The firewall in every Peplink router is a full policy engine, not a checkbox. Four rule domains cover every direction traffic can move, and deep packet inspection lets you write policy about what the traffic is, not just where it’s going.
Four rule domains
- Inbound rules — what the outside world may reach behind your WANs.
- Outbound rules — what your users and devices may reach on the internet.
- Internal rules — traffic between VLANs and subnets inside the network; segmentation is enforced in the same policy language.
- Local service rules — access to the router’s own services (web admin, API, VPN endpoints), so the management plane is firewalled like everything else.
Application blocking and DPI
Deep packet inspection classifies traffic by application — not port number — so policy like “no BitTorrent, no anonymizers, streaming throttled on the guest VLAN” is one rule, not a list of ports that stopped being accurate in 2015. The DPI reports in InControl show you what’s actually on the wire before you write the rule.
IDS and DoS protection
Built-in intrusion detection and denial-of-service protection watch for scan patterns, floods, and malformed-traffic attacks at the edge, where they’re cheapest to stop.
Content blocking and per-VLAN DNS
Content blocking filters web categories per network — guest Wi-Fi gets a family-safe policy while the corporate VLAN stays open. With firmware 8.6, Cloudflare DNS can be assigned per VLAN, so each segment can run its own filtered resolver (e.g., Cloudflare for Families on guest, standard on corporate, logging resolver on IoT) with zero extra hardware.
Hands-on walkthroughs: Firewall & Access Rules guide · prioritize POS over guest Wi-Fi.