If you’re switching between networks with different trust levels—home, café, coworking space—you probably don’t want your VPN behavior to be static.
This guide walks through a clean, system-level way to automatically connect or disconnect Cloudflare WARP depending on your WiFi network name (SSID) using NetworkManager on Linux.
🧠 Why This Matters
Not all networks are equal:
🏠 Trusted WiFi (Home) → You may not need WARP
☕ Public WiFi → You definitely want WARP
🏢 Office networks → Might conflict with VPN routing
Instead of manually toggling WARP every time, we can hook into network state changes and automate it.
⚙️ How It Works
Linux systems using NetworkManager support dispatcher scripts—these are triggered automatically when network events occur (e.g., connecting to WiFi).
We leverage this to:
Detect the current SSID
Apply conditional logic
Toggle WARP accordingly via CLI
🔧 Step-by-Step Implementation
1. Ensure WARP CLI is Installed
You should already have warp-cli available. If not, install Cloudflare WARP first.
Then register and test:
warp-cli register
warp-cli connect
warp-cli status
2. Create a NetworkManager Dispatcher Script
Dispatcher scripts live here:
/etc/NetworkManager/dispatcher.d/
Create a new script:
sudo nano /etc/NetworkManager/dispatcher.d/99-warp-toggle
3. Add Logic Based on SSID
Paste the following:
#!/bin/bash
INTERFACE="$1"
STATUS="$2"
# Trigger only when a connection is established
if [ "$STATUS" = "up" ]; then
SSID=$(iwgetid -r)
if [ "$SSID" = "home_wifi" ]; then
echo "Connecting WARP for $SSID"
warp-cli connect
elif [ "$SSID" = "office_wifi" ]; then
echo "Disconnecting WARP for $SSID"
warp-cli disconnect
else
echo "Unknown network: $SSID — no action taken"
fi
fi
4. Make the Script Executable
sudo chmod +x /etc/NetworkManager/dispatcher.d/99-warp-toggle
5. Apply Changes
Restart NetworkManager:
sudo systemctl restart NetworkManager
Or simply reconnect your WiFi.
🧪 Testing
Switch between your networks:
Verify with:
warp-cli status
⚠️ Things to Watch Out For
SSID detection relies on iwgetid — ensure it’s installed
Dispatcher scripts run as root, so be careful with permissions and logging
Some networks may block WARP traffic, causing connection failures
Avoid adding too many rapid toggles (though WARP CLI is fairly tolerant)
🧩 Optional Enhancements
If you want to level this up:
🔹 Add Logging
echo "\((date): Connected to \)SSID" >> /var/log/warp-toggle.log
🔹 Handle More Networks
Expand your conditions into a case statement:
case "$SSID" in
"home_wifi")
warp-cli connect
;;
"office_wifi")
warp-cli disconnect
;;
esac
🔹 Default Behavior
Set a fallback (e.g., always connect WARP unless explicitly disabled)
💡 Final Thoughts
This approach is powerful because it’s:
Event-driven (no polling loops)
Lightweight (no extra services needed)
Extensible (you can hook in more automations)
You’re essentially turning your machine into a context-aware system—reacting intelligently to its environment.
Once you get comfortable with dispatcher scripts, this pattern opens up a lot of automation possibilities beyond VPNs.
If you’re building out a more advanced workflow system (especially with tools like n8n or custom daemons), this can serve as a solid foundation for network-aware automation.
🚀
