Apple’s Private Relay can cause the system to ignore firewall rules

Re:Apple’s Private Relay can cause the system to ignore fire... by ec109685 on Monday April 25, 2022 @03:16PM (#31159369)

The headline implies that normal user traffic bypasses the firewall. When in fact, it's only apple system traffic. Still not great, but way less bad than if the VPN was actually bypassed for all traffic:

"It is worth noting that Private Relay (mostly) disables itself as soon as any firewall rule is added to PF (the system firewall on macOS devices). The Mullvad VPN app does add firewall rules. Once you connect the Mullvad app, Private Relay announces that it has disabled itself. We see no correlation between user traffic and the leaking packets. We believe they are just some heartbeat signal calling home to Apple. We do not know what information is transmitted to Apple, but since the destination is Apple servers, it is a strong signal to your local network and ISP that you might be a macOS user."

[ Parent | on HN ]

Re:Apple’s Private Relay can cause the system to ignore fire... by gigel82 on Monday April 25, 2022 @04:41PM (#31160325)

It's not the first time Apple allowed certain applications bypass the firewall / VPN (see https://www.macworld.co.uk/news/apples-own-programs-bypass-f... ).

It is very bad indeed; not even Microsoft dares to do this in Windows (you can still very much block any network request from any part of the system via firewalls or DNS ad-blockers).

[ Parent | on HN ]

Re:Apple’s Private Relay can cause the system to ignore fire... by adamomada on Monday April 25, 2022 @06:39PM (#31161726)

I’ve been using little snitch for a decade+ and as far as I remember it was the only time, and was probably a mistake by Apple.

From your link:

> Objective Development, the developers of Little Snitch, also writes about the discovery - and that they take it for granted that Apple will correct it. (Update, 14 January 2021: Apple indeed appears to have removed the whitelist exemption in macOS Big Sur 11.2 beta 2.)

[ Parent | on HN ]

Re:Apple’s Private Relay can cause the system to ignore fire... by ridgered4 on Tuesday April 26, 2022 @07:56AM (#31166375)

Is that true? I thought I recall reading the Windows firewall resets itself and that come call homes use hard coded IPs.

[ Parent | on HN ]

Re:Apple’s Private Relay can cause the system to ignore fire... by tedmiston on Monday April 25, 2022 @05:48PM (#31161136)

> It is worth noting that Private Relay (mostly) disables itself as soon as any firewall rule is added to PF (the system firewall on macOS devices).

Unclear if that's the case on iOS though.

[ Parent | on HN ]