Explorer III

Question

Issue with gracefully blocking iCloud Private Relay

Forum|Forum|1 year ago
March 5, 2025
12 replies
9904 views

I'm following the directions found here

https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-block-iCloud-Private-Relay-from-bypassing/ta-p/228629

Which are supposed to allow you to block the iCloud private relay but in a somewhat graceful way. Meaning that the iPhone user should still be able to use their device, it's just not going to route traffic through the private relay. However, when I follow the directions above the iphone basically stops any internet traffic saying "can't connect to iCloud Private Relay" until I manually turn off the private relay. I've followed the directions but they don't seem to want to work as intended.

Jean-Philippe_P

Staff & Editor

Hello IrbkOrrum,

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.

Thanks,

Jean-Philippe - Fortinet Community Team

Jean-Philippe_P

Staff & Editor

Hello,

We are still looking for an answer to your question.

We will come back to you ASAP.

Thanks,

Jean-Philippe - Fortinet Community Team

AnthonyH

Staff

Hello IrbkOrrum,

Would you be able to share your DNS Filter, WebFilter, Application Control and firewall policy configurations through screenshots?

IrbkOrrumAuthor

Explorer III

Unfortunately, I'm no longer on site at that location and able to test.

teddyb

Visitor III

Same here (we are using a pair of FortiGate 121G running 7.2.11).

The graceful way would be to trigger "Private Relay Temporarily not available" message which will enable pass-through mode. I've seen it before, but cannot reproduce it.

Returning NXDOMAIN for the domains mask.icloud.com, mask-h2.icloud.com, mask.apple-dns.net, mask-api.fe.apple-dns.net and mask-t.apple-dns.net, would not trigger the message but rather block browsing using Safari (returning "can't connect to iCloud Private Relay" message). The rest (Chrome/apps and etc) should normally work without any issues.

teddyb

Visitor III

I think I spoke too soon. The private relay indeed becomes unavailable if you follow the instructions:

Image (3).jpg

bwsitadmin

New Member

Private relay shows as available as mine and all internet access doesn't work.

Does your web filter and DNS filter look like mine, or am I missing something? Are you blocking proxy/vpn in app control?

I am getting nxdomain for 1.mask.icloud.com but mask.icloud.com seems to be resolving.

Thanks!

zalonta1

New Member

I had it go on and off about three times in an hour on all of my devices. Since the last time it came back on, it has not happened again on any device.

Sign up

Login with SSO

Login to the community

Login with SSO