A QUICker SASE client: re-building Proxy Mode

Cloudflare rebuilt the Cloudflare One Client’s proxy mode to address performance problems caused by translating TCP traffic into IP packets through WireGuard. The new design uses HTTP/3 and QUIC streams for direct Layer 4 proxying, eliminating the smoltcp translation layer. Internal tests showed download and upload speeds doubling while latency decreased significantly.

Limitations of the Original Proxy Architecture

• Proxy mode exposed a local SOCKS5 or HTTP proxy for broad application compatibility.
• WireGuard operates at Layer 3, while proxy traffic arrives as Layer 4 TCP streams.
• The Client used the Rust-based smoltcp stack to convert TCP streams into IP packets.
• Cloudflare’s edge then converted those packets back into TCP streams.
• This added overhead, limited access to modern TCP features, and caused sluggish performance for media-heavy websites, large transfers, and video calls.

Direct Layer 4 Proxying with QUIC

• Cloudflare deprecated WireGuard for proxy mode and adopted QUIC-based transport.
• HTTP/3’s CONNECT method encapsulates proxy traffic directly in QUIC streams rather than breaking it into Layer 3 packets.
• The new architecture:
  • Removes the smoltcp translation layer.
  • Uses QUIC’s built-in congestion and flow control.
  • Allows the Client and Cloudflare edge to tune transport parameters for performance.
• Testing showed approximately doubled upload and download speeds and substantially reduced latency.

Use Cases That Benefit

• Third-party VPN coexistence: Users can combine legacy VPNs for on-premises resources with zero trust web security without imposing as much performance loss.
• Application partitioning: Specific browser traffic can be routed through Cloudflare Gateway while other operating-system traffic remains on the local network.
• High-bandwidth workloads: Streaming, large dataset transfers, and other data-intensive applications receive faster proxy connections.
• Developer and CLI workflows: Tools using the SOCKS5 listener benefit from lower-latency API calls and data transfers.

Availability and Configuration

• The improvement requires Cloudflare One Client version 2025.8.779.0 or later on Windows, macOS, or Linux.
• In the Cloudflare One dashboard:
  • Go to Teams & Resources > Devices > Device profiles > General profiles.
  • Set Service mode to Local proxy mode.
  • Set Device tunnel protocol to MASQUE.
• Verify the active protocol with:

warp-cli settings | grep protocol

Organizations using proxy mode should upgrade the client and switch to MASQUE to gain the new QUIC-based performance improvements.