Tweet
How to block Apple iCloud Private Relay.
Apple designed iCloud Private Relay for user privacy, but it creates a significant problem for network administrators as it allows Safari to bypass DNS filtering.
Here is how to block it.
1. Block the relay domains in NxFilter
Go to Whitelist > Domain and add the following domains with the drop-packet flag.
mask.icloud.com
mask-h2.icloud.com
mask-api.icloud.com
When these domains are blocked, the device detects that Private Relay is unavailable and disables it automatically.
* By v4.7.5.3 of NxFilter, these domains are blocked at default.
2. Block UDP/443 at your firewall
DNS blocking alone is not always enough. Safari may still attempt a direct connection using QUIC over UDP/443. Block this at your firewall to close that gap.
Here is how to block it.
1. Block the relay domains in NxFilter
Go to Whitelist > Domain and add the following domains with the drop-packet flag.
mask.icloud.com
mask-h2.icloud.com
mask-api.icloud.com
When these domains are blocked, the device detects that Private Relay is unavailable and disables it automatically.
* By v4.7.5.3 of NxFilter, these domains are blocked at default.
2. Block UDP/443 at your firewall
DNS blocking alone is not always enough. Safari may still attempt a direct connection using QUIC over UDP/443. Block this at your firewall to close that gap.