iOS allows DNS request to escape the VPN tunnel

#1

Post by nb_key » Wed, Oct 12, 2022, 2:37 PM UTC

iOS allows DNS request to escape the VPN tunnel
twitter.com

Re: iOS allows DNS request to escape the VPN tunnel

#2

Post by nb_key » Wed, Oct 12, 2022, 2:37 PM UTC

> We confirm that iOS 16 does communicate with Apple services outside an active VPN tunnel. Worse, it leaks DNS requests. #Apple services that escape the VPN connection include Health, Maps, Wallet.We used @ProtonVPN and #Wireshark

Re: iOS allows DNS request to escape the VPN tunnel

#3

Post by lapcat » Wed, Oct 12, 2022, 2:55 PM UTC

Dupe: https://news.ycombinator.com/item?id=33173163

Re: iOS allows DNS request to escape the VPN tunnel

#4

Post by disabled » Wed, Oct 12, 2022, 3:13 PM UTC

Last that I heard, Raspberry Pi with VPN installed along with PiHole that you SSH/VNC (via iOS app) in to is your best option.

Re: iOS allows DNS request to escape the VPN tunnel

#5

Post by khana » Wed, Oct 12, 2022, 3:27 PM UTC

nb_key wrote: post #2

> We confirm that iOS 16 does communicate with Apple services outside an active VPN tunnel. Worse, it leaks DNS requests. #Apple services that escape the VPN connection include Health, Maps, Wallet.We used @ProtonVPN and #Wireshark

No post body was provided.

Re: iOS allows DNS request to escape the VPN tunnel

#6

Post by kube-system » Wed, Oct 12, 2022, 3:41 PM UTC

disabled wrote: post #4

Last that I heard, Raspberry Pi with VPN installed along with PiHole that you SSH/VNC (via iOS app) in to is your best option.

SSHing to another machine isn’t a solution, you’re just using a different machine.

The way to solve it and still continue to use iOS is to implement your VPN at the network layer. e.g. use one of those wifi routers with a VPN client built in.

Re: iOS allows DNS request to escape the VPN tunnel

#7

Post by RetpolineDrama » Wed, Oct 12, 2022, 3:46 PM UTC

nb_key wrote: post #2

> We confirm that iOS 16 does communicate with Apple services outside an active VPN tunnel. Worse, it leaks DNS requests. #Apple services that escape the VPN connection include Health, Maps, Wallet.We used @ProtonVPN and #Wireshark

Wallet at least has a semi-plausible non-evil answer: Users who kick their VPN on to another country and try to use apple pay at checkout will unexpectedly get declined (because the purchase would appear to be coming from another country perhaps?).

Apple could fix that with proper UI though.

Re: iOS allows DNS request to escape the VPN tunnel

#8

Post by drcongo » Wed, Oct 12, 2022, 3:51 PM UTC

Also Google / Android, but that doesn't get the clicks.

Re: iOS allows DNS request to escape the VPN tunnel

#9

Post by dljsjr » Wed, Oct 12, 2022, 3:56 PM UTC

Always-on VPN that tunnels everything requires MDM commissioning. It's documented by Apple.

See the section "Always On VPN": https://support.apple.com/guide/deployment/vpn-overview-depa...

Is it dubious that Apple doesn't let VPN apps do this as well? Maybe. But this is known and documented.

Re: iOS allows DNS request to escape the VPN tunnel

#10

Post by jaywalk » Wed, Oct 12, 2022, 3:58 PM UTC

RetpolineDrama wrote: post #7

nb_key wrote: post #2

> We confirm that iOS 16 does communicate with Apple services outside an active VPN tunnel. Worse, it leaks DNS requests. #Apple services that escape the VPN connection include Health, Maps, Wallet.We used @ProtonVPN and #Wireshark

Wallet at least has a semi-plausible non-evil answer: Users who kick their VPN on to another country and try to use apple pay at checkout will unexpectedly get declined (because the purchase would appear to be coming from another country perhaps?). Apple could fix that with proper UI though.

I don't see any reason why Apple Pay would use IP geolocation like that when it's running on a device that has GPS.