Most of the time you manage a Peplink router entirely through its web UI — over the LAN or through InControl 2. But every unit also has two physical access paths that exist for the moments when the normal way in isn’t available: the console port and the management port. Here is what each is actually for, and how a professional deployment should treat them.
The console port — for engineering, and off by default
The console (serial) port is an engineering interface. It exists for low-level, last-ditch diagnostics — not day-to-day administration — and Peplink provides only very minimal support for working over the console. You will not find the full web UI there; it is a bare, limited interface.
It is also disabled by default. If you want to use it, you have to turn it on first, in one of two places:
- In the web UI — enable the console under System › System Settings before you connect.
- Or in InControl 2 — enable it at the device level if you manage the unit from the cloud.
Until you enable it in one of those two places, a serial cable into the console port does nothing. Treat the console as a break-glass tool for engineers — not a normal way in.
The management port — the “get me back in” port
On the models that have one, the dedicated management port is not the segmented, locked-down interface the name suggests. In practice it behaves like an unmanaged LAN port that trunks everything — all VLANs, no isolation, no policy.
Think of it as a last-resort recovery port: if you misconfigure your LAN or VLANs and lock yourself out of the box, you plug straight into the management port to get back in and fix it. It is a safety net, not a security boundary.
Don’t make it your everyday management network
Because it trunks every VLAN with no filtering, leaving a laptop — or worse, a switch — permanently on the management port quietly defeats the segmentation you built everywhere else.
Do it right: build a real management network
If you want an actual management port — something segmented, controllable, and safe to leave patched in — don’t rely on the physical “management” port. Build one:
- Create a management VLAN — a dedicated VLAN reserved for device administration. You add VLANs in the Network tab locally, or via Grouped Networks in InControl 2.
- Set a LAN port to access that VLAN — so anything plugged into that port lands only on the management network, and nothing else.
- Lock it down — apply firewall / access rules so only the right people and hosts can reach the admin interface on that VLAN.
That gives you a purpose-built management port with real isolation — which is what you actually want in production. The built-in management port then stays what it should be: the emergency door you only open when you’ve locked yourself out.
West Networks field note
Our recommendation: reserve the console for engineering, treat the physical management port purely as break-glass recovery, and do all real day-to-day management over a proper management VLAN + access port. That’s the difference between “a port labelled management” and an actual managed network.