iCloud Private Relay Not Working

[bobbob]

Expected Behaviour:

iPhone IOS 15.0.2 with private relay enabled shows isn't compatible with iCloud Private Relay, and should be.

Actual Behaviour:

Setting the iphone to use 8.8.8.8 on the same WiFi network allows icloud private relay to work. Disabling pi-hole or allow-listing an individual client doesn't allow it to work either.

This is a fresh Docker install.

There are no blocked entries for mask.icloud.com or mask-h2.icloud.com (which as I understand it are the key records to allow for it to work)

Debug Token:

https://tricorder.pi-hole.net/GtR1cAla/

[yubiuser]

• Add special handling of iCloud Private Relay domains
  Implement special handling of Apple iCloud Private Relay domains to prevent Apple devices from bypassing Pi-hole.

Pi-hole FTL v5.10.1, Web v5.7 and Core v5.5 released

Originally published at: https://pi-hole.net/2021/09/29/pi-hole-ftl-v5-10-web-v5-7-and-core-v5-5-released/ As always, please read through the changelog before updating with pihole -up. A new tag for docker image will arrive shortly. Highlights Changes in the embedded dnsmasq-v2.87rc1: Fix crash if combining server=/domain/# is combined with address=/domain/1.2.3.4(issue reported by Pi-hole) Add all defined RR types to the table of type names used for query logging (Pi-hole provided patc…

You can turn it off by setting BLOCK_ICLOUD_PR=false in /etc/pihole/pihole-FTL.conf followed by a pihole restartdns

https://docs.pi-hole.net/ftldns/configfile/#icloud_private_relay

[bobbob]

But I want to allow network users to use Private Relay if they want, I don't care about globally disabling it.

There's something not working correctly at the moment - or have I misunderstood the changes in 5.10.1 (I am on 5.10.2) which means that pi-hole will always NXDOMAIN the Apple domains irrespective of what the query log says?

[Coro]

@bobbob

But I want to allow network users to use Private Relay if they want

Do as said above:

@yubiuser

You can turn it off by setting BLOCK_ICLOUD_PR=false in /etc/pihole/pihole-FTL.conf followed by a pihole restartdns

[bobbob]

OK, great that works.

Yes, I fully accept I need to read the instructions but having DNS behaviour overridden in a non obvious way is a bit frustrating.

Thanks for the help!

[yubiuser]

@bobbob

There's something not working correctly at the moment - or have I misunderstood the changes in 5.10.1 (I am on 5.10.2) which means that pi-hole will always NXDOMAIN the Apple domains irrespective of what the query log says?

Yes. As long as you don't disable the option in the config file it will always reply with NXDOMAIN. Does the query log says something different for you?

[bobbob]

The query log was always showing as permitted, yes, hence it was not obvious to work out what was going on. I assumed the query log was the "truth" but I guess FTL has its own behaviour downstream.

[yubiuser]

And the Reply? Should have been NXDOMAIN.

[bobbob]

I'm pretty sure it was A/AAAA OK/Cached. but I've had to blow the Docker image away and start again now, so sorry, can't easily check.

I'm 99% sure I also checked on other clients using the pi-hole for valid nslookup entries for the Apple domains as well when I was troubleshooting.

[DL6ER]

@bobbob

overridden in a non obvious way

What would be a more obvious but still not obtrusive way? We block the Mozilla canary domain the same way. Mozilla even asks developers of projects to do this to preserve local DNS functionality. It is handled by a similar config flag.

[bobbob]

It's totally legit functionality - I guess if it were a web UI tick box instead of text config maybe?

Or that the query log said "Blocked by FTL config" ?

[Coro]

I vote for a new query status as well. However, I'm not so sure about showing a working canary domain block in red. But I can see that opinions may differ on this aspect.