A CLI tool that controls Cloudflare WARP via wgcf and enforces an nftables kill switch to block all non-tunnel traffic if the tunnel drops.

Stars

7

7-day growth

No data

Forks

0

Open issues

0

License

MIT

Last updated

2026-07-12

AI repository intelligence
FR-AI / ANALYSIS

Why it is worth attention

It provides a robust, non-bypassable kill switch using nftables drop verdict, deliberately excludes DNS and LAN exceptions to prevent leaks, and works seamlessly with Tailscale.

Who it is for

  • Privacy-conscious users running Cloudflare WARP
  • Users who need a reliable kill switch for WireGuard tunnels
  • Arch Linux users (tested) and Debian/Ubuntu users
  • Developers or sysadmins managing VPN setups alongside Tailscale

Use cases

  • Prevent real IP leakage when a WARP tunnel goes down unexpectedly
  • Ensure only tunnel traffic exits the machine, blocking all other outbound connections
  • Run a kill switch that coexists with Tailscale and other nftables rules
  • Automate boot-time setup of WARP and kill switch via systemd services

Strengths

  • Immediate, uncircumventable block via nftables drop verdict
  • No DNS or LAN exemptions, so ISP DNS or local subnet leaks are impossible
  • Supports both IPv4 and IPv6, including neighbor discovery
  • Boot persistence via nftables.service and wg-quick@wgcf.service

Considerations

  • Requires pre-configured wgcf and `/etc/wireguard/wgcf.conf`
  • Intentionally isolates LAN access while kill switch is active (no local subnet traffic)
  • Debian/Ubuntu support is implemented but not yet confirmed on real hardware

README quick start

Usage

Description

Minimal CLI tool to manage a Cloudflare WARP (wgcf) tunnel with an nftables kill switch that blocks all traffic unless the VPN is active, preventing IP leaks.

Related repositories

Similar projects matched by category, topics, and programming language.

PostmanReminisce
PostmanReminisce GitHub avatar

Wisp-VPN

Wisp VPN is an open-source, free Windows VPN client based on WireGuard targeting users in Russia and CIS to bypass censorship without registration, logs, or speed limits.

C#
118
bjan
Featured
bjan GitHub avatar

claudemux

Claudemux is a lightweight, dependency-minimal message bus that lets multiple Claude Code sessions communicate in real-time over tmux, enabling one session to ask another a question and receive the answer without manual intervention.

AI & Machine LearningAI Agents
9
l0ng-ai
Featured
l0ng-ai GitHub avatar

tty7

tty7 is a fast, GPU-accelerated terminal workbench with persistent sessions, built-in input tools, SSH support, and coding agent awareness.

Developer ToolsCLI & Terminal
359