Adguard DNS and Apple’s Private Relay

I have a question that I cannot easily find an answer to.

My understanding is that because Adguard DNS creates a local “VPN” on the device to resolve URLs, and that Apple’s Private Relay has exemptions for certain network activity (local networks, VPNs, private domains, etc.), would this VPN exemption by Private Relay not leave the follow-up network data/traffic (after Adguard DNS resolves the URL locally) exposed since Adguard DNS isn’t a true off device VPN? Or does Private Relay kick in after the URL is locally resolved? How could I test that Adguard DNS resolved the URL and Private Relay continued to function properly (sending and receiving)?

To further muddy the waters, this AdGuard support page (which references Monterey) says basically you have your choice of iCould Relay or AdGuard
https://adguard.com/kb/adguard-for-mac/solving-problems/icloud-private-relay/

I think local VPN route is either one or another. Basically they don’t work together. If you go iOS native DNS route then they should work together. Maybe someone will be able to add more info.

I am using both on Mac and iPhone and looks like it is working. When I am using ADGuard only I can see my ISP public IP. When Private Relay is ON and AdGuard ON as well, is showing a different IP and is a message that I am using VPN. Most likely because private relay.

I’m going to reach out through support and see if they’re able to clarify. My inexperienced logic tells me that if iOS sees that a VPN is active (even though it’s being tricked per se), that Private Relay would be “enabled” but allowing data/traffic through in the open as the device believes it’s being routed through a VPN.

I’m running AdGuard Pro (includes DNS) and NordVPN together on iOS, iPadOS, and Windows 10. For iOS and iPadOS, NordVPN takes the VPN slot. You have to run AdGuard DNS in native mode for it to work with Nord. But they do work together. I’ve always understood Apple’s Private Relay performs some VPN-like functions but isn’t a true VPN. I don’t recall the differences but I wanted a true VPN, so I went with Nord.

“The same applies to using any VPN apps on Mac: you have to choose between using iCloud Private Relay or a VPN service.”

So is it the same for iOS and iPadOS I wonder. The article recommends using Adguard for Safari which I understand is fundamentally the same as Adguard for iOS/iPadOS.

This article seems to be aimed towards using a traditional VPN with Private Relay. Does it hold true for Adguard DNS with its local on device only VPN? Is iOS and such smart enough to know Adguard DNS is not a full fledge VPN?

I’m thinking similar.

Yup, working fine with the DNS profile.

Would it be showing a different location due to the DNS resolving and not Private Relay?

Is this anything?

https://adguard-dns.io/kb/private-dns/solving-problems/icloud-private-relay/

If you reach out mind updating? This has me curious!

When I am using only ADGuard my ISP IP is shown. With private relay with or without ADGuard I have a random IP (like it should). So far I had no issues having both enabled at the same time.

Interesting. Wondering if this is only whitelisting (within Private Relay) those two domains so that the test functions properly?

This was they’re reply:

Hello!

Thank you for reaching out to AdGuard Support!

When iCloud Private Relay is enabled, it essentially bypasses the network filtering provided by AdGuard. This is because iCloud Private Relay encrypts traffic before AdGuard can filter the network connections. This means that AdGuard cannot block ads or perform DNS filtering.

However, when you’re using the AdGuard app’s DNS protection, these limitations caused by iCloud Private Relay do not apply. This is because AdGuard DNS ensures that your queries do not go to the DNS servers of your ISP, preserving your online privacy and anonymity.

It’s also worth noting that AdGuard DNS is not considered a leak because it merges your traffic with over 50 million other users, making it difficult to track any single user.

Please feel free if there is anything else :folded_hands:

Best!
AdGuard Support Team :green_heart:

Gotcha, this is promising. Thanks for testing both scenarios.

Great question. I don’t know.

So the adguard iOS app with dns set to their server(local vpn thing) and private relay can work together?

So, does this mean on the iPhone app for AdGuard for IOS, I want to make sure in the “DNS Server” section that I have “AdGuard DNS” selected?

Did you ever figure it out?