iPhone not Picking up pcwrt settings

[markpenn2020]

A few days ago, I noticed that my iphone no longer uses any pcWRT settings, such as OpenDNS, enforce safe search, etc. All other devices work. Here is my test. I go on my Windows machine and browse to internetbadguys.com, and it is blocked as expected. I also am unable to disable safesearch at google, again as expected. Finally, yahoo.com is blocked as expected on my Windows machine as well.

However, none of those tests work in my iPhone, even thought my iPhone is definitely getting an IP from the same pcWRT router and is in the same group as my Windows PC. Could this have to do with iPhone having this private IP search thing Apple implemented? Perhaps that is bypassing pcWRT somehow.

Thank you,
Mark

[markpenn2020]

Also I forgot to mention that I turned cellular data off, so my iPhone is only connected to my pcWRT router. Plus, I did some other tests, and this is odd. I checked my DNS settings at https://www.dnsleaktest.com/ from both my iPhone and my Windows PC. They both said I was using OpenDNS servers. However, my iPhone is not being blocked the same way. The DNS settings on my iPhone for my pcWRT wifi is set to Automatic, which I assume is correct. I restarted my iPhoned and have the same results.

[markpenn2020]

Apologies for the rapid-fire posts, but I did another test. I intentionally blocked cnn.com from pcWRT, and both my iPhone and my Windows PC were blocked as expected. I unblocked it and both could get to the site. That confirms that the iPhone is indeed going through the router and being affected by changes there.

[support]

So on the iPhone you were able to reach internetbadguys.com, but on Windows it’s blocked? Can you check the Internet logs and see what’s being accessed or blocked for the iPhone and for Windows?

[markpenn2020]

Correct. internetbadguys.com is blocked on Windows blocks it, but not on my iPhone. It’s also blocked as expected using an Android phone. I do not see logs for internetbadguys.com (or exampleadultsite) in pcWRT, nor do I see it blocked in OpenDNS logs. I am never quite sure which is blocking what, but I’ve never seen OpenDNS blocks in the pcWRT logs. Regardless, I see no logs for any of that being blocked or accessed.

[markpenn2020]

More tests show that pcWRT is successfully blocking another iPhone and an iPad. Also no logs in pcWRT for either of those iOS devices being blocked. So, it seems very specific to my iPhone somehow. It’s as if my iPhone has figured out a way to connect through pcWRT but not have any access controls applied.

[support]

You should be able to see the accessed or blocked domain names on the Internet Logs page. More details here: https://www.pcwrt.com/2020/05/monitor-activities-on-your-home-network/.

[markpenn2020]

Yes, I am aware of the logs, and I found something strange. If I blacklist a site specifically in pcWRT, then my iPhone cannot get there, as expected. If I remove the blacklist, my iPhone can get there as expected. If I go to internetbadguys or exampleadultsite on my iPhone, I see the site that says, “This is a demo…If it were a real site…” However, both of those entries show up in the pcWRT blocked logs as DNS. If, however, I go to welcome.opendns.com, then I see the red X saying I am not using OpenDNS. That is then logged as visited in my pcWRT logs. So it appears as if my iPhone is somehow bypassing the OpenDNS blocking even though pcWRT sees the traffic as blocked. Very odd.

[markpenn2020]

OK, I figured this out. See this article, which indicates that using private relay hides IP addresses, which is why pcWRT sees it as blocked, but OpenDNS doesn’t actually block it. Apple is monkeying with addresses in between. https://support.apple.com/en-us/102022 As soon as I disabled Private IP address for the pcWRT wireless network, it began to behave like normal. What that means is that Apple provided a really easy way to bypass pcWRT filtering, which is obviously a problem.

[support]

Thanks for the update. You can add these entries to the black list to block private relay:

mask.icloud.com
mask-h2.icloud.com

[markpenn2020]

That appears to have worked. However, sites seem to load more slowly than before. Also, is this perhaps a feature you could add in future releases so that the blacklist entries are controlled by a checkbox such as “Block Apple Private Relay”?

[support]

We’ll make it block these domains when “Enforce Access Control” is checked. This change will be available in the next update.

[Author]

Posts