Automating Cloudflare WARP Based on WiFi SSID (Linux Guide)

If you frequently switch between trusted and untrusted networks, manually toggling your VPN becomes...

If you frequently switch between trusted and untrusted networks, manually toggling your VPN becomes tedious fast.

This guide shows how to automatically connect or disconnect Cloudflare WARP based on your WiFi network name (SSID) using NetworkManager on Linux.

🧠 Why This Matters

Not all networks are equal:

• 🏠 Trusted WiFi (Home) → You may not need WARP
• ☕ Public WiFi → You definitely want WARP
• 🏢 Office networks → Might conflict with VPN routing

Instead of manually toggling WARP every time, we can hook into network state changes and automate it.

⚙️ How It Works

Linux systems using NetworkManager support dispatcher scripts—these are triggered automatically when network events occur (e.g., connecting to WiFi).

We leverage this to:

1. Detect the current SSID
2. Apply conditional logic
3. Toggle WARP via CLI

🔧 Step-by-Step Implementation

1. Ensure WARP CLI is Installed

Make sure warp-cli is available. Then register and test:

warp-cli register
warp-cli connect
warp-cli status

2. Create a NetworkManager Dispatcher Script

Dispatcher scripts live here:

/etc/NetworkManager/dispatcher.d/

Create a new script:

sudo nano /etc/NetworkManager/dispatcher.d/99-warp-toggle

3. Add Logic Based on SSID

#!/bin/bash

INTERFACE="$1"
STATUS="$2"

# Trigger only when a connection is established
if [ "$STATUS" = "up" ]; then
    SSID=$(iwgetid -r)

    if [ "$SSID" = "home_wifi" ]; then
        echo "Connecting WARP for $SSID"
        warp-cli connect

    elif [ "$SSID" = "office_wifi" ]; then
        echo "Disconnecting WARP for $SSID"
        warp-cli disconnect

    else
        echo "Unknown network: $SSID — no action taken"
    fi
fi

4. Make the Script Executable

sudo chmod +x /etc/NetworkManager/dispatcher.d/99-warp-toggle

5. Apply Changes

Restart NetworkManager:

sudo systemctl restart NetworkManager

Or simply reconnect your WiFi.

🧪 Testing

Switch between your networks:

• Connect to home_wifi → WARP should connect
• Connect to office_wifi → WARP should disconnect

Verify with:

warp-cli status

⚠️ Things to Watch Out For

• Requires iwgetid (usually part of wireless-tools)
• Dispatcher scripts run as root
• Some networks may block WARP traffic
• Avoid rapid toggling (WARP CLI is tolerant, but don’t spam it)

🧩 Optional Enhancements

🔹 Add Logging

echo "$(date): Connected to $SSID" >> /var/log/warp-toggle.log

🔹 Use a case Statement (Cleaner Scaling)

case "$SSID" in
  "home_wifi")
    warp-cli connect
    ;;
  "office_wifi")
    warp-cli disconnect
    ;;
  *)
    echo "No rule for $SSID"
    ;;
esac

🔹 Default Behavior Strategy

You can invert the logic:

• Always connect WARP by default
• Explicitly disable only on trusted networks

💡 Final Thoughts

This approach is:

• ⚡ Event-driven — no polling loops
• 🪶 Lightweight — no extra services
• 🔌 Extensible — plug in more automations

You’re essentially turning your machine into a context-aware system—reacting intelligently to its environment.

Once you get comfortable with dispatcher scripts, you can extend this pattern to:

• Auto-sync files on trusted networks
• Trigger backups only at home
• Change DNS / proxies dynamically

Happy hacking 🚀