Apple’s Private Relay can cause the system to ignore firewall rules | Hacker News Reader

Apple’s Private Relay can cause the system to ignore firewall rules

mullvad.net

243 pointsvitplister102 comments

I doubt this is a leak, it very much sounds like Apple is using QUIC to connect home and make the API work.

Not respecting the system firewall does seem like a flaw, but Apple has had a history of bypassing attempts at filtering network traffic. Firewalls have been blocked from working and Apple services have been made unblockable in later APIs. I'm not surprised in the slightest that Apple also bypasses your VPN to call home.

I don't know if this is a problem, though. If you buy Apple, you let Apple make the decisions for you, that's how the entire ecosystem is designed. You must trust Apple unconditionally and accept traffic sent home to adhere to their privacy settings, or you should not run macOS at all. Try to run Windows or Linux on it if you've bought your computer for the hardware quality, though the M1 makes that nearly impossible without sacrificing user experience.

That sounds like treacherous computing. And I've argued before, that this smells like a rental with the name of a "sale".

A computer does what its owner whats it to do. And when Apple or another company is directing its actions, tells me that what I have is a rental.

Either relinquish control, or put it on the market with the real name. It's not a sale.

I agree with this take 110%

As an aside, I’d also like to subscribe to “No as a service”.

Dude, literally the article says: data gets sent to private relay if you have it enabled. You can stop it from being sent by not turning it on.

What is apple meant to do? Just not provide the service at all?

Because private relay is vastly superior to a VPN for web content, which is what matters to most users?

The problem is that it's proof that PF firewall can't block all traffic. This essentially means one cannot trust PF to protect themselves from leaking traffic.

It seems entirely plausible that this is a simple implementation bug.

PF is not the thing that does actual networking, on any OS.

As far as I understand networking and firewalls like PF, you essentially have the lowest level, where the kernel/driver puts bytes onto the channel.

Then you have the various userspace networking interfaces for various transport mechanisms, TCP, UDP, QUIC, etc

Each one of those is doing

    <transport protocol specific thing>
    <send the bytes>

The <send the bytes> part is below where your firewall stuff is going to happen, so I'm going to guess (I have never written kernel level networking because that stuff seems like relentless misery) that it means that every transport implementation has to independently have some code that looks like

    packet_data = <build the packet>
    if (auto firewall = current_firewall()) {
        if (firewall->should_block(packet_data))
            return E_BLOCKED; // or whatever
    }
    kernel_send_the_bytes_yo(packet_data);

Or something like that, all super super pseudo code of course.

Anyway, if that general concept is vaguely accurate then that means every time someone brings up a new transport protocol that another opportunity for this to get missed. Not saying its good that such a thing is possible, or that not catching it is ideal, just saying it seems like a plausible path to this kind of bug happening - Hell, I'm not even sure it would be the first case of an OS missing PF, I have some vague recollection from the distant past?

Apple does tell you how to block this stuff if that’s your concern. Having highly opinionated defaults is required for “it just works” which millions of users really do want, but those same defaults will always annoy someone.

Circumventing a system firewall is not an opinionated default. By default, the firewall isn't enabled. Nothing requires the traffic to leak here, it just doesn't need to behave this way. This makes nothing simpler. And, this is undocumented behavior. Don't buy into the argument that this makes some UX better. It doesn't.

By default this feature is also disabled.

What happens when multiple features in conflict are both turned on is a classic UI problem. Quietly doing a compromise between them is the exact kind of opinionated default that I am talking about.

As a user you have made the choice to both enable private relay, and enable a VPN. Now PR isn't itself a VPN as such, but clearly there's some level of potential conflict in making such a decision. If you don't want Private Relay interfering with network traffic routing, pretty much it's job as advertised, for goodness sake just switch it off and the whole problem goes away.

There are exactly 0 reason why the private relay couldn't be routed within the VPN or vice versa. There's exactly 0 reasons to make the private relay traffic circumvent the firewall.

>There are exactly 0 reason why the private relay couldn't be routed within the VPN or vice versa.

