VoWiFi to respect VPN

DeletedUser622

Hi,

For the privacy sake, please make VoWiFi traffic go through user VPN instead of separate connection.

Xtreix

DeletedUser622 It's not possible at my knowledge, Wifi calling automatically goes through an IPsec VPN tunnel; that's how it's designed.

schklom

You can if you set the VPN on the Wifi router.
For example, the https://www.gl-inet.com/products/gl-e750/ can take your SIM card and generate a Wifi with VPN. If your phone connects to it, VoWifi will have no choice but be routed through the (router's) VPN.

23Sha-ger

DeletedUser622
This will create more issues than it will solve.
First of all, your carrier knows your identity, so it makes little sense to hide your IP from them. Which brings me to a more important point. All carriers I saw, force VoWiFi incoming IP address to be geolocated in the same country as the home carrier. And many VPNs don't have their IPs correctly geolocated etc, it's a mess. A VPN on a router as suggested above works perfectly for me, in my case Mullvad server in Israel. But if you use Proton with their fake locations, don't expect a carrier in let's say, Cambodia, to accept a fake GeoIP address from that server of theirs.

DeletedUser594

DeletedUser622

If you use Google Fi, you can have your entire device routed through Google’s VCS when using WiFi Auto Connect+

https://support.google.com/fi/answer/10460561?sjid=9335986817852428138-NC#zippy=%2Chow-wi-fi-auto-connect-works

telemetry83

This has been discussed in the past.

#3158
#9784
#9784
#15856

GrapheneOS team response:

Carrier-based calls/texts don't go through the user's VPN whether it's using the cellular connection or Wi-Fi. VoLTE, VoNR and VoWi-Fi are based on using SIP via IMS over an IPSec tunnel. The IPSec tunnel to the carrier is the VPN and there's always one.

VoWi-Fi could theoretically go through another VPN but it would need to support sending IPSec traffic through it which is not usually the case. You can't trivially send IPSec through another VPN. Linux kernel doesn't support nesting IPSec itself and it causes MTU issues when doing it multiple machines / virtual machines.

I don't see a feature request in the GrapheneOS issue tracker. You could create one there, but the complexity lowers the likelihood of it being implemented.

23Sha-ger First of all, your carrier knows your identity, so it makes little sense to hide your IP from them.

Which identity are you referring to? A carrier knows the IMEI and IMSI, but a carrier doesn't have to know a subscriber's personal identity. In cases where a subscriber is looking to protect that, it makes sense to hide an IP address if the IP address is linked to the subscriber's identity.

As schklom replied, a VPN on Wi-Fi router is the current way to achieve this.

DeletedUser622

schklom Thanks, I know it is feasible, however I would like to only use my GOS phone, hence the question.

23Sha-ger your carrier knows your identity, so it makes little sense to hide your IP from them

They may know the identity, actually. The country I live in has unregistered prepaid cards. Anyway, in my case I use a subscription with my true identity. What I am willing to avoid, is the carrier pinpointing my location as I'd use VoWiFi in airplane mode. I also have plenty of WiFi networks where I usually commute and reside.

23Sha-ger All carriers I saw, force VoWiFi incoming IP address to be geolocated in the same country as the home carrier

Not an issue, the VPN in question is my VPS in a local datacenter.

hociv82468

Vowifi over a VPN paired with VoCrossSIM "backup calling" #4415 looks like it has the potential to be a more reliable and accessible alternative to VoIP apps for separating your precise physical location from your SMS/call activity, whilst also reducing the number of parties that get your call/SMS data/metadata.

As you could have a data sim that knows your location but not your activity due to VPN and another sim that knows your SMS/call activity but not your location because it uses the data sim for Vowifi over a VPN!