Faster SASE Proxy with QUIC: Cloudflare’s Breakthrough

The Problem with Traditional Proxy Mode

Zero trust security often relies on proxies to secure web traffic, but users frequently face performance trade-offs. Slow browsers, laggy video calls, and stalled file transfers become common complaints after deploying proxy mode. The root cause? Legacy architectures like WireGuard struggle to handle modern TCP demands while maintaining security.

Cloudflare’s initial approach used smoltcp—a Rust-based TCP implementation—to bridge the gap between application-layer (L4) traffic and WireGuard’s Layer 3 tunnel. While functional, this method introduced bottlenecks. Smoltcp’s lack of modern TCP features and the need to convert L4 to L3 packets created a performance ceiling, especially on media-heavy sites with dozens of concurrent connections.

Introducing Direct L4 Proxying with QUIC

To solve this, Cloudflare re-engineered its SASE client to leverage QUIC (Quick UDP Internet Connections) for proxy mode. This shift eliminates the need for smoltcp and WireGuard, enabling direct Layer 4 proxying through QUIC streams. Here’s how it works:

• Bypassing smoltcp: Traffic remains at Layer 4, avoiding inefficient IP packet conversions.
• Native QUIC Benefits: Modern congestion control and flow management optimize speed and stability.
• Tuneability: Cloudflare’s edge and client can dynamically adjust QUIC parameters for peak performance.

Internal testing showed download/upload speeds doubling and latency dropping significantly. This isn’t just incremental improvement—it’s a fundamental architectural shift.

Who Benefits Most?

Three key use cases gain immediate value:

1. Coexistence with Legacy VPNs: Organizations using dual SASE setups for redundancy or compliance can now layer security without performance penalties.
2. High-Bandwidth Applications: Streaming HD content or transferring large datasets via proxy mode is now seamless.
3. Developers & Power Users: SOCKS5 listeners for CLI tools and APIs now leverage QUIC’s low-latency global network.

How to Enable QUIC SASE Proxy

To access these improvements:

1. Update to Cloudflare One Client version 2025.8.779.0+.
2. Log in to the Cloudflare One dashboard and navigate to Teams & Resources > Devices > Device profiles > General profiles.
3. Set Service mode to Local proxy mode and Device tunnel protocol to MASQUE.
4. Verify the active protocol with: warp-cli settings | grep protocol.

For free access to Cloudflare SASE, sign up for a 50-user trial and experience the speed-boosted Zero Trust architecture firsthand.

Conclusion

Cloudflare’s QUIC-based SASE proxy redefines what’s possible in secure, high-performance networking. By eliminating legacy bottlenecks, this update ensures security and speed coexist. Whether you’re managing a hybrid workforce or optimizing developer workflows, the future of proxy mode is here.

Ready to upgrade? Visit 1.1.1.1 to start securing your network with Cloudflare’s global infrastructure.

FAQ

How does QUIC improve SASE proxy performance?

QUIC’s direct L4 proxying bypasses inefficient L3 conversions, enabling faster data transfer and lower latency.

Can I use this with existing third-party VPNs?

Yes—Cloudflare’s proxy mode works seamlessly with legacy VPNs for hybrid Zero Trust setups.

What client versions support QUIC proxying?

Minimum version 2025.8.779.0 for Windows, macOS, and Linux.

Does this affect non-browser traffic?

No—only browser traffic routed through the proxy benefits from QUIC optimizations.

How do I verify my active protocol?

Run warp-cli settings | grep protocol in your terminal.