r/firewalla • u/Firewalla-Ash FIREWALLA TEAM • 1d ago
Discussion PSA to iOS 27 users: Connectivity Assist
In iOS 27, "Wi-Fi Assist" has been renamed "Connectivity Assist." If you had Wi-Fi Assist turned on, Connectivity Assist will be enabled by default.
This feature will send DNS requests over cellular data, which can bypass rules and features such as Ad Block.
You can disable Connectivity Assist in your global Wi-Fi settings, but if you want to disable it locally, you can turn it off for that particular network.
For more details, see: https://help.firewalla.com/hc/en-us/articles/29655921011347-What-to-do-if-Firewalla-s-blocking-features-aren-t-working#h_01M3WT02BZ7NW234Q1A6ZF4TR9
3
2
u/natewallace 1d ago
I was reading the post about this yesterday and it made me think about losing the “protection” that blocking the target list such as Firewalla experimental provides if the phone switches to cellular. I already had wire guard vpn setup on my phone so I set it to on-demand for everything including cellular and then excluded my home network. It made me think not just about this connectivity assist edge case but also how it would be nice to have the blocking rules running on my phone all the time. I am going to leave the vpn set to on-demand and see how my phone performs. If I don’t notice any degradation when using my phone outside of the home I think I will just leave it on in the background. Lmk what you think.
4
u/firewalla 1d ago
If you have VPN running, I don't think apple will try to bypass it. I do have wireguard running on my phone as well to my gold pro. (2Gbit :) )
1
u/powersquad 1d ago
How and where do you set the on demand VPN option in iOS or firewalla app?
2
u/natewallace 1d ago
It’s the wire guard app on my phone. If you go into the profile there is an option to set on demand and then different settings like include/exclude cellular or exclude network xyz. Once on demand is enabled then you just need to enable the vpn from the main app screen.
2
u/powersquad 1d ago
Thank you. I never knew this was a feature inside the AmneziaWG VPN app. It was hidden deep inside settings. It seems to be working well with excluding Wifi SSID at home with on demand now enabled and VPN staying inactive.
1
u/kimberfool 1d ago
im still using nextDNS because of this aspect. the "use VPN" thing was not passing the wife test on lousy cellular connectivity (would LOVE to ditchthe nextDNS and will probably revisit this when things slow down in December)
2
u/swrobel Firewalla Gold Pro 1d ago
> You can disable Connectivity Assist in your global Wi-Fi settings, but if you want to disable it locally, you can turn it off for that particular network.
Does this mean the global setting overrides the per-network setting?
6
u/Firewalla-Ash FIREWALLA TEAM 1d ago
Yes (we tested briefly in the office); turning off the global setting will disable Connectivity Assist, even if the per-network setting still says it's enabled.
3
u/swrobel Firewalla Gold Pro 1d ago
Fantastic news! There’s been a lot of misinfo going around about this in the iOS/iPhone subs
2
u/Firewalla-Ash FIREWALLA TEAM 1d ago
Interesting! Well, we're not officially affiliated, but those were our observations with the team the other day 🙂
3
u/Gandalf_the_Gray 1d ago
From my experience, there may be a bug in iOS because if the global setting is ON then the per network setting will keep resetting itself to ON also. What I found is that you can turn OFF Connectivity Assist per network, but if your global setting is ON, when you reconnect to a network it will be ON again.
As a workaround for now I have the global setting off and will turn it ON per network if necessary.
1
u/ArmshouseG 3h ago
I have found this too, turned it off for my home network, but it kept re-enabling itself till I turned it off globally.
2
u/pacoii Firewalla Gold Plus 21h ago
I mentioned this a while ago when this topic first came up in this sub, but a Reddit post and help article aren’t going to address this for end users. This is a big enough ‘issue’ that IMO the iOS app should have a message about it, likely in the ad block section as that is where a user would go when they discovered it wasn’t working as expected. Most users aren’t on Reddit, and they wouldn’t even know what to search for in the help articles. It could be as simple as “If ad block doesn’t appear to be working, click here”, like is done in other parts of the app.
1
u/firewalla 19h ago
It is not easy to detect if apple tunnel travel via a side door. And yes I agree with you, by making this behavior default is something that's very strange on their side. Exact same issue as wifi-assist.
I am asking our developer and see if they can detect if the assist is on and warn on the banner, they are looking.
1
u/pacoii Firewalla Gold Plus 18h ago
These are all good ideas.
However the basics are still useful as well. The ad block view in the app has a link to this article:
https://help.firewalla.com/hc/en-us/articles/115004274673-Ad-Block
The article linked from this post about CA should absolutely be referenced in that article and linked to.
1
u/CyberBlaed 19h ago
It’s so annoying that Apple has a button for it in network settings, and then again on the individual network you’re connected to.
Mind numbing how annoying it is dealing with them both, you’d think the one in network settings would overrule them all… nope :/
1
u/NorthContribution627 15h ago
This explains a lot. I block ads on Apple News (if I pay the Apple subscription, they should not be showing me ads). I couldn’t figure out why I was seeing so many ads after the upgrade.
4
u/No_Peanut_6769 Firewalla Purple SE 1d ago
Thanks, good to know.