SpeedFusion 101

SpeedFusion is the technology that turns several imperfect internet connections into one connection that behaves better than any of them alone. This guide explains what it is, how each of its bonding behaviors works, and how to think about the trade-offs — overhead, latency, and traffic steering — so you can plan a deployment that actually delivers.

What SpeedFusion Is

SpeedFusion is Peplink’s proprietary system architecture for delivering unbreakable internet connections, enhanced speeds, and seamless, jitter-free video conferencing. Rather than picking one link and hoping it holds up, SpeedFusion takes multiple WAN connections — fiber, dual 5G, Starlink, LTE, or any mix of them — and combines them into a single logical VPN tunnel between two endpoints.

Networks are unreliable on their own. Wireless links are highly variable and get congested; real-time services like voice and video are very sensitive to packet loss. SpeedFusion addresses this by treating all available WAN links as one virtual network connection. If a single WAN fails, SpeedFusion detects the failure at the packet level and seamlessly redirects traffic across the remaining links — which is what makes site-to-site connectivity so resilient.

Creating a SpeedFusion connection always requires two endpoints. The second endpoint can be:

• A Peplink-hosted server — available through a SpeedFusion Connect subscription.
• Another SpeedFusion-compatible Peplink device — any Peplink device that supports SpeedFusion.
• A user-hosted cloud instance — a cloud-native virtual instance (FusionHub or FusionHub Solo) you run on your own cloud infrastructure.

SpeedFusion Security

Every SpeedFusion connection establishes a secure WAN-to-WAN link using the Diffie-Hellman key exchange protocol and public-key cryptography. Encryption keys are derived from exchanged master keys and are renegotiated at random intervals, which provides perfect forward secrecy. All data crossing the WAN-to-WAN links is protected with 256-bit AES encryption.

Because SpeedFusion uses every available WAN by creating sub-VPN tunnels, the number of tunnels depends on the WAN count at both ends. If the local site has 4× 5G and 2× Starlink (6 WANs) and the remote site has 2× fiber, SpeedFusion builds 12 tunnels (6 × 2) — each with its own set of encryption keys.

A single TCP/IP session is distributed across those multiple tunnels, with data broken into packets, and each WAN-to-WAN connection is encrypted separately. To read the data, an attacker would need to compromise the key for every connection simultaneously — which makes SpeedFusion virtually impervious to man-in-the-middle attacks.

The SpeedFusion Technologies

SpeedFusion is versatile: the same protocol can be optimized for the highest throughput or for maximum reliability, depending on whether you are running an enterprise branch office, a remote industrial site, or a vehicle or vessel on the move. The building blocks below can be combined to fit the deployment.

Bandwidth Bonding

Bonding combines the speed and bandwidth of multiple WAN connections into a single aggregated virtual WAN. Instead of load-balancing sessions across links, all WANs work together on one logical VPN, so throughput scales with the connections you add.

Hot Failover

Hot Failover lets two SpeedFusion peers maintain session persistence even while switching between WAN connections. The switch can happen between any links — fixed lines, cellular, or a mix — and authenticated sessions and video calls keep running as connections change. Hot Failover is the core on which all the other SpeedFusion technologies are built.

WAN Smoothing

For streaming traffic such as VoIP or video conferencing, connection quality matters more than raw speed — high latency breaks the flow of a conversation and packet loss causes jitter and dropped words. WAN Smoothing reduces the impact of packet loss and improves latency by duplicating packets across multiple WAN links, in exchange for extra bandwidth. It also works with a single WAN-to-WAN link.

The amount of smoothing is configurable to your bandwidth sensitivity:

Setting	Bandwidth consumption
Normal	At most 2× the original traffic
Medium	At most 3× the original traffic
High	At most 4× the original traffic
Maximum	Depends on the number of active WAN-to-WAN connections

(With a single WAN-to-WAN link, WAN Smoothing consumes 2× the original traffic.)

