How iOS 15 Private Relay Stops Public Wi-Fi Snooping

Apple's iCloud Private Relay in iOS 15 protects user privacy on unsecured public Wi-Fi by encrypting web browsing traffic and routing it through a dual-hop architecture. This setup ensures that public Wi-Fi operators, internet service providers (ISPs), and local network snoopers cannot intercept your DNS queries, track the websites you visit, or correlate your identity with your browsing activity.

The Vulnerability of Public Wi-Fi

Public Wi-Fi networks in airports, cafes, and hotels are often unencrypted or poorly secured. On these networks, bad actors or network administrators can monitor traffic using packet sniffers. Even when connecting to secure websites (HTTPS), standard devices broadcast unencrypted DNS requests and Server Name Indication (SNI) data. This allows observers on the same local network to see the exact domains you are visiting, track your browsing habits, or spoof DNS responses to redirect you to malicious websites.

The Dual-Hop Architecture

Private Relay neutralizes local network snooping by replacing direct connections with a two-hop relay system built on the modern QUIC (HTTP/3) protocol:

  1. The Ingress Proxy (Apple): When you browse using Safari, your DNS requests and web traffic are encrypted before leaving your device. The connection first goes to an Apple-operated ingress proxy. The local Wi-Fi router can only see that your device is sending encrypted data to an Apple IP address; it cannot view the destination domain or the contents of your request.
  2. The Egress Proxy (Third-Party Partner): The Apple ingress proxy validates your iCloud+ subscription, strips your original IP address, and forwards the encrypted payload to an independent egress proxy run by content delivery networks like Cloudflare, Fastly, or Akamai.

Because of this separation, no single entity possesses both pieces of the puzzle:

  • The Wi-Fi network and Apple know your real IP address, but not the website you are visiting.
  • The egress partner and the destination website know the website you are visiting, but not your real IP address.

Encrypted DNS and Metadata Protection

Beyond routing data, Private Relay fundamentally closes information leaks at the protocol level:

  • Oblivious DNS-over-HTTPS (ODoH): DNS queries are decoupled from the user's IP address. Local network snoopers cannot see domain lookups, stopping DNS-based profiling and man-in-the-middle attacks.
  • Encrypted SNI and Metadata: Because all traffic between the device and the proxies is encapsulated in encrypted tunnels, local eavesdroppers cannot inspect the SNI field, which normally reveals the hostnames of HTTPS connections.

Scope of Protection

Private Relay automatically protects all web browsing within Safari, DNS resolution queries, and unencrypted HTTP traffic from background app processes. While it does not function as a system-wide VPN for all third-party app connections, it effectively shields the primary vectors that attackers exploit when snooping on open, untrusted Wi-Fi networks.