WireGuard on Peplink: Modern VPN Remote Access Arrives with Firmware 8.6.0

Remote access has been a core requirement of modern network infrastructure for years. Employees access corporate resources from home, on the road or from branch offices. Previous VPN protocols such as OpenVPN, L2TP or PPTP have proven that they work — but they show their limits as soon as performance, connection stability during network changes or maintainability come into play.

With Firmware 8.6.0, Peplink changes the game. WireGuard — the most modern VPN protocol currently being developed — is now available on all Peplink models. As a Peplink Gold Partner, Ascend supports you in implementing and migrating your VPN infrastructure.

In this article, we look at WireGuard in the Peplink context, compare it with the established protocols and give clear recommendations for your use cases.

WireGuard is a modern VPN protocol that was released as stable in 2020 after years of development. It was designed from the ground up — not as an evolution of existing protocols, but with the ambition to do everything better: faster, more secure, simpler.

The key properties

Slim codebase. The WireGuard kernel code comprises around 4,000 lines. For comparison: OpenVPN/IPsec stacks are in the range of 100,000 to 400,000 lines. Less code means smaller attack surface, easier audits and fewer bugs. This is not just an academic argument — in practice, the slim architecture leads to measurably higher stability.

Modern cryptography. WireGuard uses Curve25519 (ECDH), ChaCha20 (symmetric encryption), Poly1305 (authentication) and BLAKE2s (hashing) by default. These algorithms are considered state of the art and are unanimously recommended by the cryptographic community. No configuration chaos with cipher suites like with OpenVPN — WireGuard fixes the algorithms.

Lightning-fast connection setup. The handshake takes only a few milliseconds. Where OpenVPN often needs several seconds to establish a tunnel, WireGuard is practically instantaneous. For end users this means: you click connect and the tunnel is up — without noticeable delay.

Roaming without tunnel drops. WireGuard survives network changes — from Wi-Fi to cellular and back — without losing the connection. This is a decisive advantage for mobile users. The tunnel persists, the session continues, applications do not break.

Why this matters for Peplink users

Peplink routers are frequently used in demanding environments — from construction sites to event venues to mobile operations. Here, WireGuard's combination of performance and robustness pays off particularly well. With Firmware 8.6.0, all Peplink models gain access to this technology — without additional licenses or hardware upgrades.

Peplink routers support four VPN protocols for Remote User Access with Firmware 8.6.0: WireGuard, OpenVPN, L2TP and PPTP. In the following, we compare the three relevant options.

Comparison table

• Codebase: WireGuard around 4,000 lines; OpenVPN stacks in the range of 100,000 lines and more; L2TP is IPsec-based and correspondingly complex.
• Encryption: WireGuard with fixed ChaCha20; OpenVPN configurable (typically AES); L2TP over IPsec.
• Handshake: WireGuard in the millisecond range; OpenVPN and L2TP usually need seconds.
• Roaming on network change: WireGuard persists; OpenVPN and L2TP tunnels usually drop.
• Configuration effort: WireGuard minimal; OpenVPN medium to high; L2TP medium.
• Platform support: WireGuard with native clients for all common OS; OpenVPN with its own client; L2TP OS-integrated.

WireGuard

Strengths: Minimal configuration effort, fastest handshake, seamless roaming. WireGuard also does not respond to unauthenticated packets and stays inconspicuous to scans. WireGuard is the most modern and most performant option.

Weaknesses: Relatively new in the Peplink ecosystem, hence fewer documented edge cases than OpenVPN. No native support for site-to-site connections on Peplink (deliberately — SpeedFusion is for that).

OpenVPN

Strengths: Proven for decades, huge community, extremely flexible to configure. TCP mode also works through restrictive firewalls.

Weaknesses: Slow handshake, tunnel drops on network change, complex cipher configuration, higher resource consumption on the router.

L2TP

Strengths: OS-integrated (no additional client needed), IPsec encryption.

Weaknesses: Slowest handshake of the three options, tunnel drops on network change, fixed to UDP ports 500 and 4500 (firewall-relevant). L2TP without IPsec is insecure — IPsec is complex to configure.

