---
title: "iCloud Private Relay vs router security and parental controls: Xfinity, NETGEAR Armor, BT · Kilobat Guides"
url: "https://kilobat.app/guides/private-relay-router-security"
description: "Private Relay stops working at home, or your router's security and parental controls stop covering the Mac. See which router features conflict and what to change."
---

# iCloud Private Relay and your router’s security or parental controls

Router security and parental controls inspect or filter the traffic through the router. iCloud Private Relay hides Safari traffic and DNS lookups from the network. The two do not work together on the same network.

**Fix this with your agent**Copies a prompt for Claude Code, Codex or any agent that can use Terminal.

My Mac has this problem: iCloud Private Relay and your router’s security or parental controls. Read https://kilobat.app/guides/private-relay-router-security.md and work through it with me. Install the Kilobat CLI if it’s missing: brew install seifip/kilobat/kilobat. Run the guide’s Terminal and kilobat checks yourself and tell me what you find. List the steps only I can do. Ask before you change any setting.

Applies to: Private Relay needs an iCloud+ or Apple One subscription. Mac steps are for macOS 14 Sonoma and later. · Checked: 7 November 2026

## Symptoms

- The router app says that a Mac or iPhone is not protected, or shows no activity for it.
- Parental controls or website blocks on the router do not work on a Mac with Private Relay on.
- Safari or the Mac says that the network is not compatible with Private Relay.
- Private Relay works on mobile data but not on the home Wi-Fi.
- Private Relay stopped working after you turned on a router security or filtering subscription.

## Likely causes

- **The router service needs to see your traffic.** Apple says that Private Relay may not work with services that rely on viewing browsing activity, such as parental controls.
- **Xfinity xFi features.** Xfinity says that CyberSecure, Parental Controls and Active Time Details do not work on Apple devices with Private Relay on.
- **NETGEAR Armor.** NETGEAR says that Private Relay makes Armor web security, brute force and exploit protection unavailable for that device.
- **BT Web Threat Protect.** BT lists an Apple device with iCloud Private Relay turned on among the things that Web Threat Protect does not cover.
- **A filter blocks the Private Relay names.** Apple tells networks that must filter traffic to block `mask.icloud.com` and `mask-h2.icloud.com` in DNS. The device then shows an alert.
- **Other router filters.** Users report the same conflict with TP-Link HomeShield, Sky Broadband Shield, eero Plus and Synology Safe Access. These vendors do not document it.

## How to check

1. Choose Apple menu > System Settings. Click your name, then iCloud, then Private Relay. Note its state.
2. Open the router or provider app. Find its security, filtering or parental-control feature. Note if it is on.
3. Join your phone’s hotspot with the Mac. If Private Relay works there, the home network blocks it.
4. Look up a Private Relay name on the home network.

   ```
   dscacheutil -q host -a name mask.icloud.com
   ```

   Output An answer with no address can mean that a filter on the network blocks Private Relay.

## How to fix it

1. Choose one: the router’s filtering, or Private Relay on this network. You cannot have both on one network.
2. To keep the router’s features, choose Apple menu > System Settings, then click Network.
3. Click Wi-Fi. Click Details next to your home network.
4. Turn off Limit IP address tracking. Private Relay then stays off on this network only.
5. Xfinity says not to turn on Private Relay on your home Wi-Fi if you use the full xFi feature set.
6. NETGEAR recommends that you turn off Private Relay to keep all Armor features on the device.
7. As an alternative, NETGEAR says Bitdefender local protection on the Mac gives web protection with Private Relay on.
8. To keep Private Relay instead, turn off the router’s filtering service in its app.
9. BT: in My BT, choose Manage my extras. Select Turn off in the Web Threat Protect panel.
10. BT says that this change can take up to 2 hours.
11. If the router blocks the Private Relay names, follow [“iCloud Private Relay is not available on this network”](https://kilobat.app/guides/private-relay-not-available-network).
12. If a child uses Private Relay to avoid the router’s parental controls, use controls on the Mac as well.

The exact menus for your router, from FRITZ!Box and Xfinity to eero and Livebox: [router guides](https://kilobat.app/routers).

## With Kilobat

1. Kilobat does not read the state of Private Relay. It shows the DNS servers that each network gives the Mac.

   ```
   kilobat dns
   ```
2. Check whether a VPN or filter on the Mac also affects the traffic.

   ```
   kilobat vpn
   ```

## Questions

**Does turning off Private Relay for my home network turn it off everywhere?**

No. Apple says that it turns off only for that network. It stays on when the Mac uses other networks.

**Why does the router app still list my Mac?**

The router still sees the Mac and the amount of data it uses. It cannot see which sites Safari visits.

**Does Private Relay hide all apps from the router?**

No. Apple designed it for Safari, DNS lookups and some insecure app traffic. Other app traffic still passes the router’s filters.

**Why did Private Relay stop when I turned on the router’s security service?**

Some services block the Private Relay names in DNS so that they can filter traffic. The Mac then turns Relay off for that network or shows an alert.

## Sources

- [Apple Support: Manage iCloud Private Relay for specific websites, networks, or system settings](https://support.apple.com/en-us/102022)
- [Apple Developer: Prepare your network or web server for iCloud Private Relay](https://developer.apple.com/support/prepare-your-network-for-icloud-private-relay/)
- [Apple Support: About iCloud Private Relay](https://support.apple.com/en-us/102602)
- [Xfinity: How Apple iCloud Private Relay may impact Xfinity xFi features](https://www.xfinity.com/support/articles/iCloud-private-relay-xfi)
- [NETGEAR: How does using Apple iCloud Private Relay affect NETGEAR Armor?](https://kb.netgear.com/000064019/How-does-using-Apple-iCloud-Private-Relay-affect-NETGEAR-Armor)
- [BT Help: About Web Threat Protect](https://www.bt.com/help/security/learn-about-bt-web-protect)
- dscacheutil(1), man page installed with macOS 27.2

Checked on 7 November 2026.

## Related guides

- [“iCloud Private Relay is not available on this network”](https://kilobat.app/guides/private-relay-not-available-network): Some networks block iCloud Private Relay on purpose.
- [iCloud Private Relay breaks some websites](https://kilobat.app/guides/icloud-private-relay-sites): iCloud Private Relay sends Safari traffic through two relays.
- [Limit IP address tracking on a Mac](https://kilobat.app/guides/limit-ip-address-tracking): Limit IP address tracking is a setting for each network.
- [A content filter blocks websites on a Mac](https://kilobat.app/guides/content-filter-blocking): A content filter examines web traffic and blocks some sites.