It's to do with DNS. Push uses a connection to the exchange server via 3g so uses you outside public ip address. Wifi I would assume is on your lan, hence uses the internal ip address.
Depending on you firewall you can set it up so that wifi will use your external ip address for the exchange server and be allowed through your firewall.