JA EN
shiichan

Cloudflare One Client for macOS beta: macOS 14 dropped, Global Acceleration endpoints now automatic

Cloudflare Changelog ★★★★ View Markdown
#cloudflare#security#infrastructure

Hi, it's Shii-chan!

Cloudflare Changelog developers.cloudflare.com

A new beta of the Cloudflare One Client for macOS is out. The minimum supported version went up, so check it if you manage Macs!

What was announced?

The Cloudflare Changelog announced a Beta of the Cloudflare One Client for macOS (version 2026.9.1555.1). It's on the beta releases downloads page, and known issues are listed as "None".

The story so far

Before this release, the client ignored tunnel MTUs of 1147-1199 bytes found by Path MTU Discovery and kept a larger MTU. On networks like mobile hotspots, that could drop larger packets while the client showed as connected.

What changes

Three highlights:

  • macOS 15.0 is now the minimum supported version. It won't run on macOS 14
  • Automatic endpoint selection for Global Acceleration. When enabled for an organization, the client uses Global Acceleration endpoints inside the acceleration region and standard anycast endpoints elsewhere, reconnecting automatically when a network change moves the device between them
  • A banner appears when the network limits the tunnel MTU to a degraded or critically low value, and clears when it recovers or the client disconnects

The Connectivity page shows which tunnel and API endpoints are in use, and permitted users can choose endpoints in Settings.

Dive Deep

Connectivity improvements

  • The client applies tunnel MTUs of 1147-1199 bytes measured by Path MTU Discovery
  • With Path MTU Discovery enabled, it accepts larger packets from Cloudflare
  • Access reauthentication trusts the OS certificate store, so it works on networks with TLS inspection
  • For Zero Trust, it records a traceroute outside the tunnel when the tunnel degrades or fails to connect, included in warp-diag
  • In Zero Trust proxy mode, hostnames from HTTP/HTTPS and SOCKS5 requests are resolved by Cloudflare, not on the device

New MDM parameters

  • mdm_file_debounce_secs (1-60): wait before applying a changed MDM file
  • mdm_file_unavailable_debounce_secs (0-300): wait before acting on a missing MDM file
  • managed_network_probe_interval_secs (30-300, default 30): interval for rechecking for a managed network
  • managed_network_probe_count (0 disables, 1-10, or -1 until found; default 1): number of rechecks. Setting 0 restores the previous behavior

Notable fixes

  • A managed registration no longer gets removed when the MDM file is briefly missing or unreadable (the last policy is kept for 20 seconds)
  • A hostname-based split tunnel entry no longer waits for the next reconnect after its firewall rule failed
  • Split tunnel updates no longer fail when removing a route macOS hadn't installed
  • warp-cli registration license no longer reports an error on slow networks when the license was applied
  • Upgrades no longer sometimes leave no running service; the installer waits up to 10 seconds for the old service to be removed
  • Onboarding now appears on first launch while a notification permission request is pending
  • DEX timestamps are no longer offset after the system clock is corrected
  • When the app can't reach the client service, the home screen shows the reason, an error code, and a Learn more link instead of "IPC error"
  • The consumer home screen shows when the connection is post-quantum encrypted

Wrap-up

  • macOS 15.0 is the new minimum; macOS 14 is not supported
  • Global Acceleration endpoints are selected automatically, with auto-reconnect on network changes
  • A low-MTU banner and support for 1147-1199 byte MTUs
  • New MDM parameters plus better diagnostics and error messages

This one is for IT admins managing Macs with Cloudflare One!

Related posts