Global Protect Split tunnel dns resoleving problems in MacOS configured with Private Relay

[DorMarcovitch]

hey, 

i recently got an issue with a user that got a new MacOs laptop that had an issue with connecting to internal resources, looks like Chrome and Ping and also other client application would not work because the dns is not resolved.

there is an Apple feature called "Private Relay" it basically acts like a "vpn" that routes traffic through some gateway so the ISP etc wont see the user's traffic. that was probably collide with the GP client. 

if this feature is enabled on the user's intune this will be enabled by default on a new device that is linked to this user's intune.

this feature can be disabled on the user MacOS

https://support.apple.com/en-il/102602 

[aleksandar.astardzhiev · Accepted solution]

Hi @DorMarcovitch ,

Thank you for sharing this.

Note that you can also prevent the use of private relay on network level by blocking the DNS resolution for these two FQDNs

mask.icloud.com
mask-h2.icloud.com

As described by Apple documentation - https://developer.apple.com/icloud/prepare-your-network-for-icloud-private-relay/