance separately. Fast.com transfers data to Netflix servers to estimate speed and latency. Its expanded information also shows a client location. That is useful for diagnosis, but the selected test server is not proof of a chosen catalog, and a good speed result does not guarantee playback without buffering.
  4. Test in Netflix itself. Check the titles available to your account and start playback. Note any VPN/proxy message. A private browser window can reduce old session state; it cannot force Netflix to grant a different catalog. Repeat the test on the actual TV, console or player if that is the intended device.

Netflix’s VPN guidance says VPN users may be shown only titles with worldwide licensing. It also says VPN viewing is not supported for its ad-supported experience or live events. If the tunnel and IP checks work but Netflix restricts the selection or playback, that is a different outcome from a broken SOCKS5 relay. Record the result rather than treating every restriction as a configuration error.

Sharing the Connection (Mobile Hotspot)

A laptop can also share its connection with a TV or another device through Windows Mobile Hotspot. The useful detail is that forwarded device traffic must be included in WireSock’s routing policy. A working VPN connection on the laptop does not prove that traffic from the hotspot follows it.

  1. Connect the WARP profile with the SOCKS5 all-traffic option enabled.
  2. Follow the WireSock hotspot guide: enable Windows Mobile Hotspot and select the regular Internet connection to share.
  3. If using an application allowlist, include system in the effective tunneled-app list as the guide explains, then reconnect. This also includes Windows system traffic from the laptop, so it broadens what you are tunneling.
  4. From the connected device, repeat the public IPv4/IPv6, DNS and playback checks. Verify the laptop’s results separately. Do not infer a device’s route or Netflix availability solely from the fact that it joined the hotspot.

Check sharing on the Windows configuration you intend to use. A working IPv4 path does not establish that IPv6 or DNS follows the same route, and a result on one device does not establish the result on another.

Conclusion

The useful building block is a WARP WireGuard connection whose tunnel traffic travels through an authenticated Dante UDP relay. It lets you explore the effect of a different entry path into Cloudflare. It does not give you a residential address, promise a US catalog or make SOCKS5 an encrypted transport.

SOCKS5 UDP framing still carries the WireGuard packets inside it, so the extra wrapper is not proof of resistance to DPI. WireGuard protects the tunneled payload, while the standard SOCKS5 username/password exchange is sent in cleartext unless the client-to-proxy path is protected separately. Keep those properties distinct when deciding where to use this setup.

Check the relay first, the tunnel second, and the application last. That makes a successful connection useful evidence and an unsuccessful streaming test much easier to interpret.