How to Set Up Peplink WireGuard Remote User Access [Step-by-Step]

Want to check your cameras, grab a file off your NAS, or get into the office network while you're on the road? Peplink's Remote User Access feature supports WireGuard, so your laptop or phone can tunnel straight back into the LAN behind your Peplink router. Setup takes one profile or QR code per device, and you don't need a third-party service or subscription.

We set this up on a Peplink MAX BR2 Pro running firmware 8.6.1 build 6572. Every screenshot below comes from our test unit.

What is Peplink Remote User Access?

Remote User Access lets a single device, like a laptop, phone, or tablet, connect into the network behind your Peplink from anywhere. SpeedFusion is the other Peplink VPN option, and it connects Peplink routers to each other. Remote User Access supports L2TP with IPsec, PPTP, OpenVPN, and WireGuard. We recommend WireGuard for most people.

Why WireGuard?

WireGuard is lighter and faster than L2TP or OpenVPN, which you'll notice most over cellular. The tunnel stays up when your phone switches from Wi-Fi to LTE or 5G. Clients are easy to set up because you import one config file or scan a QR code in the free WireGuard app. Each user also gets their own key pair, so you aren't handing out a shared password.

Before you start

• A Peplink router on current firmware. We used 8.6.1, and you can update through InControl 2 or System > Firmware.
• A WAN with a public IP address. If the Peplink sits behind another router or modem, forward UDP 51820 to it.
• The free WireGuard app on each client (Windows, macOS, iOS, Android, or Linux).

A note about the WAN in our screenshots

Our lab BR2 Pro is double NATed. WAN 1 gets a private address (192.168.2.75) from another router upstream, so remote users couldn't reach it from the internet without extra port forwarding on that upstream router. Your WireGuard WAN needs a public IP. Most cellular carriers put you behind CGNAT, which blocks inbound connections entirely. A Crosstalk Mobile unlimited plan with our static IP add-on gives your Peplink a public, static address that WireGuard clients can always find.

Step 1: Confirm your firmware

Log in to the router's web admin, either locally or remotely through InControl 2 > InTouch. The firmware version is listed under Device Information on the Dashboard.

Step 2: Open Remote User Access

Go to Advanced > Remote User Access and check Enable.

Step 3: Choose WireGuard as the VPN type

Set VPN Type to WireGuard. The note under it says you'll find the client profile on the Status page once you save.

Step 4: Listen on one WAN only

Every WAN is checked by default, but WireGuard only allows one WAN connection and one interface IP. Uncheck everything except the WAN with your public IP. We used WAN 1.

Step 5: Port, network, and user accounts

Leave the port at 51820, the WireGuard default. Set Connect to Network to the LAN or VLAN your remote users should land on. We used Untagged LAN.

Under User Accounts, add one entry per device, such as demo-laptop. Each user needs a static IP. Pick an unused address in that network, outside your DHCP range. We used 192.168.50.250.

Click Save, then Apply Changes in the top right.

Step 6: Get the client profile or QR code

Go to Status > Device, find WireGuard Client Profile, and click View Profiles.

Each user has a Show QR Code link and a Download link.

On a phone or tablet, open the WireGuard app, tap +, choose Scan from QR code, and scan it. On a laptop, click Download and use Import tunnel(s) from file in the WireGuard app.

The QR code and .conf file contain the user's private key, so guard them like a password. We blurred ours.

Step 7: Connect and test

Turn off Wi-Fi on your phone so you're on cellular, switch the tunnel on, and browse to the router's LAN IP (192.168.50.1 in our setup). If the Peplink admin page loads, you're connected.

Troubleshooting

• If the handshake never completes, the WAN probably doesn't have a public IP (double NAT or CGNAT), or UDP 51820 isn't forwarded upstream.
• "Static IP cannot be empty" means a user account is missing its static IP.
• If you connect but can't reach devices, check Connect to Network and any firewall rules between VLANs.
• If your public IP changes, turn on Peplink DDNS so the profile points to a hostname, or use a static IP.

WireGuard vs. SpeedFusion vs. OpenVPN on Peplink

Use WireGuard Remote User Access when individual devices need to reach home or the office. Use SpeedFusion for router-to-router links with bonding and hot failover. OpenVPN and L2TP are still there for older clients that can't run WireGuard.

Recommended Peplink routers for WireGuard remote access

These are the routers we recommend for this setup. Pair any of them with a static IP plan so remote users can always reach it.

Peplink MAX BR1 Pro 5GSingle 5G modem, rugged, great for vehicles and small sitesShop nowPeplink MAX BR2 Pro 5GDual 5G modems for bonding and failover (the router in this guide)Shop nowPeplink B One 5GCompact 5G router for home offices and small businessShop now

Browse all routers or add a static IP to your plan.

Need help?

If you'd like us to set up Peplink remote access for you, or you need a static IP so it works over cellular, contact our team.