Automating Cloudflare WARP Based on WiFi SSID (Linux Guide)

If you frequently switch between trusted and untrusted networks, manually toggling your VPN becomes tedious fast. This guide shows how to **automatically connect or disconnect Cloudflare WARP based on your WiFi network name (SSID)** using NetworkManager on Linux. --- ## 🧠 Why This Matters Not all networks are equal: - 🏠 **Trusted WiFi (Home)** → You may not need WARP - ☕ **Public WiFi** → You *definitely* want WARP - 🏢 **Office networks** → Might conflict with VPN routing Instead of manually toggling WARP every time, we can hook into **network state changes** and automate it. --- ## ⚙️ How It Works Linux systems using NetworkManager support **dispatcher scripts**—these are triggered automatically when network events occur (e.g., connecting to WiFi). We leverage this to: 1. Detect the current SSID 2. Apply conditional logic 3. Toggle WARP via CLI --- ## 🔧 Step-by-Step Implementation ### 1. Ensure WARP CLI is Installed Make sure `warp-cli` is available. Then register and test: ```bash warp-cli register warp-cli connect warp-cli status ``` ### 2. Create a NetworkManager Dispatcher Script Dispatcher scripts live here: ```bash /etc/NetworkManager/dispatcher.d/ ``` Create a new script: ```bash sudo nano /etc/NetworkManager/dispatcher.d/99-warp-toggle ``` ### 3. Add Logic Based on SSID ```bash #!/bin/bash INTERFACE="$1" STATUS="$2" # Trigger only when a connection is established if [ "$STATUS" = "up" ]; then SSID=$(iwgetid -r) if [ "$SSID" = "home_wifi" ]; then echo "Connecting WARP for $SSID" warp-cli connect elif [ "$SSID" = "office_wifi" ]; then echo "Disconnecting WARP for $SSID" warp-cli disconnect else echo "Unknown network: $SSID — no action taken" fi fi ``` ### 4. Make the Script Executable ```bash sudo chmod +x /etc/NetworkManager/dispatcher.d/99-warp-toggle ``` ### 5. Apply Changes Restart NetworkManager: ```bash sudo systemctl restart NetworkManager ``` Or simply reconnect your WiFi. ### 🧪 Testing Switch between your networks: - Connect to `home_wifi` → WARP should connect - Connect to `office_wifi` → WARP should disconnect Verify with: ```bash warp-cli status ``` ### ⚠️ Things to Watch Out For - Requires `iwgetid` (usually part of `wireless-tools`) - Dispatcher scripts run as root - Some networks may block WARP traffic - Avoid rapid toggling (WARP CLI is tolerant, but don’t spam it) ### 🧩 Optional Enhancements 🔹 Add Logging ```bash echo "$(date): Connected to $SSID" >> /var/log/warp-toggle.log ``` ### 🔹 Use a case Statement (Cleaner Scaling) ```bash case "$SSID" in "home_wifi") warp-cli connect ;; "office_wifi") warp-cli disconnect ;; *) echo "No rule for $SSID" ;; esac ``` ### 🔹 Default Behavior Strategy You can invert the logic: - Always connect WARP by default - Explicitly disable only on trusted networks ### 💡 Final Thoughts This approach is: - ⚡ Event-driven — no polling loops - 🪶 Lightweight — no extra services - 🔌 Extensible — plug in more automations You’re essentially turning your machine into a context-aware system—reacting intelligently to its environment. Once you get comfortable with dispatcher scripts, you can extend this pattern to: - Auto-sync files on trusted networks - Trigger backups only at home - Change DNS / proxies dynamically Happy hacking 🚀