Forum Discussion

ddaniel's avatar
ddaniel
Icon for Making Connections rankMaking Connections
4 months ago

Blocking icloud private relay "nicely"

I would like to block "icloud private relay" in such a way that the user would be notified and able to continue without icloud private relay.   Apple's recommended way to do this is to block DNS requests to mask.icloud.com and mask-h2.icloud.com so a "no error/no answer" or NXDOMAIN response is returned. This alerts the users that they either need to disable private relay or choose another network.  Details are here: Prepare your network or web server for iCloud Private Relay - iCloud - Apple Developer
  Is there a way to configure this using only Cato?  I cannot see how to create a custom DNS rule to block specific queries, and I cannot see how to create a custom IPS rule either.
  Is there a recommended way to do this?  What are others doing?  I am in a Windows shop.  I could redirect DNS queries to a Windows DNS server and use DNS query filtering, but would rather do a Cato only solution if possible.

Per Apple:  Some enterprise or school networks might be required to audit all network traffic by policy, and your network can block access to Private Relay in these cases. The user will be alerted that they need to either disable Private Relay for your network or choose another network.

The fastest and most reliable way to alert users is to return either a "no error no answer" response or an NXDOMAIN response from your network’s DNS resolver, preventing DNS resolution for the following hostnames used by Private Relay traffic. Avoid causing DNS resolution timeouts or silently dropping IP packets sent to the Private Relay server, as this can lead to delays on client devices.

mask.icloud.com mask-h2.icloud.com


 

7 Replies

  • MichaelQ's avatar
    MichaelQ
    Icon for Making Connections rankMaking Connections
    4 months ago

    I'd think if you block QUIC, that would take care of it. I think Cato recommends you do this anyway. 

    If for some reason you can't block QUIC completley via the internet firewall, I suppose you could make a custom app for UDP/443 to the relevant domains and block that. 

    iCloud Private Relay uses QUIC, a new standard transport protocol based on UDP. QUIC connections in Private Relay are set up using port 443

  • SMBD24's avatar
    SMBD24
    Icon for Making Connections rankMaking Connections
    22 days ago

    ddaniel​ Just wanted to say that you are not crazy! I am very familiar with this prompt. We use Cisco Umbrella and they offer a backend configuration change you can request to perform Apple's recommended approach. BUT especially with cellular devices I think they hop back and forth between WiFi and Cellular at times and it will throw that message a few times a day sometimes. 

    I wish it was easier to manage from an enterprise standpoint as well... but likely it's overcomplicated deliberately to discourage disableing Apple's "magic".

  • ddaniel's avatar
    ddaniel
    Icon for Making Connections rankMaking Connections
    4 months ago

    Thanks for the reply.  I do block QUIC which makes it stop working but doesn't alert the user.  In most cases, they need to manually turn it off to work.  And our support folks get a call as to why their wifi is not working.  My goal is to block it cleanly so that their phone or macbook lets them know what is going on.   According to Apple, the proper way is to return NXDOMAIN to the DNS queries.  But the DNS queries are not blocked, only their access once the device tries to enable the icloud private relay.

    I think that if the DNS filtering offered custom rules, I could block the two DNS records they use to enable it and that would trigger the device to gracefully alert the user.  Although the DNS query needs a NXDOMAIN reply and the DNS filtering may only offer to drop the request.

    • Cato_Fan_2024's avatar
      Cato_Fan_2024
      Icon for Making Connections rankMaking Connections
      2 months ago

      That's odd because we block Apple private relay without any complaints.  We do this by blocking the Anonymizers category, and we also block QUIC as a service.

      • ddaniel's avatar
        ddaniel
        Icon for Making Connections rankMaking Connections
        2 months ago

        Cato_Fan_2024,

        Do you know if your users are being alerted on their Apple devices?  We are blocking Apple private relay, but users are confused, and our support desk has to tell them to turn off Apple private relay.  Apple's documentation indicates that they should be alerted on their device that they need to disable it.


        your network can block access to Private Relay in these cases. The user will be alerted that they need to either disable Private Relay for your network or choose another network.

  • Mihai's avatar
    Mihai
    Icon for Cato Professional Services rankCato Professional Services
    18 days ago

    Hi ddaniel,
    I think it's a great idea for the idea hub! Please post this request there!
    Thanks,
    Mihai