Recommendation

WireGuard is the standard recommendation for new Remote User Access from Firmware 8.6.0 onward. Existing OpenVPN setups do not need to be migrated immediately, but for new configurations and mobile users, WireGuard is the superior choice. L2TP should only be used for compatibility cases going forward.

One of the most important decisions in VPN planning is: is this about Remote User Access (a single user connects to the network) or site-to-site (two networks are permanently connected)?

Remote User Access with WireGuard

Use cases:

• Home-office employees access the corporate network
• Field staff connect on the go
• Technicians access systems remotely
• Administrators maintain systems from afar

Advantages of WireGuard here: fast connection setup, roaming when switching between Wi-Fi and cellular, low resource consumption on the router. The user starts the WireGuard client on their device (Windows, macOS, iOS, Android) and connects to the Peplink router as the server.

Site-to-Site with SpeedFusion

Use cases:

• Two or more branch offices are to be permanently connected
• Load balancing over multiple WAN connections
• Bandwidth bonding (WAN bonding)
• Failover between sites

Why not WireGuard for site-to-site? Peplink deliberately positions WireGuard for Remote User Access. For site-to-site connections between Peplink routers, SpeedFusion is the optimal solution. SpeedFusion offers WAN bonding, automatic failover, traffic optimization and VPN tunnels developed specifically for permanent site connections. No generic VPN protocol can compete here.

Decision ladder

1. A single user connects to the network? → WireGuard (Remote User Access)
2. A user needs access to one specific router, not the entire network? → SFC Direct Access (see next section)
3. Two networks are to be permanently connected? → SpeedFusion (site-to-site)
4. Two networks are to be connected but no Peplink on the other side? → IPsec VPN (site-to-site, vendor-neutral)

With Firmware 8.6.0, Peplink also supports SHA2-384 as the hash algorithm for IPsec Phase 2, which further improves interoperability with other vendors.

An innovation that goes hand in hand with the WireGuard release is SFC Direct Access. This feature of the SpeedFusion Connect (SFC) app makes it possible to access supported routers directly — without manual VPN tunnel configuration.

How SFC Direct Access works

The SpeedFusion Connect app on the end device automatically builds a tunnel to the target router. The administrator does not need to perform any complex VPN configuration on the router — the connection is mediated via Peplink infrastructure and established automatically.

Use cases for SFC Direct Access

• Remote maintenance: administrators quickly access routers without manually creating VPN profiles.
• Support from Ascend: as a Peplink Gold Partner, Ascend can reach supported routers via SFC Direct Access — ideal for proactive service.
• Temporary access: short-term connections for troubleshooting or configuration changes without creating permanent VPN profiles.

SFC Direct Access vs. WireGuard Remote Access

• Criterion: configuration effort · SFC Direct Access: minimal (app-based) · WireGuard Remote Access: medium (profiles & keys)
• Criterion: target · SFC Direct Access: a single router · WireGuard Remote Access: the entire network
• Criterion: persistence · SFC Direct Access: session-scoped · WireGuard Remote Access: permanent
• Criterion: client · SFC Direct Access: SpeedFusion Connect app · WireGuard Remote Access: WireGuard client (OS-native)
• Criterion: ideal for · SFC Direct Access: remote maintenance, support · WireGuard Remote Access: regular remote access

The two approaches complement each other. WireGuard is the choice for regular, permanent remote access to the corporate network. SFC Direct Access is ideal for administrative access to individual routers without configuration effort.

With Firmware 8.6.0, Peplink brings the VPN world up to date. WireGuard is now the first choice for Remote User Access — faster, more robust and simpler than OpenVPN or L2TP. The native implementation on all Peplink models makes the migration straightforward.

The important distinction: WireGuard is for Remote User Access, not for site-to-site. For site connections between Peplink routers, SpeedFusion remains the optimal solution. And for fast remote maintenance of individual routers, SFC Direct Access complements the portfolio.

As a Peplink Gold Partner, Ascend supports you in planning, implementing and migrating your VPN infrastructure. Whether you are introducing WireGuard for the first time or migrating from OpenVPN — our Peplink-certified engineers are ready.

Contact Ascend for your VPN implementation: https://www.ascend.de/en/loesungen/marken/peplink/

This article was researched and written with AI support and reviewed before publication by Ascend's Peplink-certified engineers.