What is usque?

usque is an unofficial, open-source CLI tool that reimplements Cloudflare WARP's MASQUE mode using the Connect-IP protocol (RFC 9484). It lets users register a WARP account and then run the tunnel in several modes: a native TUN device (Linux/Windows), SOCKS5 proxy, HTTP proxy with CONNECT support, lighter L4 TCP-only variants of both proxies, and a port-forwarding mode for WARP-to-WARP device communication. It supports both personal WARP and Cloudflare ZeroTrust (with manual token setup), offers connect/disconnect hooks for route management, and can fall back to TCP/HTTP/2 when QUIC is blocked. The program is written in Go, distributed as static binaries for Linux, Windows, macOS, Android, and iOS, and can also be built via the provided Dockerfile. Only the Linux amd64 binary is tested by the author. Configuration is stored in a JSON file containing keys, endpoints, and assigned IP addresses.

Should you self-host usque?

usque scores 53/100 on selfhost.directory (how scoring works) and ranks #29 of 56 in VPN. It has 1 503 GitHub stars.

It shipped 9 stable releases in the past year. The latest, v4.2.1, came out on 20 July 2026. New versions land roughly every 4 days.

Setup is moderate: expect some configuration beyond a single command. It is MIT-licensed and written mostly in Go.

Its closest alternative on selfhost.directory is Tailscale (84/100, 38 215 stars). It scores higher overall, so compare the two before you pick. See usque vs Tailscale side by side.

Features

Connect/Disconnect Hooks
Cross-platform binariesOnly Linux amd64 tested by author
HTTP proxy
L4 TCP-only Proxies
Native TUN TunnelLinux and Windows only; requires root/admin privileges
Port ForwardingRequires ZeroTrust setup and manual configuration
SOCKS5 Proxy
TCP/HTTP/2 Fallback
ZeroTrust SupportSSO login not supported; requires manual token setup

How to configure usque

access_tokenAccess token given by the server upon registration/login. Used for API calls.
Access token given by the server upon registration/login. Used for API calls.
endpoint_h2_v4162.159.198.2IPv4 address used by --http2. Defaults to 162.159.198.2 when empty.
IPv4 address used by --http2. Defaults to 162.159.198.2 when empty.
endpoint_h2_v6IPv6 address used by --http2. Empty by default and must be set manually for HTTP/2 over IPv6.
IPv6 address used by --http2. Empty by default and must be set manually for HTTP/2 over IPv6.
endpoint_pub_keyBase64 encoded ECDSA public key on the NIST P-256 curve in PEM format. Used to verify the Cloudflare WARP endpoint.
Base64 encoded ECDSA public key on the NIST P-256 curve in PEM format. Used to verify the Cloudflare WARP endpoint.
endpoint_v4IPv4 address of the Cloudflare WARP endpoint. Used for connecting to the WARP network.
IPv4 address of the Cloudflare WARP endpoint. Used for connecting to the WARP network.
endpoint_v6IPv6 address of the Cloudflare WARP endpoint. Used for connecting to the WARP network.
IPv6 address of the Cloudflare WARP endpoint. Used for connecting to the WARP network.
idDevice ID given by the server. Used for device identification and API calls.
Device ID given by the server. Used for device identification and API calls.
ipv4Internal IPv4 address assigned to the device by the Cloudflare WARP network.
Internal IPv4 address assigned to the device by the Cloudflare WARP network.
ipv6Internal IPv6 address assigned to the device by the Cloudflare WARP network.
Internal IPv6 address assigned to the device by the Cloudflare WARP network.
licenseLicense returned by the server for the account. Allows pairing multiple devices to the same account.
License returned by the server for the account. Allows pairing multiple devices to the same account.
private_keyBase64 encoded ECDSA private key on the NIST P-256 curve in ASN.1 DER format. Used for device authentication.
Base64 encoded ECDSA private key on the NIST P-256 curve in ASN.1 DER format. Used for device authentication.