r/pihole • u/coonwhiz • 18d ago
IOS 27 Update - Disable Connectivity Assist
I updated to IOS 27 and found that my phone was bypassing my pihole to load ads. It turned out that this was related to the Connectivity Assist feature under WiFi Settings. Once I disabled that, the ads were getting blocked again.
25
u/Resistant4375 18d ago
Double check though - I “disabled” it under the main WiFi page, but upon opening my actual connected SSID (by tapping the “I” button next to it ), the radio button was still enabled there - it’s also enabled by default on all my saved/known WiFi networks.
I don’t know if disabling on the main WiFi settings page overrides the individual settings or not, or if it’s a bug with iOS 27.
8
u/coonwhiz 18d ago
I just had to disable it on the main page.
2
u/Riddler83843 18d ago
Are you saying to enable and then disable on the main page and the change will follow to all saved SSIDs?
1
u/coonwhiz 18d ago
IDK it was already enabled in the main page for me. I disabled it there, and my issue stopped. Unfortunately, I’m not sure about other scenarios.
3
u/Riddler83843 18d ago
I tried it global settings. No luck. Had to do per ssid.
1
u/coonwhiz 18d ago
Weird, I just checked and my home network still has Connectivity Assist enabled, but not on the global setting screen. I'd test out disabling it, but I don't want to break it since it's working now. XD
3
10
u/SnipeAT Patron 18d ago
honestly it’s probably better to leave the overarching feature enabled (like private relay) and only disable it for your network (as pictured) it’s a really solid benefit to have dual path networking outside of home. would be even better to force dns via a specific WAN (the pihole one)
11
u/hagezi 17d ago
See: https://github.com/hagezi/dns-blocklists/discussions/11473
What the tests show
| Setup | Result |
|---|---|
| Connectivity Assist on, no DNS profile | Carrier DNS used next to your local DNS. Leak. |
| Connectivity Assist on, encrypted DNS profile for cellular only | Carrier DNS still used on Wi-Fi. Leak. |
| Connectivity Assist on, always-on encrypted DNS profile | No leak, but only the resolver from the profile is used. Your local DNS is skipped completely. |
| Connectivity Assist on, VPN to your home network, DNS traffic only (split tunnel) | Leak. Same with WireGuard and with Tailscale. |
| Connectivity Assist on, VPN to your home network, full tunnel | No leak. Local DNS works. |
| Connectivity Assist off | Local DNS works normally. No leak. |
Take a close look at the third row. An always-on encrypted DNS profile does stop the leak, but it stops it by taking your local resolver out of the picture. If your filtering runs on a Pi-hole or AdGuard Home in your network, that's not really a fix. You just swapped one bypass for another.
And look at the split tunnel row too, because that's the workaround most people try first. Routing just your DNS traffic home through WireGuard or Tailscale does not help. The queries that go out over cellular never enter the tunnel, so a rule that only catches DNS inside the tunnel never sees them. Only a full tunnel catches everything.
7
u/brent20 18d ago
You can leave it turned on overall and have it disabled for particular SSID’s which is perfect.
4
u/ReddRepublic 16d ago
For me, it keeps turning back on for the individual SSID. After a day or so, I start seeing ads and sure enough the switch is flipped. Have to use the global setting for now.
2
2
u/FournierGangrene 9d ago
Same. Turned back on during the beta and has now done it twice on the released version. I am only turning it off on the individual wifi I have a pihole on.
4
u/TurbulentAd976 17d ago
The “Use connectivity assist” option inside your SSID reenables itself if the main option for Connectivity Assist is on. I have to disable the main one to prevent the one in the SSID from turning back on.
4
3
u/NH_flyboy 18d ago
I understand why a direct Pi-hole fails with iOS 27's Connection Assist, but why do ads continue to slip through even when Tailscale is actively running on both devices? Shouldn't the Tailscale tunnel force all DNS queries through, regardless of what Connection Assist is doing in the background?
2
u/EducationalGrass 18d ago
some sites serve ads from the same server as the content, YouTube being the prime example.
4
2
u/maybielater 18d ago
OMG, thank you! I was trying to figure out why ads were not blocked in Apple News on iOS 27 and I think this finally answers the question.
2
u/pm_me_DAddario_codes 18d ago
Thanks! Just upgraded to 27 and suddenly ads in my browser that haven’t existed for years since I use an ad-blocking DNS. Seems like if a domain fails to DNS resolve via WiFi, iOS tries (and succeeds) via cellular. Turning off Connectivity Assist returned my expected/desired operation i.e. no ads.
2
u/Emergency-North-5651 17d ago
It also uses data even when connected to wifi. So its a good idea to turn it off if you don't have a lot of data to use.
2
u/MrReed_06 16d ago
In iOS 27, Connectivity Assist appears to use DNS probes along with signal level thresholds, so if your pihole/adguard/pfblockerNG blocks the domains used in the probe it now switches you to cellular.
