192.168.1.1). 2) Navigate to WAN → NAT Passthrough (or Firewall Settings). 3) Ensure IPsec Passthrough is set to Enabled. 4) Locate UDP Session / NAT Timeout and increase the value from 30 seconds to 180–300 seconds. 5) Enable QoS and prioritize UDP ports 500 and 4500. Save settings and reboot your router. VoWiFi call stability will restore immediately.
Protocol Architecture: How Wi-Fi Calling Establishes Encrypted Tunnels
Wi-Fi Calling (VoWiFi) does not operate like standard VoIP apps (such as WhatsApp or Skype). Instead, mobile carriers (including T-Mobile, AT&T, Verizon, EE, and Vodafone) establish an encrypted, carrier-grade IPsec tunnel directly from your smartphone's baseband modem to the mobile carrier's ePDG (Evolved Packet Data Gateway):
- IKEv2 (Internet Key Exchange): Initial cryptographic security association is negotiated over UDP port 500.
- IPsec NAT-Traversal (NAT-T): Because residential routers translate IP addresses, all subsequent encrypted voice payloads (Encapsulating Security Payload - ESP) are encapsulated inside standard UDP datagrams over UDP port 4500.
Because UDP is a connectionless protocol, home routers maintain an internal translation table (NAT state table). If your smartphone does not transmit voice packets for a brief period (e.g., during a pause in conversation or background idle), a router with an aggressive 30-second UDP timeout purges the NAT translation entry. The IPsec tunnel collapses silently, causing dropped calls or one-way audio.
VoWiFi Network Parameter & Timeout Recommendations
| Router Setting / Parameter | Standard Factory Default | VoWiFi Optimized Value | Impact on Call Reliability |
|---|---|---|---|
| UDP NAT Keepalive Timeout | 30 seconds | 180 – 300 seconds | Prevents silent call dropouts during pauses |
| IPsec Passthrough (ESP) | Disabled or Auto | Enabled | Ensures clean transport of carrier encrypted voice |
| SIP ALG (Application Layer Gateway) | Enabled | Disabled | Prevents router firmware from corrupting SIP headers |
| QoS Voice Prioritization | Unmanaged / FIFO | DSCP EF (46) Priority | Eliminates audio stutter under heavy home downloading |
Step-by-Step Optimization Protocol Across Leading Routers
- Disable SIP ALG: In AsusWRT, TP-Link, or Netgear, navigate to WAN → NAT Passthrough. Locate SIP Passthrough / SIP ALG and switch it to Disabled. SIP ALG is designed for legacy VoIP phones and corrupts modern encrypted carrier VoWiFi handshakes.
- Extend UDP State Timeout: In AsusWRT, go to Administration → System → NAT Timeout: UDP and set value to
180or300. In OpenWrt, edit/etc/sysctl.confand add:net.netfilter.nf_conntrack_udp_timeout = 60 net.netfilter.nf_conntrack_udp_timeout_stream = 180 - Adjust DTIM Interval for Mobile Battery Sleep: In Wireless → Professional → DTIM Interval, change value from 1 to 3. This prevents Android and iOS devices from sleeping through carrier keepalive beacon packets.
Frequently Asked Questions (FAQ)
Why does Wi-Fi Calling work near the router but drop in my bedroom?
Wi-Fi Calling requires a steady signal with an RSSI stronger than $-75 ext{ dBm}$. When signal drops below this threshold, packet loss triggers an automatic handoff back to weak cellular coverage, dropping active calls.
Does Wi-Fi Calling consume substantial internet bandwidth?
No. VoWiFi utilizes adaptive AMR-WB (Adaptive Multi-Rate Wideband) audio codecs consuming only 80 kbps to 120 kbps of bandwidth. Latency stability and low jitter ($<30 ext{ms}$) are far more critical than raw bandwidth.
Why do outgoing calls connect but I cannot receive incoming calls on Wi-Fi?
This is a classic symptom of an expired UDP NAT timeout table. Outbound calls create a fresh NAT session, while incoming calls fail because the carrier's inbound probe is rejected by the router's closed firewall.
Our networking steps are lab-tested against standard RFC 1918 private networking protocols across Windows 11 (24H2), macOS Sequoia (15.1), iOS 18, and Android 15. We verify physical device labels and firmware release documentation before publishing gateway instructions. Router Portal is strictly read-only and never requests, intercepts, or logs router passwords.