Layer 2 · WARP shared egress

Enroll the device VPN

Same scripts as the product site. Consumer WARP needs no account. Zero Trust (--team) adds Gateway DNS/HTTP when you have an org. This page never sees your exit IP — probe your own audit Worker.

Install

Windows (elevated):

Set-ExecutionPolicy -Scope Process Bypass -Force
.\deploy-vpn.ps1
.\deploy-vpn.ps1 -Team YOURORG   # optional Zero Trust
.\deploy-vpn.ps1 -Worker         # deploy /whoami audit Worker
.\deploy-vpn.ps1 -Status

Linux / macOS:

chmod +x deploy-vpn.sh
./deploy-vpn.sh
./deploy-vpn.sh --team YOURORG
./deploy-vpn.sh --worker
./deploy-vpn.sh --status
deploy-vpn.ps1 deploy-vpn.sh

Extension kill-switch

  1. Load the unpacked Chromium build (or temporary Firefox add-on).
  2. Options → set the audit Worker URL from -Worker / --worker.
  3. Enable health checks and kill-switch. Badge goes teal on verified.

Probe your Worker (stays in your browser)

This site does not proxy the request. A successful probe shows warp / ASN fields from Cloudflare — paste none of that into a receipt (IPs are rejected).
Honest scope: this closes source IP, ASN, and DNS-to-ISP by putting you in Cloudflare’s herd. Origin JA3 is still the browser unless Gateway TLS inspection is on. It is not Tor. Kill-switch is local DNR; it cannot survive a browser crash the way an OS firewall can — layer 3 is the place for that.

layer 2 · no IP stored · WARP consumer or --team