Apple Private Relay slowdown

Follow

David Koppenhofer

• June 24, 2022 23:55

I used the Apple Private Relay target list to block it on my network.

My wife complains about Internet problems with her iPhone now, and I ran across the following note from Apple:

Allow for network traffic audits

Some enterprise or school networks might be required to audit all network traffic by policy, and your network can block access to Private Relay in these cases. The user will be alerted that they need to either disable Private Relay for your network or choose another network.

The fastest and most reliable way to alert users is to return either a "no error no answer" response or an NXDOMAIN response from your network’s DNS resolver, preventing DNS resolution for the following hostnames used by Private Relay traffic. Avoid causing DNS resolution timeouts or silently dropping IP packets sent to the Private Relay server, as this can lead to delays on client devices.

 

Is there a way I can do this in Firewalla? I'm comfortable with ssh and the command line, though not necessarily the low level network commands.

0

• 

  Support Team

  • June 25, 2022 02:52

  Firewalla will return NXDOMAIN to devices when the domain is blocked. You may try nslookup mask.icloud.com on one of your devices to check the response.

  0

  Comment actions Permalink
• 

  David Koppenhofer

  • June 25, 2022 17:55

  Ah, fantastic, thank you for pointing that out!

   

  I'll have to dig into what's happening with my wife's phone. Would the block of doh.dns.apple.com (or even the Apple Private Relay) servers cause issues - even with the NXDOMAIN response?

   

  Final question: my phone is in a group that's configured to use Unbound, and also DoH is configured for "all devices". The nslookup appears to be using 8.8.8.8 as its server.

  ~ $ nslookup doh.dns.apple.com

  Server: 8.8.8.8

  Address: 8.8.8.8#53

   

  ** server can't find doh.dns.apple.com: NXDOMAIN

  dnsleaktest.com correctly shows my external IP address. Am I misunderstanding the nslookup output?

   

  Thanks,

  David

  0

  Comment actions Permalink
• 

  Firewalla

  • June 25, 2022 18:31

  Nslookup requests will be forwarded to what ever DNS services you picked. So, if you setup unbound and your PC configured to be 8.8.8.8, it will use unbound, while your PC may still think it is 8.8.8.8

  0

  Comment actions Permalink
• 

  David Koppenhofer

  • June 25, 2022 23:06

  I found the reason the nslookup via Termux wasn't using the system settings, but /usr/etc/resolv.conf

  https://www.reddit.com/r/pihole/comments/iivdgq/psa_termux_on_android_does_not_use_system_dns/?utm_medium=android_app&utm_source=share

  Thanks again for the help!

  0

  Comment actions Permalink

Please sign in to leave a comment.