Running your own LTE network for fun and profit

The talk follows the speaker's attempt to run a private LTE network that can place ordinary phone calls, with the goal of staying legal and avoiding rooting the handsets. The regulatory part comes first. Band 48 falls under the CBRS shared-spectrum framework, so transmitting on it is not enough. The operator needs a CBRS-compliant base station, a spectrum authorization service, and a certified installer whose keys sign the installation. The installation record includes location and RF details, because spectrum can be withdrawn when a higher-priority user appears.

The technical middle covers the software stack. The network started on srsRAN and moved to Open5GS to get IMS telephony working. Calls were bridged to the public phone network through a PBX with SIP trunks. The first blocker was Android's carrier configuration database, which does not enable VoLTE for unofficial network codes. The workaround was a custom Android app whose signing hash is stored on the SIM. Writing that applet needed a SIM profile built from a PySIM-derived tool, and cheap SIM cards could not hold it, so eSIMs were used. Rooting with Shizuku or Pixel IMS was ruled out as a gimmick. Coverage was limited to the antenna's direction, so voice over Wi-Fi covered the rest. An audio codec mismatch between Asterisk and the phone's VoLTE stack needed transcoding.

The takeaways are practical. A working setup is possible but expensive and legally risky. Operators should lock down SIM provisioning on managed fleets, since the K and OPC values must never be readable.