<# .SYNOPSIS algoblocker - deploy the Cloudflare WARP free-tier VPN and route this Windows device through it. .DESCRIPTION Closes the network-layer fingerprint surfaces the browser extension cannot touch: source IP (shared CF egress pool), ASN (AS13335), DNS (encrypted to 1.1.1.1), and TLS ClientHello (uniform WARP JA3). See ..\ARCHITECTURE.md for the full model. This is NOT anonymity. It shifts network-layer trust from your ISP to Cloudflare. For adversaries who can compel Cloudflare, or for behavioral de-anonymization, use Tor Browser instead. .EXAMPLE .\deploy-vpn.ps1 # install + register consumer WARP (free), connect, verify .EXAMPLE .\deploy-vpn.ps1 -Team myorg # enroll into a Cloudflare Zero Trust org (free, 50 users) .EXAMPLE .\deploy-vpn.ps1 -Mode warp+doh -Worker -BrowserDoh .EXAMPLE .\deploy-vpn.ps1 -Status # show WARP + egress status .EXAMPLE .\deploy-vpn.ps1 -Disconnect # disconnect WARP .NOTES Run in an elevated PowerShell for install + browser-DoH policy writes. Mode: warp (default, full tunnel) | warp+doh | doh | proxy #> [CmdletBinding()] param( [string]$Team = "", [ValidateSet("warp","warp+doh","doh","proxy")][string]$Mode = "warp", [switch]$Worker, [switch]$BrowserDoh, [switch]$Status, [switch]$Disconnect ) $ErrorActionPreference = "Stop" $DohTemplate = "https://cloudflare-dns.com/dns-query" function Say ($m){ Write-Host "> $m" -ForegroundColor Cyan } function Ok ($m){ Write-Host "[+] $m" -ForegroundColor Green } function Warn($m){ Write-Host "! $m" -ForegroundColor Yellow } function Die ($m){ Write-Host "[x] $m" -ForegroundColor Red; exit 1 } function IsAdmin { $p = New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent()) $p.IsInRole([Security.Principal.WindowsBuiltinRole]::Administrator) } # -- locate warp-cli.exe --------------------------------------------- function Warp-Bin { $c = Get-Command warp-cli.exe -ErrorAction SilentlyContinue if ($c) { return $c.Source } foreach ($p in @( "$env:ProgramFiles\Cloudflare\Cloudflare WARP\warp-cli.exe", "${env:ProgramFiles(x86)}\Cloudflare\Cloudflare WARP\warp-cli.exe")) { if (Test-Path $p) { return $p } } return $null } $script:WARP = Warp-Bin # warp-cli's subcommand grammar changed across releases: try the modern form, # fall back to legacy on an "unrecognized subcommand" style failure. function Warp-Raw { param([string[]]$Args) $out = & $script:WARP @Args 2>&1 | Out-String return [pscustomobject]@{ Out = $out; Code = $LASTEXITCODE } } function Warp-Try { param([string[]]$Modern,[string[]]$Legacy) $r = Warp-Raw (@("--accept-tos") + $Modern) if ($r.Code -ne 0 -and $r.Out -match '(?i)unrecognized|unknown|invalid.*subcommand|no such') { $r = Warp-Raw $Legacy } if ($r.Out.Trim()) { Write-Host $r.Out.Trim() -ForegroundColor DarkGray } return $r.Code } function Trace { try { return (Invoke-RestMethod -Uri "https://1.1.1.1/cdn-cgi/trace" -TimeoutSec 8) } catch { return "" } } function Trace-Field { param($Trace,$Key) ($Trace -split "`n" | Where-Object { $_ -like "$Key=*" } | ForEach-Object { $_.Split("=",2)[1] }) -join "" } # -- status / disconnect short-circuits ------------------------------ if ($Status) { if (-not $script:WARP) { Die "WARP is not installed. Run without -Status to install it." } Warp-Try -Modern @("status") -Legacy @("status") | Out-Null Say "egress as origin servers see it:" $t = Trace if ($t) { ($t -split "`n" | Where-Object { $_ -match '^(ip|warp|gateway|loc)=' }) | ForEach-Object { Write-Host " $_" } } else { Warn "no trace (offline?)" } exit 0 } if ($Disconnect) { if (-not $script:WARP) { Die "WARP is not installed." } if ((Warp-Try -Modern @("disconnect") -Legacy @("disconnect")) -eq 0) { Ok "WARP disconnected - traffic is on your ISP again." } else { Warn "disconnect reported an error" } exit 0 } Write-Host "algoblocker VPN " -NoNewline -ForegroundColor White Write-Host "- Cloudflare WARP, network-surface layer" -ForegroundColor DarkGray Write-Host "" # -- 1. capture the ISP baseline ------------------------------------- $ispIp = Trace-Field (Trace) "ip" if ($ispIp) { Say "current public IP (your ISP): $ispIp" } else { Warn "could not read current IP (continuing)" } # -- 2. install WARP if absent --------------------------------------- if ($script:WARP) { Ok "WARP client already installed ($script:WARP)" } else { if (-not (IsAdmin)) { Die "Installing WARP needs an elevated PowerShell. Right-click -> Run as administrator, then re-run." } Say "installing Cloudflare WARP via winget..." if (-not (Get-Command winget -ErrorAction SilentlyContinue)) { Die "winget not found. Install 'App Installer' from the Microsoft Store, or grab WARP from https://1.1.1.1, then re-run." } & winget install --id Cloudflare.Warp -e --accept-source-agreements --accept-package-agreements Start-Sleep -Seconds 3 $script:WARP = Warp-Bin if (-not $script:WARP) { Die "WARP installed but warp-cli.exe not found. Open a new PowerShell and re-run." } Ok "WARP installed" } # ensure the WARP service is running (installer registers 'CloudflareWARP') $svc = Get-Service -Name "CloudflareWARP" -ErrorAction SilentlyContinue if ($svc -and $svc.Status -ne "Running") { try { Start-Service CloudflareWARP; Ok "started CloudflareWARP service" } catch { Warn "could not start CloudflareWARP service (need admin?)" } } for ($i=0; $i -lt 5; $i++) { if ((Warp-Raw @("status")).Code -eq 0) { break }; Start-Sleep 1 } # -- 3. register (consumer) or enroll (Zero Trust) ------------------- $st = (Warp-Raw @("status")).Out if ($st -match '(?i)registration missing|not registered' -or -not $st) { if ($Team) { Say "enrolling into Zero Trust org '$Team' (a browser will open for one-time-PIN auth)..." Warp-Try -Modern @("teams-enroll",$Team) -Legacy @("teams-enroll",$Team) | Out-Null Warn "finish the browser auth, then run: .\deploy-vpn.ps1 -Status" } else { Say "registering a free consumer WARP device (no account needed)..." if ((Warp-Try -Modern @("registration","new") -Legacy @("register")) -ne 0) { Die "registration failed - see output above" } } Ok "device registered" } else { Ok "device already registered" } # -- 4. set tunnel mode + connect ------------------------------------ Say "setting tunnel mode to '$Mode' (full-device: browsers and every app route through WARP)..." Warp-Try -Modern @("mode",$Mode) -Legacy @("set-mode",$Mode) | Out-Null Say "connecting..." if ((Warp-Try -Modern @("connect") -Legacy @("connect")) -ne 0) { Die "connect failed - check 'warp-cli status'" } # -- 5. verify egress actually changed ------------------------------- Say "verifying egress..." $t = ""; for ($i=0; $i -lt 6; $i++){ $t = Trace; if ((Trace-Field $t "warp")){ break }; Start-Sleep 2 } $warpState = Trace-Field $t "warp"; $newIp = Trace-Field $t "ip"; $loc = Trace-Field $t "loc" Write-Host "" if ($warpState -in @("on","plus")) { Ok "WARP active (warp=$warpState)" if ($newIp) { $locTxt = if ($loc) { " ($loc)" } else { "" }; Ok "egress IP now: $newIp$locTxt - shared Cloudflare pool, not yours" } if ($ispIp -and $ispIp -ne $newIp) { Ok "your ISP IP ($ispIp) is no longer visible to sites" } } else { Warn "WARP does not report active (warp='$warpState'). Traffic may still be on your ISP." Warn "check 'warp-cli status'; a conflicting VPN or MDM profile can block WARP from taking the route." } # -- 6. optional: deploy the audit Worker ---------------------------- if ($Worker) { Write-Host ""; Say "deploying the /whoami audit Worker..." $wdir = Resolve-Path (Join-Path $PSScriptRoot "..\worker") $wr = if (Get-Command wrangler -ErrorAction SilentlyContinue) { "wrangler" } elseif (Get-Command npx -ErrorAction SilentlyContinue) { "npx --yes wrangler" } else { $null } if (-not $wr) { Warn "wrangler/npx not found - skipping (install Node, then: cd $wdir; npx wrangler deploy)" } else { Push-Location $wdir try { & cmd /c "$wr deploy"; if ($LASTEXITCODE -eq 0) { Ok "Worker deployed - paste its https://...workers.dev URL into the extension's Options -> VPN health check" } else { Warn "wrangler deploy failed (run 'wrangler login' first?)" } } finally { Pop-Location } } } # -- 7. optional: pin browser DNS to Cloudflare DoH ------------------ if ($BrowserDoh) { Write-Host ""; Say "pinning Chrome/Edge/Firefox DNS to Cloudflare DoH (defense-in-depth if WARP drops)..." if (-not (IsAdmin)) { Warn "browser-DoH policy writes to HKLM and need admin - skipping. Re-run elevated with -BrowserDoh." } else { function Set-Pol($path,$name,$value,$type="String"){ if (-not (Test-Path $path)){ New-Item -Path $path -Force | Out-Null }; New-ItemProperty -Path $path -Name $name -Value $value -PropertyType $type -Force | Out-Null } foreach ($vendor in @("Google\Chrome","Microsoft\Edge")) { $k = "HKLM:\SOFTWARE\Policies\$vendor" Set-Pol $k "DnsOverHttpsMode" "secure" Set-Pol $k "DnsOverHttpsTemplates" $DohTemplate Ok "policy set: $vendor" } $ff = "HKLM:\SOFTWARE\Policies\Mozilla\Firefox\DNSOverHTTPS" Set-Pol $ff "Enabled" 1 "DWord"; Set-Pol $ff "ProviderURL" $DohTemplate; Set-Pol $ff "Locked" 1 "DWord" Ok "policy set: Firefox" Warn "restart your browsers for DoH policy to take effect" } } # -- summary (honest) ------------------------------------------------ Write-Host "" Write-Host "closed by this layer: " -NoNewline -ForegroundColor White Write-Host "source IP, ASN, DNS-to-ISP, TLS JA3 (uniform WARP)." Write-Host "still open: " -NoNewline -ForegroundColor White Write-Host "Cloudflare can see your egress (trust shifted from ISP to CF);" Write-Host " TLS content, logins, and behavioral biometrics are unaffected. Not Tor." Write-Host "verify anytime: .\deploy-vpn.ps1 -Status - turn off: .\deploy-vpn.ps1 -Disconnect" -ForegroundColor DarkGray