# iCloud Private Relay problems
**URL:** https://discourse.pi-hole.net/t/icloud-private-relay-problems/66764
**Category:** Customizing Pi-hole
**Created:** [December 5, 2023, 5:35pm UTC](https://discourse.pi-hole.net/t/icloud-private-relay-problems/66764 "2023-12-05T17:35:49Z")
**Posts on this page:** 10
**Page:** 1
### Author:  [@MatejKovacic](https://discourse.pi-hole.net/u/MatejKovacic)
#### Post date: [December 5, 2023, 5:35pm UTC](https://discourse.pi-hole.net/t/icloud-private-relay-problems/66764/1 "2023-12-05T17:35:49Z")
I have Pi-hole `v5.17.1` (docker version), FTL `v5.23` and Web Interface `v5.20.1`.
One of my users is using iCloud Private Relay (basically, this it is an Apple's implementation of oDoH (Oblivious DNS over HTTPS), meaning that iDevices are using an Apple's proxy server (relay) to avoid the destination DNS server knowing who is sending which DNS requests).
What I did?
```auto
sudo docker exec -it pihole bash
nano /etc/dnsmasq.d/02-NXDOMAIN.conf
```
In that file I added:
```auto
server=/mask.icloud.com/
server=/mask-h2.icloud.com/
```
And then restarted FTL: `sudo service pihole-FTL restart`.
Now, the problem is, that iDevices are still saying, that iCloud Private Relay is not working. Is there any option to block them in a way, that iPhones will not be complaining about that?
---
### Author:  [@Bucking\_Horn](https://discourse.pi-hole.net/u/Bucking_Horn)
#### Post date: [December 5, 2023, 7:26pm UTC](https://discourse.pi-hole.net/t/icloud-private-relay-problems/66764/2 "2023-12-05T19:26:29Z")
You can either have iCloud's relaying or Pi-hole's filtering.
Pi-hole is already signaling its clients to switch off iCloud in its presence, providing the recommended answers for the domains by default (so it isn't necessary to manually configure them like you tried to).
Pi-hole's behaviour can be controlled via the [**`BLOCK_ICLOUD_PR`**](https://docs.pi-hole.net/ftldns/configfile/#icloud_private_relay) setting in pihole-FTL's [configuration](https://docs.pi-hole.net/ftldns/configfile/).
Note that if you'd switch that to **`false`** , clients using Apple's iCloud Private Relay would always by-pass Pi-hole.
---
### Author:  [@MatejKovacic](https://discourse.pi-hole.net/u/MatejKovacic)
#### Post date: [December 5, 2023, 9:18pm UTC](https://discourse.pi-hole.net/t/icloud-private-relay-problems/66764/3 "2023-12-05T21:18:20Z")
So if I understand - if I set `BLOCK_ICLOUD_PR` to `false`, PiHole filtering will be working for all devices, except iDevices (and iDevices won't complaing about iCloud relay not working)?
---
### Author:  [@jfb](https://discourse.pi-hole.net/u/jfb)
#### Post date: [December 6, 2023, 1:51am UTC](https://discourse.pi-hole.net/t/icloud-private-relay-problems/66764/4 "2023-12-06T01:51:03Z")
> [@MatejKovacic](#):
>
> if I set `BLOCK_ICLOUD_PR` to `false`, PiHole filtering will be working for all devices, except iDevices (and iDevices won't complaing about iCloud relay not working)
Generally yes. The iDevices will use Pi-hole if you have iCloud Private Relay disabled on an individual device. If you enable iCloud PR on a device, that device will use it and won't use Pi-hole for DNS.
You will need to decide for yourself if you would rather have ad-blocking via Pi-hole or some anonymity gained through iCloud PR.
> [@MatejKovacic](#):
>
> What I did?
>
> ```auto
> sudo docker exec -it pihole bash
> nano /etc/dnsmasq.d/02-NXDOMAIN.conf
>
> ```
>
> In that file I added:
>
> ```auto
> server=/mask.icloud.com/
> server=/mask-h2.icloud.com/
>
> ```
>
> And then restarted FTL: `sudo service pihole-FTL restart`.
Pi-hole already does this through an FTL setting.
