usque

Free allowance: No service and no account; "an open-source reimplementation of the Cloudflare WARP client's MASQUE mode"
Verdict: self-hosted, last resortverdict qualifies-with-caveat: usable, with a named limit or an unprobed read path. Self-hosted options are listed last, because this site is for users who have no hardware.
Cost: not statedsee Price below
Identity: anonymousno card, no phone
Binding limit: noneno named constraint binds
Evidence: documented4 sources; a first-party page was read and the sentence quoted
Freshness: stale on 2026-11-23checked 2026-10-23 (live); stale on 2026-11-23

Free tier	no service and no account; "an open-source reimplementation of the Cloudflare WARP client's MASQUE mode" unit none; metered on none
Price	USD 0
Binding	none it adds no quota; its value is that it reaches WARP over TCP or HTTP/2 where WireGuard over UDP fails
Identity	anonymous no account; registration is performed by the tool
Egress	not stated by this tool; the traffic reaches Cloudflare WARP; ingress: none free allowance: none published
Interface	cli usque register / enroll / native-tun / socks5 / http-proxy / l4-proxy / port-forward
Tooling	single Go binary; SOCKS5, HTTP, native TUN and port-forward modes
Composes with	composes with any free compute host that blocks WireGuard but allows QUIC or TCP 443, and with the cloudflare-warp record.
Reliability	the README says only the Linux amd64 binary was tested; userspace QUIC is slower than kernel WireGuard by the author's own statement
Notes	The only client that replaces the UDP transport without a second host: it speaks MASQUE over TCP or HTTP/2 to Cloudflare's own edge, so there is no wrapper at the far end. That makes it the one answer to a UDP block that needs nothing but the device. It is also the honest no for the router question, since no .conf exists. Port forward mode is documented, which is the closest it comes to ingress.
Evidence note	documented a probe through the native tunnel or the SOCKS5 mode would raise it
Parsed numbers	price USD 0

Evidence 4

date	source	what it proved
2026-10-23	github.com/Diniboy1123/usque	"leverages the Connect-IP (RFC 9484) protocol" with native tunnel, SOCKS5, HTTP and L4 proxy modes
2026-10-23	github.com/Diniboy1123/usque	"reports that WARP+ doesn't work anymore over WireGuard arose lately" citing wgcf issue 459, and "certain networks block WireGuard, but don't block QUIC"
2026-10-23	github.com/Diniboy1123/usque	release v4.2.1 published 2026-07-20; last push 2026-07-20; 1493 stars
2026-10-23	github.com/Diniboy1123/usque	"MASQUE is userspace, and so is QUIC, the underlying protocol, making the implementation slower"

More fields 9

wg path	registration-api
wg detail	it registers its own WARP device and then carries traffic over MASQUE (Connect-IP, RFC 9484) instead of WireGuard, so there is no .conf and no UDP
ingress	none
volume stated	not stated by this tool; the traffic reaches Cloudflare WARP
bytes transit	yes
transit note	through Cloudflare's MASQUE endpoint
hosting requirement	none; runs on the device and dials Cloudflare's edge
last release	v4.2.1 2026-07-20
stars	1493

Unknown values 3