unexpected QUIC traffic / iCloud Private Relay

Question

Created Jul ’22

Replies 1

Boosts 0

Views 3.9k

Participants 1

We have several iPads, locked down using an MDM where users use a web clip to open Safari, which opens our site, and a real time two way video runs.

Unfortunately, in many office environments, the video stream seems to fail intermittently. In review with the network team addressing the usual suspects, like bandwidth, latency, etc, we found something unusual.

We found network traffic which may be iCloud Private Relay - However the iPads are locked down not allowing iCloud login, and we do not have iCloud plus subscriptions, whish is a prereq for this feature. Interestingly, most traffic from the iPad, including our app do not appear to be using the relay. Client security policy is to block QUIC and private relay. See Allow for network traffic audits.

The iPad reaching out using QUIC (UCP/443) to 5 addresses.

17.248.254.101
17.248.354.103
172.224.75.4
172.224.75.6
172.224.75.9

Of course we know Apple controls the 17.0.0.0/8 network, and some quick research shows 172.224.75 is a part of Akami's network, commonly used by Apple.
There are nearby egress ranges on Akami associated with Apple Private Relay.

The documents here do shed some light, but not definitive that this is iCloud Private relay. We reviewed several Apple articles, and these were the closest match: https://support.apple.com/en-us/HT210060 https://support.apple.com/en-us/HT202944

Since we do not have iCloud let alone iCloud Plus, we cannot follow this article's steps to disable iCloud Private relay. we're on iOS 15.5 in iPads gen 6 through 9.

Can we confirm what this traffic really is? If it is iCloud Private relay, Why is it being invoked without a subscription? is there any additional means of controlling it?

Boost

Answer 1

Dana340 OP

Jul ’22

So after some closer review, the iPad invokes iCloud Private Relay for DNS queries and other items. From the iCloud Private relay article:

Private Relay can be turned on or off just for a specific network using the Limit IP Address Tracking preference.*

On your iPhone, iPad, or iPod touch, go to Settings > Wi-Fi, then tap the More Info button next to the Wi-Fi network. Or for cellular networks, go to Settings > Cellular > Cellular Data Options.
On your Mac, choose Apple menu  > System Preferences, then click Network and select the network from the list to see more options._

This is likely the cause of our unexplained QUIC traffic: system DNS works as expected, and mask.icloud.com resolves here. Then iOS invokes iCloud Private relay for user DNS lookups for things like Safari. Our firewall drops this traffic, and these delays in DNS lookup are probably just along enough to cause issues. and this failure can take just along enough to cause our video to fail.

With this understood, Apple does list some recommendations for network admins to clearly disable iCloud Private relay. The average user though may find themselves with an apple device not working on someone else's network where this is blocked. Are there improvements that can be baked into the Private Relay protocol?

0