mask-api.icloud.com not added to Ventura/Monterey Guidance

[vaughnhart]

Hi Folks,

I noticed that mask.icloud.com and mask-h2.icloud.com are recommended blocks for Apple but I don't see mask-api.icloud.com which seems to have a lot of traffic generated to it as well.

Thank you!

-Vaughn

[robertgendler]

https://www.apple.com/privacy/docs/iCloud_Private_Relay_Overview_Dec2021.PDF

The Relay IP addresses used by Private Relay are not used or shared for any purpose other than to provide the Private Relay service. The entire list is published to the major geo-IP industry databases and is posted publicly by Apple at: mask-api.icloud.com/egress- ip-ranges.csv

I'm not sure it needs to be added, it doesn't seem like it's the relay portion? It probably wouldn't hurt to add it though.

[vaughnhart]

Yeah... the thing is that I saw a post online that Sonicwall categorized mask-api.icloud.com as proxy avoidance. Plus I mentioned it to Cusco Umbrella that this Private Relay is nested inside a service that was Online and Cloud Storage. I was at the Apple Store on Palm Sunday and I noticed on their Apple Store network they were using Cisco Umbrella and they were blocking mask-h2.icloud.com. But since I didn'

t know about mask-api.icloud.com I didn't check for that site.