You don't know that for sure, unless you know exactly how the Apple side of PR works, there could well be circumstances where that would cause problems. At the scale Apple operates at they must come across all sorts of weird an unusual configuration combinations.

There are 0 reasons for enabling private relay and also configuring a VPN, yet that's what the user did. In any case this is documented and Apple provides instructions how to block it.

The issue here is thinking that the VPN subsystem and firewall subsystem and how they work are the product from Apple's point of view. They're not, they're just implementation details. For Apple the intended high level user experience is the product, in this case the UX of the private relay service. If they need to bypass some subsystem to achieve a better more consistent high level user experience then that's what they will do.

>A computer does what its owner whats it to do.

If you've enabled Private Relay then it's doing exactly that.

If you run Windows or Linux you gain nothing. Apple just demonstrates some ability that operating systems have. They all have this ability. Apple’s benign use of it gives you no new information.

Stuff like this in-kernel with Linux is heavily discouraged and you'd be almost publicly shamed. If it's a problem with user-space, simply use something else.

With Mac, you can usually handle the user-space scenario. Not so much the kernel-space one.

That's what's great about Linux. You don't have to submit to somebody else's will if you don't want to. It takes more effort, but good things always come at some cost.

And yet Linux is a terrible choice for the vast majority of users, no amount of "user choice" will change this. Most users don't need choice, they need structure and guide rails.

Apple is arguably engineering computers and OS UX "correctly," e.g. better for most people.

Yep, if some linux kernel component would bypass iptables and called home, Linus would probably use some very very profound words, before denying the patch and effectively killing the "new feature".

You're suggesting that Windows is equal to Linux as an alternative to MacOS if you favor control and privacy???

Windows is by far the worst of the three.

Not in this use case.

With regards to privacy and control, yes. There’s loads of telemetry you can’t turn off in Windows anymore, and you can’t even setup Windows 11 without an internet connection.

You can. Today I learned how. You just have to press Shift+F10 to access the console when it asks you to connect to a network and then enter 'OOBE\BYPASSNRO'. That is all. To skip the security questions set no password initially and then set it later using ctrl+alt+del.

Well TIL but that’s a bit silly. They should just give you a button.

Lol. If something in Linux took that much convoluted process, people would say it was totally unsuited to all but the most nerdy sadists.

Windows doesn't come close to Linux in terms of privacy, but Linux doesn't come close to Windows in terms of reliability and professional software support (Photoshop, MS Office, etc.) without hacks and Github scripts.

For the technically-minded Linux is an option, but for everyone else Windows at least allows you to firewall off any domain you choose. Sure, you'll probably break Windows Update in some way, but the Windows kernel doesn't try to bypass your settings (yet).

> "Linux doesn't come close to Windows in terms of reliability..."

I can't tell if you being extremely sarcastic or lack experience running both of these OS's...

Linux is quite reliable. Maybe even more reliable in day to day use. However it occasionally breaks for me in very subtle ways and when it does break, I have to use technical skills to resolve the issue. That doesn't happen to me on Windows or MacOS. For those reasons, I don't think I'd suggest Linux to anyone who I didn't feel would be able to resolve issues on their own.

I haven't really found windows to be that reliable, although I don't use it a lot. Lots of weird little issues and googling dll names, but maybe I'm just unlucky. a while back i tried installing vscode and it was literally just an all black window, until i installed directx or something along those lines. and that's just off the top of my head

I got my parents on Linux Mint after their desktop died, which I fixed, but they didn’t want to buy a new Windows license. They are absolutely not tech savvy, but only use the internet and some super basic document editing & viewing.

They got used to the system quickly and used it for 4 years, until the OS went out of LTS and I told them not to use it anymore… but still, they have no idea what a terminal is, no tech savvy, but still used it for their basic use-case for 4 straight years without issue! I didn’t even have to help them after the initial install. Couldn’t have been easier.

My experience, as well. I just set up my parents' Linux desktops to look and act like the systems they were used to and it's been fine for them for years. They've even added printers and scanners to their systems without my help.

