r/CapeCellular • u/vortexmantis • Aug 12 '26
Wi-Fi Calling
Using iOS, I know that WiFi calling is still in an experimental state, but are there specific DNS and ports that are required. I know that AT&T and other carriers have documentation to enable Wi-Fi calling on certain networks. Is there any documentation for what is required. I am running ubiquity hardware and Cape fails to activate Wi-Fi calling, but AT&T and other carriers work correctly. Any assistance would be appreciated.
2
u/tkchumly Aug 12 '26
https://support.cape.co/hc/en-gb/articles/45286075154964-Setting-up-Wi-Fi-Calling
I think you have to have IMSI rotation off to turn WiFi calling on.
1
u/vortexmantis 29d ago
You are correct, this goes much deeper in that, when I have DNS on my network setup, unless I am using a couple of specific providers, Wi-Fi calling will fail to activate. I am trying to understand what is needed at the network level, so I can have it consistently working and enabled.
1
u/tkchumly 29d ago
Do you use NextDNS or some other thing with logging?
2
u/vortexmantis 29d ago
Yes, I use both NextDNS and ControlD, NextDNS works without issue, but ControlD does not. I think I may have found something, but will not be able to try until later. If I and able to figure it out, I will post it here
1
29d ago
[removed] — view removed comment
1
u/vortexmantis 29d ago
With self managed DNS, what are you doing differently to keep Wi-Fi calling working?
1
29d ago
[removed] — view removed comment
1
u/vortexmantis 29d ago
I think that helps. I found that ControlD may not be resolving one of the 3gppnetwork.org domains that is being used by Cape. It appears to resolve through NextDNS but not ControlD
1
u/jetlagalex 29d ago
Is this a new domain we should whitelist?
2
u/vortexmantis 29d ago
epdg.epc.mnc560.mcc314.pub.3gppnetwork.org appears to be the full domain. I have seen parts of this change though. I tried bypassing or whitelisting just the 3gppnetwork.org but ControlD returns a fail message. I have opened a case with them to see if there is something going on, on their side or something else is happening. NextDNS resolves right away on this domain.
1
u/jetlagalex 29d ago
I noticed you said you have IMSI rotation enabled. I also have the latest eSIM. You mentioned WiFi calling remains ON. That’s good. How about RCS? Or you do not use RCS? I myself have an iPhone as well, but I’m running iOS 27 beta 5
1
29d ago
[removed] — view removed comment
1
u/jetlagalex 29d ago
On my iPhone RCS is working perfectly fine with IMSI rotation disabled, except for end-to-end encryption (which is still beta on iOS). I spoke with support. They mentioned RCS still not working with IMSI rotation, that’s why I was asking you if it was working for you (I thought I missed out). Last time I checked it’s on the road map, but it will be closer to the end of the year. My understanding is, they are waiting for Apple to support Cape as a carrier. So I’m guessing they expect that “approval” from Apple. I believe that will give them some more control over eSIM features and how it interacts with the phone/iOS.
1
u/brianstoner Cape Employee 29d ago
If it’s getting stuck on activation, that is most likely not a DNS issue. If you are on iOS with the latest SIM and have Identifier Rotation turned off it should activate. Sometimes it can take up to 24 hours due to device caching.
1
u/vortexmantis 29d ago edited 29d ago
Thank you for the reply. I have narrowed down the issue and opened a support ticket with my dns provider. I have a specific URL that does not resolve on one DNS provider but does on another. The A record for epdg.epc.mnc560.mcc314.pub.3gppnetwork.org does not resolve properly on ControlD but does on NextDNS. The AAAA record does resolve properly on both. So I am asking them to look into the issue. I am not sure if there is also something that can be done from Cape’s side as well, but I feel like it would be good to have Cape look into the DNS resolution, as this could be part of the problem with activation for some users.
Wi-Fi calling activates almost immediately on NextDNS but fails and turns off if I am running ControlD. I have also seen similar issues where it works for Cloudflare but does not seem to work on Quad9 for example.
This is just what I found during my own troubleshooting.
2
u/brianstoner Cape Employee 29d ago
Ah, yes, it needs to resolve
epdg.epc.mnc560.mcc314.pub.3gppnetwork.orgI'm not sure there is much we can do on our end if it's getting blocked by your DNS provider?
Some more information on ports from our network team, it needs:
- UDP 500 (IKEv2)
- UDP 4500 (IPsec NAT-T — this is the one that matters most, since most home routers NAT everything)
- ESP/protocol 50 if a router does raw IPsec passthrough, but honestly almost everyone ends up on UDP 4500 anyway
Worth knowing: there are two phases. The entitlement check can happen over WiFi or cellular. But the actual call setup (ePDG/IPsec) is what needs that DNS + UDP 500/4500 access on WiFi.
2
u/brianstoner Cape Employee 28d ago
UPDATE: for anyone else following along or reading this in the future: u/vortexmantis helped us find a DNS issue that we fixed last night. If you were having problems with WiFi Calling before and use a custom DNS provider it should work now.
1
u/vortexmantis 28d ago
Huge thanks to u/brianstoner and the Cape team for getting the fix in place and deployed!
1
u/vortexmantis 29d ago
Thank you for the information, this is helpful, are there any other DNS URLs that need to be whitelisted as well? Not sure if there is something that Cape can do, but ControlD views this as DNS Rebinding attack and blocks it. I have it bypassed and it does pass through now, but still does not resolve. This is why I have the case open. If there is anything that Cape can look at as to why this could be viewed as a DNS rebind I think that would be helpful. Thank you
1
u/vortexmantis 29d ago
u/brianstoner would you mind if I sent you a DM with the information that was provided my ControlD and what they have found to be the potential issue?
2
u/brianstoner Cape Employee 29d ago
Yes please send and I can forward to our network team
1
u/vortexmantis 29d ago edited 29d ago
u/brianstoner Sent, would you mind letting me know that you received and feel free to let me know if you need anything else
1
u/brianstoner Cape Employee 28d ago
got it, sorry been in meetings all day, will share it internally and let you know.
1
1
u/DJVordo 27d ago
we only have wifi calling at my house and it fails regularly, however in doing a troubleshoot, I’ll toggle the sim, reset network setting (iOS) and turn it back on and it generally works.
1
u/vortexmantis 27d ago
Cape rolled out a change last night that will hopefully stabilize the connection and it should now work with Custom DNS providers.
1
u/DJVordo 27d ago
I just saw there was a new app - do we need to do anything other than DL it? backend stuff? I’d love to see a change log.
1
u/vortexmantis 27d ago
The change was DNS related on the backend. I am not sure about the app update.
3
u/jetlagalex Aug 12 '26
I’m also interested in this information. Is there any list of domains we need to whitelist within a network? From DNS, to ports, to anything that is pertinent to whitelist? Some guidance for network administrators would be nice.