iOS devices are leaky as hell. I once tried blackholing all requests besides those to a VPN service on a router level, and even then my iPhone would just fall back to mobile data for notifications and other Apple services.
iOS allows DNS request to escape the VPN tunnel
11–20 of 78 posts
Re: iOS allows DNS request to escape the VPN tunnel
#12Always-on VPN that tunnels everything requires MDM commissioning. It's documented by Apple. See the section "Always On VPN": https://support.apple.com/guide/deployment/vpn-overview-depa... Is it dubious that Apple doesn't let VPN apps do this as well? Maybe. But this is known and documented.
So many times law enforcement take advantage of this too, to fingerprint devices. The number of people caught because someone leaks packets outside the VPN for a few seconds because they forgot to configure VPN to disable outbound data if VPN drops... I've long wondered if making always on VPN require MDM provisioning on iPhones was a sop to police/criminal investigation forces, especially after Apple's public fights with the FBI over matters like the locked San Bernadino phone etc. I bet very few crims installing VPNs are aware of that apple support doc.
If this was working as it arguably should and could be done easily without MDM provisioning, it would remove a genuinely useful avenue for law enforcement and add more fuel to the the FBI's dislike for Apple's security features.
Re: iOS allows DNS request to escape the VPN tunnel
#13Add Android to this: https://mullvad.net/en/blog/2022/10/10/android-leaks-connect...
Re: iOS allows DNS request to escape the VPN tunnel
#14Last that I heard, Raspberry Pi with VPN installed along with PiHole that you SSH/VNC (via iOS app) in to is your best option.
This doesn't stop apps using things like DNS over HTTPS etc. PiHole works pretty great today, but developers are getting sneakier and sneakier about how to obtain outbound DNS. It's not just unencrypted port 53 all the time anymore. Eventually devices will get the IP for the DNS record they want just fine, if they really want to.
PiHole arguably is getting less effective with each passing year as alternate DNS resolution methods like DNS over HTTPS etc gain traction, and defeating DNS over HTTPS is s a whack-a-mole game today, all you can really do is try to blacklist known DNS over HTTPS server IPs, which is a running battle.
My assumption is all ad driven applications who depend on resolving advert domains correctly to serve the ad content will one day all utilise methods like DNS over HTTPS to stop products like PiHole reducing revenue.
Re: iOS allows DNS request to escape the VPN tunnel
#15Earlier quoted context omitted.
Wallet at least has a semi-plausible non-evil answer: Users who kick their VPN on to another country and try to use apple pay at checkout will unexpectedly get declined (because the purchase would appear to be coming from another country perhaps?). Apple could fix that with proper UI though.
I don't see any reason why Apple Pay would use IP geolocation like that when it's running on a device that has GPS.
> I don't see any reason why Apple Pay would use IP geolocation like that when it's running on a device that has GPS.
One reason is that GPS doesn't work well (or at all) indoors, through cell-tower geolocation should work well enough for that case.
Re: iOS allows DNS request to escape the VPN tunnel
#16Earlier quoted context omitted.
Wallet at least has a semi-plausible non-evil answer: Users who kick their VPN on to another country and try to use apple pay at checkout will unexpectedly get declined (because the purchase would appear to be coming from another country perhaps?). Apple could fix that with proper UI though.
I don't see any reason why Apple Pay would use IP geolocation like that when it's running on a device that has GPS.
Fraud detection happens on the server side. The IP address is more reliable than GPS, because the client can fake GPS at any time.
Re: iOS allows DNS request to escape the VPN tunnel
#17Last that I heard, Raspberry Pi with VPN installed along with PiHole that you SSH/VNC (via iOS app) in to is your best option.
This doesn't stop apps using things like DNS over HTTPS etc. PiHole works pretty great today, but developers are getting sneakier and sneakier about how to obtain outbound DNS. It's not just unencrypted port 53 all the time anymore. Eventually devices will get the IP for the DNS record they want just fine, if they really want to. PiHole arguably is getting less effective with each passing year as alternate DNS resolu…
> PiHole arguably is getting less effective with each passing year as alternate DNS resolution methods like DNS over HTTPS etc gain traction, and defeating DNS over HTTPS is s a whack-a-mole game today, all you can really do is try to blacklist known DNS over HTTPS server IPs, which is a running battle.
Aren't blocking ads another whack-a-mole? So it seems like more of the same.
Also, aren't there proxies that you can setup that can inspect HTTPS connections (so long as you install the proxy's cert on your machine). I suppose the whack-a-mole might be more practical if a few people used those regularly along with some kind of automated scanning for DNS over HTTPS.
Re: iOS allows DNS request to escape the VPN tunnel
#18Earlier quoted context omitted.
Wallet at least has a semi-plausible non-evil answer: Users who kick their VPN on to another country and try to use apple pay at checkout will unexpectedly get declined (because the purchase would appear to be coming from another country perhaps?). Apple could fix that with proper UI though.
I don't see any reason why Apple Pay would use IP geolocation like that when it's running on a device that has GPS.
GPS can be easily spoofed.
Back in the university days, we (me + a few friends) used to get some radios and antennas to create a signal stronger than the one coming from satellites. It was always fun when the semester started and all freshmen were using Google Maps to navigate through the campus, but the map always showed their location in North Korea. Good ol' times.
Re: iOS allows DNS request to escape the VPN tunnel
#19iOS devices are leaky as hell. I once tried blackholing all requests besides those to a VPN service on a router level, and even then my iPhone would just fall back to mobile data for notifications and other Apple services.
I can't even imagine the uproar that would be a thread about Google doing this!
Re: iOS allows DNS request to escape the VPN tunnel
#20Last that I heard, Raspberry Pi with VPN installed along with PiHole that you SSH/VNC (via iOS app) in to is your best option.
SSHing to another machine isn’t a solution, you’re just using a different machine. The way to solve it and still continue to use iOS is to implement your VPN at the network layer. e.g. use one of those wifi routers with a VPN client built in.
> The way to solve it and still continue to use iOS is to implement your VPN at the network layer. e.g. use one of those wifi routers with a VPN client built in.
That's a little impractical for a phone. You'd have to lug around some kind of VPN-enabled mobile hotspot, plus batteries to power it.