I think it works for either very tech savvy (who tinker but know how to fix things) or completely not tech savvy people (who will never tinker and use the computer for very basic things).

If you're medium tech savvy then you run the risk of knowing how to break something but not fix it.

Installing regular OS upgrades has in turn broken, fixed, and broken hibernation again on my PC. Sound is another adventure that either goes great or it's a constant game of cat and mouse.

My Windows 10 install may be full of spyware I need to block, but the software works pretty flawlessly in comparison.

With the terrible state of Nvidia's drivers, my Linux install has kernel panicked more often than my Windows box has BSOD'd.

The only thing you said that I agree with is that Windows has better professional software support. Unfortunately, that's not what we're talking about. :/

In my experience, if someone's use cases would be well-suited by Chromebooks or ChromeOS, then desktop Linux will work just as well, if not better, for them.

Reliability-wise, desktop Linux is boringly stable these days as long as you don't insist on the bleeding edge by using Arch or Debian unstable.

The MS Office situation has gotten much better with the rise of online office suite web apps, including Office 365, as well as professional desktop software like SoftMaker's closed-sourced and misnomered FreeOffice[1] that has great compatibility with files written in MS Office's formats.

Lack of Photoshop is a problem, but if you're doing animation, special effects or video editing work, Linux has you covered because companies release Linux versions of their workstation software like DaVinci Resolve, Houdini, Autodesk Flame, Blender, Lightworks etc.

[1] https://www.freeoffice.com/en/

In what way is linux less stable than windows? Sure, on some shitty hardware, maybe. But I had much less random audio stack restart, visual glitches etc on a modern linux system, and then we don’t even talk about service reliability where linux’s server domination should be evidence in itsef of it being that much more stable.

When? Are you talking end user config in the preference pane?

My colleagues have implemented and validated firewalls on MacOS without issue.

Seems annoying, but any application can work around any firewall rules pretty trivially provided they can get at least one type of connection out to the internet. TCP, UDP, DNS... anything. Just need that one connection and it can be turned into a tunnel.

The private relay feature is worth being aware of, but it's irritating for users to deal with overzealous and clueless admins who think that locking down systems by disabling features like this can "increase security". It just ends up getting in the way of getting work done without any real benefit.

You're ignoring that admins have often legal responsibilities and compliance requirements to manage and monitor their networks. It doesn't really matter how I feel about a given VPN service... if you want to be on my network you have to turn it off.

(And yes, I often end up annoying myself by blocking stuff I myself would like to access at work. But that's my job.)

This is why apple tells you how to block private relay.

https://developer.apple.com/support/prepare-your-network-for...

mask.icloud.com mask-h2.icloud.com

In addition if this service is a problem, consider there could be a thousand providers you have never heard of providing the same kind of service but while going out of their way to make sure you don’t actually have a way to block it.

If you really ‘need’ to block that kind of connection the onus is on you, not on the services.

Absolutely. There are block lists out there that can help but they are unlikely to be perfect. This guy seems to be up to date; https://github.com/oneoffdallas/dohservers

Sure and that is understandable, but it doesn't really do much. My personal phone is not on my employeers wifi but is still right next to me. There is nothing technical that they can do, short of a faraday cage for the building, to prevent me from going where ever I want on it.

I feel like rules such as yours are a pre smartphone era thing, when I had to use the company laptop to get online away from home.

It does a lot: You aren't exposing our network to security threats or legal liability. I don't care what you do with your phone on your own Internet connection. But if you want to connect it to my Wi-Fi then it has to follow my rules.

If you don't control the endpoints you don't control the network.

It depends. Obviously a lot of effort by certain monopolistic advertising companies have gone into ensuring the web platform is increasingly opaque and difficult to manage or monitor, but it's entirely in the purview of a network owner to disable or block anything that can't be inspected to satisfaction.

Well if you want to block everything that can't be inspected you will block a lot of common functionality.

The question about if it's in the network owners purview to inspect depends on the network and traffic. It could also be illegal privacy violations.

