PEPLINK UNIVERSITY  •  A WEST NETWORKS TRAINING RESOURCE (352) 316-7701  ·  SHOP PEPLINK →

IP Forwarding (Routing Without NAT)

IP Forwarding runs a Peplink WAN as a pure router: public subnets flow untranslated. When to route instead of NAT, per-WAN routing modes, routed VLAN subnets, and the firewall and asymmetric-routing gotchas.

Every Peplink WAN can run in one of two routing modes: NAT (the default — private LAN hidden behind one WAN address) or IP Forwarding — the router simply routes, and real, public addresses flow through untranslated. When an ISP routes you a block of addresses, or your architecture cannot tolerate another NAT layer, this is the mode you want.

When routing beats NAT

  • The ISP routes you a subnet — a /29 or /28 of public space pointed at your WAN. Forward it; don’t NAT it.
  • Servers need to be themselves — mail servers, VPN concentrators, and anything certificate- or reputation-bound behaves better on its real address.
  • The Peplink sits upstream of other routers — double NAT breaks enough things (SIP, IPsec, gaming, some VPNs) that avoiding it is a design goal on its own.

How it works on Peplink

  • Routing mode is set per WAN in the WAN’s connection settings — one WAN can forward while others NAT.
  • For additional routed blocks, you can also take the approach from WAN Settings: put the routed subnet on a VLAN in IP-forwarding mode and let the LAN side carry the public space.
  • Outbound policy still decides which WAN traffic uses; forwarding only changes whether addresses are translated on the way out.

Field note

IP Forwarding is one of those settings that separates “internet works” from “network engineered.” If you find yourself building port-forward after port-forward to expose a subnet’s worth of services through one NAT address, stop: get a routed block from the carrier and forward it properly.

Gotchas

  • You are now routing public address space — the firewall matters. NAT’s accidental inbound protection is gone; review inbound firewall rules before the maintenance window ends, not after.
  • Watch for asymmetric routing when some WANs NAT and one forwards — a session that leaves translated and returns untranslated (or vice versa) will break in ways that look like packet loss.
  • Document which WAN owns which block. Six months later, nobody remembers — and the next engineer will re-learn it during an outage.

Related reading