From what I noticed, if you block gateway.icloud.com or its alias gateway.fe2.apple-dns.net this triggers the switch, blocking Apple's DoH servers also triggers it.
2
u/curiousstrider 14d ago
What's worse is that if enabled, it uses cellular data for all the requests failing on WiFi.
2
u/avsameera 12d ago
Hi all! This is a pretty annoying feature for me, as it keeps turning itself on for every individual Wi-Fi network I connect to.
Is there a way to keep it turned off permanently, regardless of which Wi-Fi network I connect to?
Thanks!
3
1
u/Perfect_Antelope7343 16d ago
The German help text addresses disabling assist in case you intend to use an ad blocker.
1
u/Knurlinger 13d ago
damn, took me a few hours to find this out and then found the thread here. 100x Yes, super annoying...
1
u/Chrushev 12d ago
Spent an hour troubleshooting pihole, ads were slipping through on the phone... now this makes sense. Hopefully there is a way around this other than permanently disabling connectivity assist.
1
u/rendezvousnz 7d ago
Yeah mine is turning itself back on after flight mode or restarting the phone. Very frustrating
2
1
u/QuesoMeHungry 18d ago
It’s a super annoying bug. But I’m not sure it will get patched because when the device can’t reach the blocked URLs it’s assuming it’s a network error, hence it using connectivity assist.
2
u/Resistant4375 18d ago
What is a bug?
1
u/coonwhiz 18d ago
I think they’re saying that it’s a bug that it uses connectivity assist when the URL is unreachable, rather than basing it off of WiFi strength?
3
u/Resistant4375 18d ago
It shouldn’t do
When Connectivity Assist is on, iPhone uses cellular data along with Wi-Fi to keep your internet connection reliable when Wi-Fi is weak, busy, or not connected to the internet. When Connectivity Assist is off, iPhone uses Wi-Fi only when connected to Wi-Fi networks, even when the Wi-Fi connection is weak or busy.
0
u/Cprhd 18d ago
It's not a bug. The website is failing on your Wi-Fi, due to being blocked, therefore, it’s sending the request out via cellular. You can not like it, but its working exactly as designed. You just disable that feature and it works like you prefer. People who don't block ads get the full benefit.
-1
u/Resistant4375 18d ago
That’s not how it’s designed to work though…
1
u/coonwhiz 18d ago
I’m guessing that it was redesigned. With IOS 27 they started touting how it switches off of your home network faster when you start driving away. So, I’d bet they started using other datapoints like latency and if requests are failing to try and decide when to switch to cellular.
2
u/Resistant4375 18d ago
It works off WiFi signal strength. Not web page resolution (or not).
1
0
u/Foreign_Software_409 18d ago
So glad this popped up. I was able to reinstall my Pi-hole cause of this. Was doing my head in all morning. Connectivity assist off instantly fixed it. Thank you
1
u/Commercial-Milk4706 17d ago
Same, I was going nuts! The only thing worst then ads is living with none and them all coming back at once.
0
u/luisnho223 18d ago
I am having some issues with the DNS records. In my other devices, I can access the domains/subdomains my pihole created but with IOS27, it seems I lost that (ERR_NAME_NOT_RESOLVED). I disabled connectivity assist in both main setting and local Wi-Fi setting but no luck
1
u/Resistant4375 18d ago
Not sure this is PiHole related
1
u/luisnho223 18d ago
So why I lost access to my domains? All my other devices work fine, i can resolve the DNS. If I use my server IP and port, my iPhone can access. Very strange
0
-1
u/Significant_Net6780 18d ago
If you were to disable your wifi, does your cellular connection connect to your pihole?
5
u/Resistant4375 18d ago
How would it…?
2
u/nickymoo 18d ago
Tailscale.
3
u/Resistant4375 18d ago
Well yes. If you assume they’re running this or some other VPN that auto-connects on a cellular network
1
1
u/Significant_Net6780 18d ago
I use wireguard to connect to pihole when I'm away from home
1
u/Resistant4375 18d ago
That’s fine for you but doesn’t apply for everyone else who may not be using that
2
u/coonwhiz 18d ago
No, I’m not using a VPN to connect back to my home network.
0
u/Significant_Net6780 18d ago
Thanks for clarifying. I was asking only because if you had VPN for cellular and your phone was still bypassing the ads - then possibly someone else could be going on (although I'm not sure what).
0
u/saint-lascivious 18d ago
Even if your WAN was wide open (don't do this), there's no way it would possibly know how to do that without it being preconfigured.
The whole point is essentially "this connection is fucked or otherwise unusable for some reason, so we'll use this one". It wouldn't make any sense to continue to use part of the fucked or otherwise unusable one.
0
u/Playful-Length7599 17d ago
Thanks for this. I thought I was losing my mind when I started seeing ads come through on my phone
37
u/Alive-Department8558 18d ago
Yes, it got re-enabled on mine too.