There is no reasonable expectation of privacy on someone else's network, particularly an employer's. Arguably network operators have the ultimate authority on what should and shouldn't happen over their networks on their equipment.

I understand that ad companies have a vested interest in circumventing this and trying to move internet standards to opaque protocols, but until that particular fiefdom is unseated, we have to make reasonable tradeoffs.

In the meantime, we block a massive amount of malware by blocking their ad domains.

> Arguably network operators have the ultimate authority on what should and shouldn't happen over their networks on their equipment.

I think the point here is you write on their equipment. I was talking about cases where the network owner don't control the endpoints, that is allowing private devices to connect. snooping in that data can be problematic.

> There is no reasonable expectation of privacy on someone else's network, particularly an employer's.

This is a massive [Citation needed]. Do you have a court precendence case where you can prove that admins have the right to snoop through private and sensitive data of users that are just connected to some network?

Yea, like enforcing the seemingly obvious “don’t use the fucking office network for torrenting”.

I nearly lost my mind when I got a DMCA notice from our ISP. I never thought I’d need to lecture a team of professionals that the consequences of losing our office internet would be significant to the business.

you comment "anything. Just need that one connection and it can be turned into a tunnel."

this interests me because a few years ago i was subjected to a government imposed firewall https://thewire.in/government/kashmir-internet-whitelisted-w...

and i tried my best to bypass this but i did not have the energy to fashion a touniquet of sorts. i did end up spinning up a free amazon vps because apparently "amazon website" was unblocked and that forced them to allow aws. i ended up simply using ssh -D to the ip of the vps. that worked for a while but it was not fun... the connection would drop frequently but otherwise it was a POC.

my point is, when we are talking about a hostile adversary like your government that is out to get you, regular "vpn" does not work, in my case, i tried every darn thing but until i came up with my thing, i could not get access to regular internet so for the next time, what can i do?

This is my first thought of how to do my own VPN in a hostile environment, with the term VPN do you think of consumer VPNs? (Mullvad, Nord, etc.)

When I moved to university, bandwidth was limited in the dormitory to 1mbps/user (in 2016…) This was unacceptable to me, but we had a private link (non-internet) to the campus with virtual desktop infrastructure that had no such limits :). ssh -D immediately gave me 500mbps download to my dorm room, and I guess this sort of thing is probably why I think of ssh -D and running on port 53 etc to evade this sort of thing. Public education in the US can function pretty well as a government out to get you in terms of digital freedom :)

yeah, i even ended up using firefox foxyproxy addon because then i could either go all in on the proxy or whitelist style only few websites or blacklist with all websites and few open. that addon probably was the best thing in all of it because i was not pushing the entire OS through the tunnel.

yeah, i guess for some time, cisco was called out by news outlets for helping the government impose the firewall which the company later denied but the damage was done by then so it didnt really matter, still, i think this just slipped from their minds, a random port, somethimes 80, 8080, 3400. it was fun (well considering the circumstances) with the added risk of incarceration if caught and many were unfortunately so yeah

I’ve historically used IP over DNS tunneling to pull this off.

A major advantage of this approach is that it leverages a port and protocol that’s rarely blocked, and if 53 is blocked, you can generally still use the approved local dns servers for your data-carrying queries.

These days, it looks like there are at least a few well-known pieces of software to do this, e.g. https://github.com/yarrick/iodine

The issue here is that an application is bypassing a kernel-level firewall, seems crazy to me that a Unix system is allowing that.

Apple seems to consider that they are the kernel and your machine is just a terminal that happens to run on their platform.

The headline implies that normal user traffic bypasses the firewall. When in fact, it's only apple system traffic. Still not great, but way less bad than if the VPN was actually bypassed for all traffic:

"It is worth noting that Private Relay (mostly) disables itself as soon as any firewall rule is added to PF (the system firewall on macOS devices). The Mullvad VPN app does add firewall rules. Once you connect the Mullvad app, Private Relay announces that it has disabled itself. We see no correlation between user traffic and the leaking packets. We believe they are just some heartbeat signal calling home to Apple. We do not know what information is transmitted to Apple, but since the destination is Apple servers, it is a strong signal to your local network and ISP that you might be a macOS user."

