Firewall Ports Used by Peplink Routers & Services

Peplink routers rarely live alone. They sit behind carrier CGNAT, inside a data center’s edge firewall, downstream of a corporate security appliance, or in front of a hub that terminates dozens of tunnels. The moment another device filters traffic for a Peplink, you need to know exactly which ports the platform uses — and in which direction. This page is the complete reference: what to allow, what each port does, and which numbers you can change.

Critical ports at a glance

How to read these tables

• Inbound = a connection arriving at the Peplink from outside (someone must be able to reach the device on that port). On an upstream firewall this means a permit rule, and often a port forward, toward the Peplink’s WAN IP.
• Outbound = the Peplink connecting out. Most cloud services need only outbound rules — no inbound holes at all.
• Ports marked configurable can be changed on the device; everything else is fixed by the platform.

InControl 2 and the Peplink cloud

Everything a managed device needs from the Peplink cloud is outbound only. A device behind CGNAT or a deny-all edge still manages fine as long as these flows can leave:

SpeedFusion / PepVPN — including FusionHub

FusionHub uses exactly the same ports as physical routers. The side that terminates tunnels (usually your hub or FusionHub) needs these inbound; the remote end connects outbound:

SpeedFusion Connect (SFC)

Devices reach Peplink’s hosted SpeedFusion Connect gateways outbound on TCP 32015 (handshake) and UDP 4500–4504 / 32015–32019 (data, including sub-tunnels). The gateway hostnames follow the pattern *.sfwangateway.peplink.com; the full regional list lives in the official endpoint file. These ports are not user-changeable for SFC. Note that classic InTouch depends on these same flows — its sessions tunnel through the SFC gateways and consume SFC data quota, so blocking SFC at an upstream firewall silently breaks InTouch even when InControl itself checks in fine.

IPsec and remote user access VPNs

Note the overlap: IPsec and L2TP/IPsec occupy UDP 4500, which is exactly why SpeedFusion falls back to its UDP 32015 alternative data range when both are in play.

Services on the router itself

Defaults from the current Peplink manual (Appendix B). Anything “disabled by default” is only a concern after you turn the feature on:

Lock the management plane down with local service firewall rules, and leave the console port disabled unless engineering needs it (console & management ports).

AP controller (managing Pepwave APs)

WAN Analysis

The built-in WAN-to-WAN throughput test runs between two Peplink devices: one acts as the server (it needs to be reachable), the other as the client. The control connection defaults to TCP 6000 and is changeable in the WAN Analysis settings. Tests can run in TCP or UDP mode.

Remote Assistance

Remote Assistance is how Peplink support engineers get a session on your device when you open a ticket — and it’s built so you never open an inbound hole for it. Access is opt-in, per device: enable it under System › Remote Assistance in the web admin (or from the device’s page in InControl 2), let support work the case, then switch it off when the ticket closes. The device dials out; nothing connects in.

Ports you choose yourself

Several features send to a destination and port that you configure, so there is no Peplink default — plan for the standard values unless you pick otherwise:

• Remote syslog — typically UDP 514 to your collector.
• NetFlow export — your collector’s port (2055 is the common convention).
• Email notifications — your SMTP server and port; the SMTP-forwarding feature also intercepts outgoing TCP 25 when enabled.
• TACACS+ — TCP 49 by convention.
• Routing protocols — OSPF is IP protocol 89, BGP is TCP 179, VRRP high availability is IP protocol 112. Standard values; Peplink doesn’t restate them in its port list.

SIM Injector

When a router reaches a SIM Injector across a routed network, the injector listens on a data port shown on its own settings page — TCP+UDP 50000 by default (community-reported and configurable; port-forward it to the injector when the router connects in over the internet). Verify on your unit’s settings page — this one isn’t in Peplink’s official port table.

Self-hosted InControl appliance (ICA / ICVA)

Running your own InControl appliance instead of the cloud? It has its own surface (from the official ICA Setup Guide):

Sources

Compiled and verified from Peplink’s official material: the knowledgebase port overview, the current product manual’s ports appendix, the official service endpoint list, and the InControl Appliance Setup Guide — plus West Networks field testing where noted. Found something that behaves differently on your firmware? Tell us and we’ll chase it down.