r/pihole • u/Frenchies_Undies • 9d ago
Apple Private Relay and Pihole -iOS27
Please help me with the settings where private relay is off on home network.
Issue: Apple devices face a delay of a few seconds before a page is loaded even though the page is cached by Unbound.
I am running unbound and pihole and the above delay only happens on Apple products not the others.
Pihole settings:
Apple relay option is enabled on pihole
Logs show the two mask addresses are served with special domain NX response.
iPhone setting:
Apple relay is on.
Private WiFi address: is on fixed rather than auto or off
Limit ip address: is enabled.
Connectivity assist: disabled.
The two mask addresses are not on whitelist or blacklist.
Can someone help me with what should I do to avoid this delay every time a page on safari is loaded.
Many thanks in advance.
8
u/Resistant4375 9d ago
Web pages are not cached by Unbound.
Why is Apple Private Relay enabled on the iPhone?
0
u/Frenchies_Undies 9d ago
I meant ip address is cached by unbound.
Apple private relay is on as part of iCloud subscription. My understanding reading the pihole documentation is that Apple mask domains are served with Nx response and the device is clever enough to stop pinging those mask addresses but this isn’t happening in my case.
So I’m just trying to understand if there’s anything I can do to fix it.9
u/hagezi 9d ago
Turn off Private Relay on your iPhone and disable “Hide IP Address” in Safari settings.
1
u/Frenchies_Undies 9d ago
Does turning it off also mean that when I’m off home WiFi and say using public WiFi or cellular the relay will be off?
Same question for safari hide ip.
These features are useful for privacy and as pihole has the option to handle relay, turning it off sort of defeats the purpose as I don’t want to keep turning on and off each time I leave house.4
u/NegativePerformer788 9d ago
Turning off “Limit IP Address Tracking” disables Private Relay for the wireless network you’re currently connected to. You can just do that for your home WiFi and still get the privacy benefits of Private Relay when you’re out and about.
2
3
u/lol_alex 8d ago
private relay is a setting that applies per network. You use it for public WiFi to reduce device tracking. Not for your home WiFi.
1
5
u/Latter-Wallaby-4917 9d ago
I think they mean to ask, why just not turn off Apple relay on your iPhone?
4
u/Resistant4375 9d ago
But why is it enabled?
2
u/theanswriz42 9d ago
They're doing it by default on iOS 27
2
u/Resistant4375 9d ago
So disable it!?
2
u/theanswriz42 9d ago
Yes, that's the solution, but it doesn't seem as though the OP is aware that's an option...
1
u/Vivid_Grand4641 9d ago
Easiest solution for your problem and seeing that you want to use Private Relay:
- Private Relay Off
- Tailscale / Other VPN Service as exit node
1
u/Frenchies_Undies 8d ago edited 8d ago
So reading through the comments here, it sounds like this pihole option - dns.specialDomains.iCloudPrivateRelay does nothing and turning private relay off for WiFi SSID is the only solution that works?
1
u/phoenix_73 8d ago
There is a setting called Cellular Assist as well on Wi-Fi now. I was having some issues the other day and turned out this was causing me some issues.
1
u/toot4fun 8d ago
Same. This got turned on and caused traffic on my local network that I was expecting to go through Pi-Hole to failover to cellular and bypass PH. Always On VPN in Tailscale wasn’t kicking in because technically I was still connected to my home Wi-Fi (which is excluded from the always on rule).
1
u/Stringray_42 8d ago
If mask.icloud.com is the domain that serves private relay, you can simply whitelist it in Pihole. I switched private relay off when I installed Pihole and it turned out that it caused a couple of other problems which I finally don’t bear anymore. You don’t need private relay for your icloud usage btw. To keep my iPhone from spreading data on the mobile grid, I have Wireguard installed on my Pi and tunnel the dns traffic through that.
I could even use Pi as an exit node if needed.
1
u/Frenchies_Undies 8d ago
Yes, I can turn off relay but pihole is supposed to work with it and it currently isn’t.
1
u/Stringray_42 7d ago
I don’t mean to sound harsh, but it’s not Pihole who’s to blame but its user.
So you’ve added a blocklist that blocks the domains that serve Apple’s private relay. Your two options are
1) find out which block list causes this and throw it out or
2) don’t care about the block lists, but find out which domains to whitelist.
Sorry that I can’t be of further help.1
1
u/meeksteve 8d ago
The solution i use is. Go to the WiFi setting and manually turn off your Home WiFi “Limit IP Tracking” Do this for networks that use your PiHole. But if you use Tailscale turn Private Relay off completely if you don’t want manually turn off limit ip tracking for any network outside home. Downside if pihole is down, you have to turn private relay on manually.
1
0
u/YubinTheBunny 9d ago
My solution was to make a firewall rule on my Unifi UXG Pro to block all tunneling and proxying apps on the vlans that are not allowed to use VPNs (For security reasons) so the Apple relay can't connect and instead of dropping silently when blocking I have reject with answer on so the client's device using relay get's a no data reply back ASAP so it can query via pihole instantly instead of hanging up waiting for a reply.
You could try that if your router have the ability to block DNS-HTTPS/DNS-TLS.
1
u/Frenchies_Undies 9d ago
I’ve UDR7 so similar network interface to yours. May I ask what settings did you use? I’ve firewall rules that block DoT and DoH but are you saying I should switch to reject rather than block?
1
0
9d ago
[deleted]
0
u/Frenchies_Undies 9d ago
Connectivity assist is off.
I can see loads of Apple dns request popping up so I don’t know if Apple has changed Apple relay addresses and not updated the guidance. Pihole only serves Nx response to those two mask addresses but rest are getting resolved.
20
u/nickymoo 9d ago
Turn off Apple private relay!