1

We have a public WiFi with auth portal, where access to the internet is granted to a user after watching ads. Access to the internet in unauthorized state of a client is restricted by IP access control list on cisco wlc. All works correctly until a user has an IOS 16.1+ and "Limit IP tracking" turned on.

When it is turned on, auth portal is not working correctly, js execution is blocked in Safari, even timers. 
How can I notify a client device that that functionality doesn't work in our network in unauthorized state.


We have tried to block by answering nxdomain to dns requests:


  • mask.icloud.com
  • mask-h2.icloud.com

  • mask-api.icloud.com
  • configuration.ls.apple.com
  • gsp85-ssl.ls.apple.com
  • iphone-ld.apple.com


but that didn't work as expected and problem was not solved.

Improve this question
0

1 Answer 1

Reset to default
2

Resources for iCloud Private Relay are available here:

https://developer.apple.com/support/prepare-your-network-for-icloud-private-relay

The fastest and most reliable way to alert users is to return either a "no error no answer" response or an NXDOMAIN response from your network’s DNS resolver, preventing DNS resolution for the following hostnames used by Private Relay traffic. Avoid causing DNS resolution timeouts or silently dropping IP packets sent to the Private Relay server, as this can lead to delays on client devices.

  • mask.icloud.com
  • mask-h2.icloud.com

I see you mention the first domain, but not the second domain. Apologies if you've already read this solution.

I also want to mention that you say that Javascript isn't working. iCloud Private Rleay (Limit IP Tracking) does not affect Javascript execution in any way, so you might have another problem on hand.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .