The issue here is that an application is bypassing a kernel-level firewall, seems crazy to me that a Unix system is allowing that.

Apple seems to consider that they are the kernel and your machine is just a terminal that happens to run on their platform.

you comment "anything. Just need that one connection and it can be turned into a tunnel."

this interests me because a few years ago i was subjected to a government imposed firewall https://thewire.in/government/kashmir-internet-whitelisted-w...

and i tried my best to bypass this but i did not have the energy to fashion a touniquet of sorts. i did end up spinning up a free amazon vps because apparently "amazon website" was unblocked and that forced them to allow aws. i ended up simply using ssh -D to the ip of the vps. that worked for a while but it was not fun... the connection would drop frequently but otherwise it was a POC.

my point is, when we are talking about a hostile adversary like your government that is out to get you, regular "vpn" does not work, in my case, i tried every darn thing but until i came up with my thing, i could not get access to regular internet so for the next time, what can i do?

I’ve historically used IP over DNS tunneling to pull this off.

A major advantage of this approach is that it leverages a port and protocol that’s rarely blocked, and if 53 is blocked, you can generally still use the approved local dns servers for your data-carrying queries.

These days, it looks like there are at least a few well-known pieces of software to do this, e.g. https://github.com/yarrick/iodine

This is my first thought of how to do my own VPN in a hostile environment, with the term VPN do you think of consumer VPNs? (Mullvad, Nord, etc.)

When I moved to university, bandwidth was limited in the dormitory to 1mbps/user (in 2016…) This was unacceptable to me, but we had a private link (non-internet) to the campus with virtual desktop infrastructure that had no such limits :). ssh -D immediately gave me 500mbps download to my dorm room, and I guess this sort of thing is probably why I think of ssh -D and running on port 53 etc to evade this sort of thing. Public education in the US can function pretty well as a government out to get you in terms of digital freedom :)

yeah, i even ended up using firefox foxyproxy addon because then i could either go all in on the proxy or whitelist style only few websites or blacklist with all websites and few open. that addon probably was the best thing in all of it because i was not pushing the entire OS through the tunnel.

yeah, i guess for some time, cisco was called out by news outlets for helping the government impose the firewall which the company later denied but the damage was done by then so it didnt really matter, still, i think this just slipped from their minds, a random port, somethimes 80, 8080, 3400. it was fun (well considering the circumstances) with the added risk of incarceration if caught and many were unfortunately so yeah

You're ignoring that admins have often legal responsibilities and compliance requirements to manage and monitor their networks. It doesn't really matter how I feel about a given VPN service... if you want to be on my network you have to turn it off.

(And yes, I often end up annoying myself by blocking stuff I myself would like to access at work. But that's my job.)

This is why apple tells you how to block private relay.

https://developer.apple.com/support/prepare-your-network-for...

mask.icloud.com mask-h2.icloud.com

In addition if this service is a problem, consider there could be a thousand providers you have never heard of providing the same kind of service but while going out of their way to make sure you don’t actually have a way to block it.

If you really ‘need’ to block that kind of connection the onus is on you, not on the services.

Absolutely. There are block lists out there that can help but they are unlikely to be perfect. This guy seems to be up to date; https://github.com/oneoffdallas/dohservers

Yea, like enforcing the seemingly obvious “don’t use the fucking office network for torrenting”.

I nearly lost my mind when I got a DMCA notice from our ISP. I never thought I’d need to lecture a team of professionals that the consequences of losing our office internet would be significant to the business.

Sure and that is understandable, but it doesn't really do much. My personal phone is not on my employeers wifi but is still right next to me. There is nothing technical that they can do, short of a faraday cage for the building, to prevent me from going where ever I want on it.

I feel like rules such as yours are a pre smartphone era thing, when I had to use the company laptop to get online away from home.

It does a lot: You aren't exposing our network to security threats or legal liability. I don't care what you do with your phone on your own Internet connection. But if you want to connect it to my Wi-Fi then it has to follow my rules.

If you don't control the endpoints you don't control the network.

It depends. Obviously a lot of effort by certain monopolistic advertising companies have gone into ensuring the web platform is increasingly opaque and difficult to manage or monitor, but it's entirely in the purview of a network owner to disable or block anything that can't be inspected to satisfaction.

Well if you want to block everything that can't be inspected you will block a lot of common functionality.

The question about if it's in the network owners purview to inspect depends on the network and traffic. It could also be illegal privacy violations.

There is no reasonable expectation of privacy on someone else's network, particularly an employer's. Arguably network operators have the ultimate authority on what should and shouldn't happen over their networks on their equipment.

I understand that ad companies have a vested interest in circumventing this and trying to move internet standards to opaque protocols, but until that particular fiefdom is unseated, we have to make reasonable tradeoffs.

In the meantime, we block a massive amount of malware by blocking their ad domains.

> Arguably network operators have the ultimate authority on what should and shouldn't happen over their networks on their equipment.

I think the point here is you write on their equipment. I was talking about cases where the network owner don't control the endpoints, that is allowing private devices to connect. snooping in that data can be problematic.

> There is no reasonable expectation of privacy on someone else's network, particularly an employer's.

This is a massive [Citation needed]. Do you have a court precendence case where you can prove that admins have the right to snoop through private and sensitive data of users that are just connected to some network?