IP Passthrough turns a Peplink into a transparent modem: the router takes its WAN address — usually a cellular carrier IP — and hands it straight to the one device behind it, typically a firewall. The firewall believes it is plugged directly into the carrier; the Peplink manages the radio and gets out of the way.
The problem it solves
Security policy at many organizations says the firewall must own the public IP — VPN endpoints, inbound rules, and audits are all anchored to it. IP Passthrough lets you add a Peplink cellular WAN to that world without an argument: the carrier address lands on the firewall’s WAN port, exactly as if the carrier had installed a plain modem.
Single and multi
- Single IP passthrough — the classic mode. One WAN address is delivered to one downstream device. Enable it on the cellular WAN’s details page on MAX/BR-series routers, and the next DHCP lease the downstream device pulls is the carrier IP itself.
- Multi-IP passthrough — when the upstream delivers a block of public addresses, multiple addresses are passed through to multiple downstream hosts, each reaching its device untranslated. Availability varies by model and firmware — if your design depends on it, confirm the target hardware with us first.
Passthrough vs Drop-in vs Forwarding
- IP Passthrough feeds one downstream WAN port. The Peplink is a modem; its multi-WAN features do not apply to the passed traffic.
- Drop-in Mode joins an existing LAN subnet mid-network and keeps bonding and outbound policy for everything flowing through.
- IP Forwarding routes whole public subnets without NAT — for when many devices need real addresses, not just one.
Field note
The most common passthrough deployment we build: a MAX BR1 as pure cellular backup into an existing firewall’s second WAN port. The firewall vendor’s HA/failover logic stays in charge; the Peplink just makes the carrier connection excellent. It is also the honest answer when a customer’s security team will not put anything they don’t manage in the routed path.
Gotchas
- Keep a management path. Once the WAN IP passes through, reaching the Peplink itself takes forethought — keep a separate LAN port or VLAN for management, or manage it through InControl 2.
- You are trading away the router’s intelligence for the passed traffic. No bonding, no WAN smoothing, no outbound policy on what passes through. If you want the firewall to keep its IP and want SpeedFusion underneath, look at Drop-in Mode instead.
- Carrier IP changes propagate to the downstream device by DHCP lease renewal — keep leases short if the carrier rotates addresses.
Related reading
- Drop-in Mode — transparent insertion with the SD-WAN features kept.
- IP Forwarding — routing real address space instead of passing a single IP.
- All WAN options & technologies