VoWiFi traffic over IPsec, not blocked by rethinkdns by default?

i use a rethinkdns v0.5.6 (website) on my android 16 and and log dns and traffic flow and block all apps and use isolate to allow "pinholes" outbound.

I also have all apps that have any access routed through a wireguard VPN.

i recently enabled vowifi with my cell carrier and it works, but i dont see any dns nor traffic in the logs, why?

would this explanation below be accurate?

The most likely reason is that VoWiFi traffic is carried over IPsec (IKE on UDP 500 / NAT-T on UDP 4500), which is encrypted end-to-end. Your firewall sees the IPsec packets as opaque encrypted blobs.

why wouldn't rethinkdns block these ports/traffic and log it by default when I block all other apps or use isolate where needed?

does android 16 do something lower level with vowifi and cell carrier network?

any insight?

please advise…. 😁