Global Protect Split tunnel dns resoleving problems in MacOS configured with Private Relay

DorMarcovitch — Wed, 07 Aug 2024 06:03:04 GMT

hey,

i recently got an issue with a user that got a new MacOs laptop that had an issue with connecting to internal resources, looks like Chrome and Ping and also other client application would not work because the dns is not resolved.

there is an Apple feature called "Private Relay" it basically acts like a "vpn" that routes traffic through some gateway so the ISP etc wont see the user's traffic. that was probably collide with the GP client.

if this feature is enabled on the user's intune this will be enabled by default on a new device that is linked to this user's intune.

this feature can be disabled on the user MacOS

https://support.apple.com/en-il/102602

Re: Global Protect Split tunnel dns resoleving problems in MacOS configured with Private Relay

aleksandar.astardzhiev — Fri, 09 Aug 2024 13:52:00 GMT

Hi @DorMarcovitch ,

Thank you for sharing this.

Note that you can also prevent the use of private relay on network level by blocking the DNS resolution for these two FQDNs

mask.icloud.com
mask-h2.icloud.com

As described by Apple documentation - https://developer.apple.com/icloud/prepare-your-network-for-icloud-private-relay/

topic Global Protect Split tunnel dns resoleving problems in MacOS configured with Private Relay in GlobalProtect Discussions

Global Protect Split tunnel dns resoleving problems in MacOS configured with Private Relay

Re: Global Protect Split tunnel dns resoleving problems in MacOS configured with Private Relay