User Manual

USER MANUAL

Peplink Balance Series

12.2 Peplink Balance Behind NAT Router

The Peplink Balance supports establishing Site-to-Site VPN over WAN connections which are behind a

NAT (Network Address Translation) router.

To be able for a WAN connection behind a NAT router to accept VPN connections, you can configure the

NAT router in front of the WAN connection to inbound port forward TCP port 32015 to the Peplink

Balance.

If one or more WAN connections on Unit A can accept VPN connections (by means of port forwarding or

not) while none of the WAN connections on the peer Unit B can do so, you should put all public IP

addresses or host names of the Unit A to the Unit B’s Peer IP Addresses / Host Names field. Leave

the field in Unit A blank. With such setting, site-to-site VPN connection can be set up and all WAN

connections on both sides will be utilized.

For example, see the following diagram:

One of the WANs of Balance A is non-NAT’d (212.1.1.1). The rest of the WANs on Balance A and all

WANs on Balance B are NAT’d. In such case, the Peer IP Addresses / Host Names field in Balance B

should be filled with all of the Balance A’s host names or public IP addresses (i.e. 212.1.1.1, 212.2.2.2

and 212.3.3.3), and the field in Balance A can be left blank. The two NAT routers on WAN1 and WAN3 of

Balance A should inbound port forward TCP port 32015 to the Balance A so that all WANs would be

utilized to establish VPN.