Forward Error Correction (FEC)

FEC provides packet-loss protection while minimizing bandwidth consumption. Where WAN Smoothing duplicates whole packets, FEC sends additional reserve (parity) packets that can rebuild lost packets on the fly through interpolation — so if a packet is dropped, the receiver reconstructs it instead of waiting for a retransmission.

Per SpeedFusion profile, FEC is set to Low (13.3% additional bandwidth) or High (26.7% additional bandwidth).

Using WAN Smoothing and FEC together

The two techniques are complementary. WAN Smoothing mitigates a high-latency moment on one WAN by duplicating traffic onto another link with steadier latency; FEC infills lost packets from parity data transmitted alongside. If you have a router with enough headroom and sufficient bandwidth, running both at once is recommended for optimal performance.

The one exception is streaming video on the move: WAN links are so variable and volatile in latency during transit that WAN Smoothing tends to work more reliably on its own.

Traffic Overflow — prioritize affordable links

SpeedFusion lets you set the order in which WAN connections are used. This is useful when one link is cheaper than the others: put the affordable WANs at first priority, and the more expensive connections are only brought in once the first reaches its configured capacity.

Setting up profiles, smoothing levels, and FEC step by step is covered in the User Guide at /docs/speedfusion/.

Outbound Policy — Steering Traffic Into the Tunnel

An important point that surprises newcomers: SpeedFusion does not automatically send everything through the tunnel. You must explicitly steer traffic into it. Traffic identified as needing the VPN is handed to SpeedFusion (encrypted, distributed across links, reassembled in order at the far end); everything else goes straight to the internet.

Today’s networks carry a diverse mix — video, VoIP, gaming, cloud apps, web browsing — and SpeedFusion gives you granular control over how each kind travels. This is done by creating multiple SpeedFusion profiles on the same router. Each profile can use different WAN connections, different bandwidth limits, and its own WAN Smoothing and FEC settings. Once those tunnels exist, outbound policy steers traffic into them based on protocol, port, application, or client type.

Peplink also supports Deep Packet Inspection (DPI), which recognizes traffic from specific applications (Skype, Google Hangouts, Spotify, Dropbox, BitTorrent, and more). DPI results can drive firewall rules, outbound policy, and assignment of SpeedFusion sub-tunnels — so, for example, you can route VoIP down a low-latency smoothed tunnel while bulk file transfers take a cheaper high-capacity path.

Full outbound-policy and DPI configuration is documented in the User Guide at /docs/speedfusion/.

Multi-Site Layer 2 VPN

A SpeedFusion Layer 2 VPN makes devices at different physical sites behave as if they were on the same local network — the same LAN and subnet stretched across locations. That is what makes it possible to remotely operate devices like printers and access points, share resources such as NAS drives, and support server-to-server communication as though everything were in one building.

The Layer 2 VPN can be applied two ways:

• To the VLAN trunk — all traffic from the router crosses the VPN and is treated as LAN traffic by the remote site.
• To a specific VLAN — only that VLAN’s traffic is considered local by the remote site, keeping the rest routed normally.

Trunk vs. per-VLAN setup is walked through in the User Guide at /docs/speedfusion/.

Understanding Overhead: The Cost of the Tunnel

SpeedFusion encapsulates all traffic in a special UDP stream carrying extra headers — the information needed to reassemble the original data in the correct order at the far end. It adds a fixed 80 bytes per packet, regardless of the original packet size, and includes advanced routing, load balancing, and 256-bit AES encryption inside that overhead.

VPN overhead comparison

Protocol	Per-packet overhead
SpeedFusion	80 bytes (fixed) — includes routing, load balancing, and 256-bit AES
IPsec	44–73 bytes (commonly ~58)
WireGuard	60 bytes (IPv4) / 80 bytes (IPv6)

Because the overhead is a fixed number of bytes, its percentage impact shrinks as packets get larger. Measured against the industry-standard Internet Mix (IMIX) profile (a realistic blend of packet sizes totaling 4,084 bytes), SpeedFusion adds about 960 bytes — roughly 19% overhead. But the effect is very size-dependent:

• At 1500-byte packets, SpeedFusion adds only about 5%.
• At 40-byte packets, overhead rises to about 200%.

