Skip to main content
Cajuntank
Cajuntank
Contributor III
November 9, 2022
Solved

iCloud Private Relay question?

  • November 9, 2022
  • 1 reply
  • 10007 views

I am following https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-block-iCloud-Private-Relay-from-bypassing/ta-p/228629 to block iCloud private relay from bypassing the security inspection. My question come into the DNS filter portion of the guide. Since I do not user the DNS filter option in my FortiGates, I just create DNS policies on my internal Windows DNS servers to DENY (provides a response and not a drop) those domains. This brings up the bigger question for me of, Apple's own admission is that the only two domains needing to be set with "no error no answer" or at least some response...just not dropped, is mask.icloud.com and mask-h2.icloud.com. The linked guide however, adds several other domains to this beyond what Apple states, so just wondering about the discrepancy between Apple and Fortinet?

Best answer by gfleming

i would say Fortinet's documentation is more detailed and exhaustive as it covers off all possible ways to block the traffic. If someone can bypass the DNS server then the web filter will block.

1 reply

gfleming
Staff
gfleming
Staff
November 10, 2022

I would think Fortinet's documentation to block is is the one to follow. Apple's documentation may be talking about bare minimum for functionality. Can you post the Apple documentation you are referencing?

Cajuntank
CajuntankAuthor
Contributor III
November 10, 2022

Sure, it's this link that was referenced (at the bottom) in the tech tip link I referred to in my question.

https://developer.apple.com/support/prepare-your-network-for-icloud-private-relay

 

gfleming
Staff
gflemingAnswer
Staff
November 10, 2022

i would say Fortinet's documentation is more detailed and exhaustive as it covers off all possible ways to block the traffic. If someone can bypass the DNS server then the web filter will block.

    Terms & ConditionsAccessibility statement