It's not the first time Apple allowed certain applications bypass the firewall / VPN (see https://www.macworld.co.uk/news/apples-own-programs-bypass-f... ).

It is very bad indeed; not even Microsoft dares to do this in Windows (you can still very much block any network request from any part of the system via firewalls or DNS ad-blockers).

I’ve been using little snitch for a decade+ and as far as I remember it was the only time, and was probably a mistake by Apple.

From your link:

> Objective Development, the developers of Little Snitch, also writes about the discovery - and that they take it for granted that Apple will correct it. (Update, 14 January 2021: Apple indeed appears to have removed the whitelist exemption in macOS Big Sur 11.2 beta 2.)

Is that true? I thought I recall reading the Windows firewall resets itself and that come call homes use hard coded IPs.

> It is worth noting that Private Relay (mostly) disables itself as soon as any firewall rule is added to PF (the system firewall on macOS devices).

Unclear if that's the case on iOS though.

I’m unsure how a VPN and private relay would be expected to operate concurrently?

What happens if you enable two VPNs concurrently today?

Private relay and VPNs serve significantly different purposes - private relay is very clearly http[s] focused to the extent that I recall it doesn’t cover most traffic?

Private Relay turns itself off when a VPN is enabled.

> Private Relay turns itself off when a VPN is enabled.

I tested this on iOS and Private Relay does not turn itself off when a VPN is enabled.

It does for me as well.

Does your VPN possibly not offer a default route?

Thanks!

If the apple documentation says it does, that would seem like an obvious bug, but I'm curious whether the apple docs do say that, or there's a general assumption of that being the case?

Oh, as I think of it, did you test the UI switch position or network traffic? I could believe the following behaviors:

* UI switch turns off, private relay continues to carry traffic

* UI switch stays on, private relay continues to carry traffic

* UI switch stays on, private relay does actually turn off

All seem like entirely plausible bug behaviors, and it would be nice to know which it was (UI off + iCPR on would seem to most overtly be a bug)

> What happens if you enable two VPNs concurrently today?

I don't believe it's possible to have more than one VPN configuration be enabled simultaneously.

You can run as many VPNs as you want. Only one of them can own the default route (and even this isn't true if I'm being pedantic). I regularly run at least two at a time in MacOS, Linux, and Windows.

Does disabling Private Relay[1] on a DNS-level prevent this?

[1] https://developer.apple.com/support/prepare-your-network-for...

Yes, but just keep the feature off in the OS. Why go through these ridiculous workarounds?

it's probably just out of band housekeeping for the private relay link.

> We do not know what information is transmitted to Apple, but since the destination is Apple servers, it is a strong signal to your local network and ISP that you might be a macOS user.

isn't this trivially evident with all your traffic being tunneled back to apple as well?

System VPN is a privileged process and it's quite possible that it uses raw networking, for efficiency or other implementation reasons. You'd also see that any Linux process with CAP_NET_RAW "ignores" iptables. It's good to keep in mind the inherent limitations of in-system software firewalls.

Completely tangential but I had no idea (what I assume to be remnants of) FreeBSD's pf firewall is included, and works, in standard MacOS.

IIRC, ipfw is there too, but maybe a little less supported, not sure about FreeBSD's third firewall (ipfilter).

As with most of the stuff pulled from FreeBSD, it was pulled around the year 2000, usually with no updates from upstream, and often with few updates from Apple. Pf's synproxy doesn't really work on macos, and is unlikely to get fixed.

Ugh - I appreciat the spirit of what they are doing, but it’s yet another example of the best of intentions getting flattend by unintended second order effects.

At least it’s still beta!

Posting this on a burner account for obvious reasons but I was able to bypass Cloudflare’s IP based restrictions using Apple’s iCloud relay when my connection was being relayed through one of their POPs. As far as I can tell the issue is fixed now but I’m unsure if they ever notified customers.

The product seems to be fraught with security issues for Apple customers and others.