> **[Configuration - Pi-hole documentation](https://docs.pi-hole.net/ftldns/configfile/#icloud_private_relay)**
Note that the Apple implementation of blocking iCloud PR calls for a response of NXDOMAIN to the two canary domains.
---
### Author:  [@Bucking\_Horn](https://discourse.pi-hole.net/u/Bucking_Horn)
#### Post date: [December 6, 2023, 3:50am UTC](https://discourse.pi-hole.net/t/icloud-private-relay-problems/66764/5 "2023-12-06T03:50:42Z")
> [@MatejKovacic](#):
>
> So if I understand - if I set `BLOCK_ICLOUD_PR` to `false`, PiHole filtering will be working for all devices, except iDevices (and iDevices won't complaing about iCloud relay not working)?
Yes.
But if this is just about the "_SpecificNetwork_ isn't compatible with iCloud Private Relay" message being annoying: That could also be avoided by turning it off for that _SpecificNetwork_:
> Private Relay can be turned off for a specific network using the Limit IP Address Tracking setting.\*
>
> - If you turn off Private Relay for a specific network, the setting for that network applies to all of your devices for which Private Relay is turned on.
> - If you regularly switch between multiple network configurations (such as Dual SIM or Wi-Fi and Ethernet), make sure that this setting is set for each network independently.
(_sourced from Apple's support pages on [managing iCloud Private Relay](https://support.apple.com/en-lamr/102022#:~:text=If%20a%20network%20doesn%27t%20work%20with%20Private%20Relay)_)
---
### Author:  [@MatejKovacic](https://discourse.pi-hole.net/u/MatejKovacic)
#### Post date: [December 6, 2023, 7:55am UTC](https://discourse.pi-hole.net/t/icloud-private-relay-problems/66764/6 "2023-12-06T07:55:17Z")
Thanks a lot for these clarifications.
Is it possible to create a special group (in PiHole) that will not block iCloud Private Relay (while default settings for default group will perform blocking)?
---
### Author:  [@Bucking\_Horn](https://discourse.pi-hole.net/u/Bucking_Horn)
#### Post date: [December 6, 2023, 8:01am UTC](https://discourse.pi-hole.net/t/icloud-private-relay-problems/66764/7 "2023-12-06T08:01:15Z")
Why would you want to do that?
Doesn't disabling **`BLOCK_ICLOUD_PR`** already achieve what you want?
---
### Author:  [@MatejKovacic](https://discourse.pi-hole.net/u/MatejKovacic)
#### Post date: [December 6, 2023, 9:00am UTC](https://discourse.pi-hole.net/t/icloud-private-relay-problems/66764/8 "2023-12-06T09:00:57Z")
Yes, but let's suppose you have two iDevices - for one you would like to enable iCloudPR blocking, for other not.
If I understand, `BLOCK_ICLOUD_PR` works globally, and not per devices.
---
### Author:  [@DL6ER](https://discourse.pi-hole.net/u/DL6ER)
#### Post date: [December 7, 2023, 6:07pm UTC](https://discourse.pi-hole.net/t/icloud-private-relay-problems/66764/13 "2023-12-07T18:07:14Z")
> [@MatejKovacic](#):
>
> Is it possible to create a special group (in PiHole) that will not block iCloud Private Relay (while default settings for default group will perform blocking)?
This will be added by
[https://github.com/pi-hole/FTL/pull/1808](https://github.com/pi-hole/FTL/pull/1808)
allowing you to put the respective domains on your whitelist. When you apply them only to one group this effectively disables the special handling for this group while it stays intact for the rest or your network. Please run
```auto
pihole checkout ftl tweak/special_domains_prio_v5
```
and check if adding
```auto
mask.icloud.com
mask-h2.icloud.com
```
and then assigning them to the group you want the feature being disabled for does what you want.
When this is working well, we can include it in the next FTL release which is scheduled rather soonish.
---
### Author:  [@Bucking\_Horn](https://discourse.pi-hole.net/u/Bucking_Horn)
#### Post date: [March 24, 2024, 7:47am UTC](https://discourse.pi-hole.net/t/icloud-private-relay-problems/66764/19 "2024-03-24T07:47:01Z")
4 posts were split to a new topic: [How to allow clients using Apple's Private Relay to use Pi-hole?](https://discourse.pi-hole.net/t/how-to-allow-clients-using-apples-private-relay-to-use-pi-hole/69152)