Against the same IMIX mix, IPsec runs about 14.6%. In other words, for only around 4–4.4% more overhead than IPsec, SpeedFusion delivers bandwidth aggregation and WAN resilience on top of encryption.

Calculating bonding overhead

This matters when setting expectations. A customer who bonds two links to get “more bandwidth” will not see the raw sum. Assuming IMIX-like traffic and the ~19% overhead, bonding two identical circuits looks like this:

Explain this to end users up front so a bonded 200/40 link delivering ~162/32 isn’t mistaken for a fault. For that small overhead premium over conventional VPN, they gain aggregation and resilience.

Bonding different WAN links well

• Use links with similar bandwidth profiles (within 50% of each other) and similar latency (within 150 ms of each other) for the highest performance.
• Use links from different ISPs where possible. Provider diversity reduces the chance that one technical — or even billing — error takes the whole site offline, and it lessens the bandwidth-sharing problem common to multiple circuits from a single provider.
• When measuring, use the WAN Analysis tool to test throughput without SpeedFusion, then the SpeedFusion VPN Test tool to test with it — and always drive all WANs simultaneously. Test for 5–10 minutes, not 20–30 seconds; wireless links fluctuate so much that a short test can be wildly misleading.

Addressing latency and packet loss

When links have similar latency, mixing them barely affects throughput. When latencies differ widely, throughput suffers, because the SpeedFusion link equalizes to the highest-latency member. Representative per-link latencies:

Link type	Typical latency
Ethernet / fixed line	3–5 ms
Starlink / LEO satellite	50–60 ms
Remote LTE	~100 ms

Bond a 3–5 ms Ethernet link with a 50–60 ms Starlink link and packet loss on the fast link takes 50–60 ms+ to detect, because the tunnel now runs at the slower link’s timing. Two better strategies:

• Put lower-latency links on SpeedFusion and set higher-latency links to failover (assuming the fast links carry enough bandwidth).
• Use higher-latency links for direct, latency-tolerant traffic (like plain internet access) while reserving low-latency links for VoIP, ERP, and other traffic that must transit the VPN.

Note: UDP traffic over SpeedFusion can achieve higher throughput than TCP, whose flow control is restrictive and very sensitive to packet loss.

Using SpeedFusion Behind a Firewall

By default, SpeedFusion establishes VPN connections and moves data over TCP port 32015 and UDP port 4500. If IPsec or L2TP/IPsec services are enabled, UDP port 32015 is also used. You can change the Data Port assignment in the SpeedFusion profile to another value if your firewall policy requires it.

Firewall and Data Port configuration is detailed in the User Guide at /docs/speedfusion/.

⭐ SpeedFusion Boost

SpeedFusion Boost is Peplink’s built-in optimization that works inside the SpeedFusion tunnel. Its job is to sustain high throughput across lossy, unpredictable links and stop a slower or flakier link from dragging down the faster ones — maximizing throughput over high-latency SpeedFusion connections built from bonded cellular, LEO satellite (Starlink), and other WANs.

It is enabled per SpeedFusion VPN profile — effectively a checkbox in the profile — and it is supported on all models.

Boost pairs naturally with the guidance above: on volatile Starlink/LEO and cellular links, enabling Boost alongside FEC (and, where appropriate, the DWB “Ignore Packet Loss Event” option) is what keeps a many-WAN bond fast and stable instead of merely resilient.

Enabling SpeedFusion Boost per profile is covered step by step in the User Guide at /docs/speedfusion/.

Where to Go Next

SpeedFusion rewards planning: match your links, steer the right traffic into the tunnel, budget for overhead, and turn on the smoothing, FEC, and Boost options that fit your workload. Every configuration walkthrough referenced above lives in the User Guide at /docs/speedfusion/.

If you’re ready to choose hardware or a SpeedFusion subscription, browse the product line at buypeplink.com or read the manufacturer’s technology overview at peplink.com.