Hacker News Reader

Comment by gennarro | Hacker News Reader

Can someone explain how it’s possible to block this? Just stop the whole IP range from the network?

Apple allows networks to block Private Relay:

"Network settings

Some organizations might be required to audit all network traffic by policy. To comply with such a requirement, these networks can block access to Private Relay. Users will be alerted that they need to either disable Private Relay for the network or choose another network. The fastest and most reliable way to do this is to return a negative answer from the network’s DNS resolver, preventing DNS resolution for the mask.icloud.com and mask-h2.icloud.com hostnames necessary for Private Relay traffic."

https://www.apple.com/privacy/docs/iCloud_Private_Relay_Over...

I'm not familiar with Private Relay's details, but based on the available public information: every connection is initiated through a proxy server controlled by Apple, so all Verizon (probably) has to do is detect that initiation pattern and/or figure out which IPs/subdomains are specifically responsible.

Apple can probably improve the situation by making Private Relay more like a VPN (instead of a fancy web proxy + DNS masker), including reusing the same IPs and domains that iCloud traffic is already going through.

Edit: Apple's docs show two well-known subdomains for Private Relay[1]. Blocking both of those is probably what Verizon's doing.

[1]: https://developer.apple.com/support/prepare-your-network-for...

No, Apple built-in a feature for carriers to disable it.

iPhones find the entry servers to Private Relay via DNS. If you drop those hostnames, then it's effectively blocked.

So with a custom dns server you are fine?

Edit: woodruffs above provided docs

While its trivial to edit DNS settings for wifi, its actually quite difficult to change your DNS server on the cellular profile on iOS as comment from Easton here rightly points out. I was kinda surprised the first time I found out you can't edit the cellular DNS server settings via the phone's Settings app.

One option that works for me to get custom DNS on iOS cellular connections (I like PiHole ad blocking on my phone) was to setup my own VPN connection to a VPS instance running PiHole for DNS and WireGuard for the VPN. Lets me get custom DNS, pihole adblocking over cellular so long as VPN isn't blocked by your cellular provider etc. Was two trivial Docker containers to get running, costs very little in AWS.

Same trick also lets me access region blocked TV services from my iOS devices over US cellular simply by turning a VPN on - I just stand up the containers on a VPS host based in source country and connect to that.

Yes, but you can't set custom DNS for cellular networks without a configuration profile or an app, so it's unlikely that most people have that set.

Depends on the ISP. If they block or re-write DNS packets, then setting your own servers wouldn't fix it. That's a real thing people see in the wild: https://superuser.com/questions/897543/how-can-i-check-if-my...

should let users run them

like Tor exit nodes, or obfs4 bridges

turn it into a war of attrition!

Reply on news.ycombinator.com