If Balance/MAX unit is placed behind a firewall, you would need to define the firewall rules and inbound port forwarding policy on firewall unit for the following port numbers in order to allow SpeedFusion traffic passing across the firewall.
SpeedFusion uses TCP port 32015 and UDP port 4500 for establishing the connections by default.
Note on Data Port:
This is the outgoing UDP port number for transporting VPN data.
By default, UDP port 4500 will be used. Port 32015 will be used if the remote unit uses Firmware prior to version 5.4 or if port 4500 is unavailable.
You can use a custom port number if the [Custom] option is selected, an outgoing port number range from 1 to 65535.
Also, if you have configured and active [IPsec VPN] or [L2TP with IPsec] profile on the Peplink router, then UDP port 4500 will be occupied and SpeedFusion will use next available port (UDP 32015).
When using multiple tunnels between 2 locations (when using Outbound policies within a PepVPN or SpeedFusion tunnel ) multiple ports are in use (1 for each-subprofile).
The UDP data ports used when using are:
4500, 4501, 4502, etcetera or (when port 4500 is in use by IPSEC or L2TP) 32015, 32016, 32017, etcetera.
Customer wants to put Balance on a private NATted address behind a firewall. The WAN IP applied to the Balance 380 will be on the network that the remote Peplink device (HD2) will need to communicate with.
Standard config:
Balance 380 WAN – Public IP
Balance 380 LAN – Private IP on LAN advertised across PepVPN
Customer request:
Balance 380 WAN – Private IP on LAN that needs to be advertised across PepVPN
Balance 380 LAN – no connection
HI,
Thanks for this article. The PepVPN data port selection sounds clear.
Use UDP4500 if there is one PepVPN.
If UDP4500 cannot connect, use TCP32015.
We have a firewall between to Peplinks with only UDP4500 allowed between them.
If UDP4500 is the data channel, what ports/protocols are used for the initial setup of the PepVPN?
When performing a capture we do not see any UDP packets at all from our Peplink to the IP addresses specified in the PepVPN profile. Am I correct that there are other ports/protocols than UDP4500 used at the “Starting…” phase ?
My problem is that even though the peplink vpn is effectively established (green box) between the two peplinks, when I perform a windows tracert to 10.20.30.40 it seems that for some reason the traffic path is being routed through the LAN port 192.168.1.200 and never works; this port does not have anything plugged into it.
Our firewall if performing the NAT.
I have enabled OSPF on WAN 1 in peplink 380.
Could someone please point/guide me to the right direction?
Thank you for your reply. From 10.20.30.x I am now able to ping and access shares on a server on 192.168.1.x; however I cannot ping back the same IPs, that is, from the same server on the 192.168.1.x I cannot ping 10.20.30.x. I have made sure the routing table is correct. On the server I have also created a windows static route 10.20.30.x mask 255.255.255.0 192.168.1.30; tracert 10.20.30.x also shows me that the next hop is 192.168.1.30 and stop there.
Yes because the 192.168.1.30 WAN on the B380 is set to NAT mode. You want it to be set to IP Forwarding with the 'Apply NAT on Remote PepVPN Peers" option unchecked.
.