Well I will be turning this off when it's out of beta and I'm prompted to use it. I already cloak my traffic with a self-hosted VPN+VPS box that I control. And using Mullvad combined with Private Relay would be redundant and overkill. Just turn it off if using a VPN client.

That’s why you always carry your personal pocket-cellular WiFi modem with custom firewall settings.

Then turn on Airport mode on your cellphone.

Sign on to your WiFi.

IP address Privacy, pretty much assured (assuming you have your own backend WireGuard and remote VPS-based gateway. )

sounds like a lot of punishment just so you can use an iphone. maybe try a different device

Yeah... like a laptop with OpenBSD?

Otherwise it sounds like sound advice for any device if you have the threat profile to warrant it.

Seems like a lot of theater to me. If you really have that kind of risk profile then you're not running your exit on your own vps. That will singularly identify you and there's no plausible deniability. And you're leaking way more PII in a typical web request over your VPN than than just an IP. I appreciate that people are interested in this stuff and want to do it, but it sounds pointless really.

O_o.

Who ever said about running your own exit node on your own VPS?

We got other ways to established an exit node. Is an entrance node, this VPS.

But it is heady and pointless … for a small fry.

Got any models you have tried and used?

I've used gl-inet stuff to great effect, it runs openwrt (can easily flash vanilla on there too).

Also use it as a backup for if the home ISP goes down.

https://www.gl-inet.com/products/gl-x750/

Isn't this a quite an annoying thing to setup? IRL Live streamers have these backpacks and they seem needed to be battery powered and quite bulky.

In what situation would you want private relay on, but block traffic to Apple?

Private relay seems to be fraught with privacy and security issues. I was able to use private relay to bypass IP based restrictions to all sites using one of the CDNs that private relay uses.

Apple being marketed as a privacy company makes me laugh... about once a month.

I mean they went up against the mainstream media and the FBI when they tried to demand the FBI demanded they make an insecure version of iOS for them, that would have enabled unlocking all iphones in existence.

The headlines said "apple is refusing to unlock a terrorist's iPhone, but if you did your homework, it was actually the aboe first sentence that was happening.

That's pretty pro privacy. I assume Google has already done this for them, perhaps without even being asked.

> NaturalPhallacy - they tried to demand the FBI demanded they make an insecure version of iOS for them, that would have enabled unlocking all iphones in existence.

Google's and Apple's policies are basically the same when it comes to sharing data with the government... they both comply with secret laws (thanks Snowden).

I believe apple did the same thing decades ago with security ("windows is insecure, macos is secure", "we don't get viruses", etc) Over time they got better in this respect. Maybe they will offer real privacy someday. I would love a real firewall and little snitch on ios.

meanwhile does everything on wsl2 still bypass windows firewall?

It's also great for accessing stuff Vietnamese ISP's try so poorly to block.

That is just how a VPN works in general, nothing special.

Especially rich coming from a VPN vendor, whose business happens to be threatened by Apple's relay.

Seems like a valid complaint to me. Apple is giving themselves privileges to end-around potential competitors on their platforms. Although this is not new.

This isn't something Apple has sneakily reserved for itself. Any process the user authorizes can access PF_NDRV sockets which bypass firewall rules. It's a documented feature of Darwin.

I fail to see the difference. apple authorized themselves to bypass firewall rules without the users input

Personally I trust Mullvad a million times more than Apple. Mullvad is one of the few vendors which have earned my trust. Meanwhile, Apple caved into pressure from the FBI to keep iCloud message backups unencrypted.

The article is referring to the Private Relay connection itself (the "VPN" connection. In quotes because it's not a real VPN) bypassing the firewall, which is not typical. Apple took some heat for doing this to their other apps when Big Sur was first released [1].

Mullvad is installing a rule to essentially disallow any non-VPN'd traffic to prevent leaks. But iCloud Private Relay is not being stopped by that rule.

[1] https://arstechnica.com/gadgets/2020/11/apple-lets-some-big-...

That's fair, but as a mullvad customer, I'm happy they let me know about it.

Reply on news.ycombinator.com