Table of Contents
Peplink dropped Firmware 8.6.0 Beta 2 on May 7, 2026, and this is one of the most consequential beta releases we have seen in a while. It is not just a maintenance bump. Beta 2 layers two major new features on top of an already aggressive Beta 1, brings 5G Standalone (SA) to a wide range of cellular modules, and rolls in well over a hundred fixes and improvements. If you run a fleet of Peplink gear and need to plan rollouts, this one deserves a careful read.
We carry the full Peplink lineup at 5Gstore, so customers regularly ask us what is worth waiting for in a beta and what is safe to test now. Below is our take on what changed, who should care, and where the risk sits.
What Beta 2 Adds on Top of Beta 1
Beta 2 introduces two genuinely new capabilities, plus a meaningful expansion of cellular SA support. Everything else in this release was carried forward from 8.6.0 Beta 1.
OneWeb WAN Integration
Peplink added native OneWeb integration as a WAN type across all supported models. This matters for two reasons. First, OneWeb is now a serious second source of low earth orbit (LEO) satellite connectivity alongside Starlink, and being able to mix the two on a single Peplink router via SpeedFusion is a game-changer for mobile, maritime, and remote-site deployments. Second, native integration typically means health checks, signal data, and provisioning information get exposed in the Peplink Web UI and InControl rather than being treated as a generic Ethernet WAN. We are still digging into exactly which OneWeb terminal interfaces are supported, but the foundation is now in firmware.
WireGuard Remote User Access
Peplink added WireGuard as a Remote User Access VPN option across all models. This is significant. Until now, remote access on Peplink was largely L2TP/IPsec, OpenVPN, or SpeedFusion VPN. WireGuard is faster, simpler to configure, and uses modern cryptography by default. For organizations that have standardized on WireGuard for client VPN, this removes a major gap and means a single Balance or MAX router can replace a separate WireGuard server.
5G Standalone (SA) Support
Beta 2 enables 5G SA on devices with 5GD cellular modules. SA mode connects directly to a 5G core network instead of anchoring on LTE, which unlocks lower latency, better network slicing support, and the kind of performance carriers have been promising since 5G launched. This applies to a long list of cellular Peplink models including the Balance 20X, 310 5G, 310X, 380X, 580X, the entire BR and Transit lines, B One 5G/Plus, UBR Plus, MBX, MBX Mini, PDX, SDX, SDX Pro, and EPX. Framed routing support was also added for 5GK and 5GN modules in this beta.
Cellular MTU Auto-Adjust
A small but practical change: Cellular WAN now automatically applies the network-provided MTU value when it is lower than what the admin configured in the Web UI. This eliminates a class of fragmentation and PMTUD issues that have plagued certain carrier APNs.
Wi-Fi 6 AP Management on Synergized Devices
Synergy mode users can now manage Wi-Fi APs on supported Synergized devices through the AP Controller. This applies to BR1/2 Pro, the Transit series, Dome series, and B One series acting as Synergized devices, with Balance, BR, B One, MediaFast, UBR Plus, SDX, SDX Pro, PDX, and EPX as Synergy Controllers.
What Carried Forward From Beta 1
Beta 1 was already a heavy release. The headliners that are still in 8.6.0 include:
SpeedFusion Boost improves application performance over SpeedFusion connections using Starlink, 5G, and other suitable WAN links. If you bond a Starlink with cellular today and notice variable per-application performance, this is the feature to test.
RADIUS over TLS (RadSec) for Wi-Fi APs lets enterprise environments encrypt RADIUS authentication traffic instead of relying on the legacy shared-secret model. Supported on Balance 20X, Balance 310 Fiber 5G, the BR series (excluding Mini 5G/Core, Micro), all Transit, all Dome, all B One, UBR Plus, MBX, and PDX.
Per-WAN bandwidth limiting lets each WAN interface be rate-limited independently. Useful for preventing a metered cellular SIM from going over its cap, or for keeping a backup link from saturating during failover.
Token-based Device API for uploading and downloading configuration files. For anyone building automation around Peplink (we get a lot of these requests at JAMD Technologies), this is overdue and removes a significant friction point.
Up to 1000 SpeedFusion peers on B1350 EC is a notable scale increase for hub-and-spoke deployments using the Balance 1350 EC as a head end.
Edge Compute on B One Series when PrimeCare is active. The B One platform gets meaningfully more capable with this addition, since you can now run containerized workloads on the same device handling routing.
Permanent FIPS support is now enabled on eligible devices, which matters for federal, defense, and regulated-industry deployments. Excluded models include Balance 20X, the entire B One Series, BR1 Mini Series, and any device with SKU codes containing 5GN, LTE-E, LTE-EU, LTE-EJ, LTE-MX, LTE-MXS, LTE-US, or LTEA-D.
Stronger certificate requirements have been adopted as part of updated security standards. DSA keys, small RSA keys, and legacy PKCS#12 files are no longer supported. If a device detects an outdated certificate, it falls back to the secure default certificate automatically. Plan to audit your Certificate Manager before upgrading production devices.
Resolved Issues Worth Highlighting
Beta 2 specifically fixes several issues that have generated support tickets:
- Cellular WAN DHCP lease renewal could fail intermittently (across the cellular product line)
- Cellular WAN might not reconnect after switching to the next manually selected carrier (LTE / LTEA modules)
- DHCP relay might not forward requests to all configured DHCP servers
- IP passthrough could stop working after enabling Layer 2 SpeedFusion VPN
- Starlink WAN status could disappear after the Data Pool limit was reached
- USB mobile WAN might not work on USB 3.0 ports on the Balance 1350 EC
The Beta 1 fix list is even longer and includes important stability fixes for BR2 devices under sustained packet flooding, B580X HW2 unexpected reboots, captive portal failures, RemoteSIM dropouts after cellular reconnect, eSIM failover when cloud access is unavailable, and DNS resolution issues over SpeedFusion after WAN restoration.
End-of-Life: What 8.6.0 Drops
Starting with Firmware 8.6.0, several legacy models are no longer supported. They will continue to receive 8.5.x maintenance releases as needed, but if you are running any of these in production, this is your signal to start a refresh plan:
- Balance: 30 LTE HW3, 30 Pro HW1, 210 HW4-5, 310 HW4, One HW1-3, One Core HW1
- MAX: 700 HW3-4, BR1 ENT HW1-2, HD1 Dome HW1, HD2 HW5-6, HD2 Dome HW1, HD2 IP67 HW2-5, HD2 Mini HW1-4, HD2 with MediaFast HW1-4, HD4 HW1-5, HD4 IP67 HW1, HD4 with MediaFast HW1-4, Transit HW1-3, Transit 5G HW2-3, Transit Core HW1, Transit Duo HW1-3, Transit Duo Pro E HW1, Transit Pro E HW1
- MediaFast: 200 HW1, 3
- SpeedFusion Engine: SFE CAM HW1
If you are on any of these and want help planning the migration, we can map old SKUs to current equivalents.
Known Issues Still Open
Peplink lists four known issues in this beta:
- LAN clients on ports 1 or 2 may fail to obtain an IP with Multiple IP passthrough WAN support (all models)
- Docker containers cannot run on a device without an active DHCP server (Edge Compute models)
- YouTube blocking may not work if YouTube traffic uses QUIC (all models)
- High Availability “Resume Master Role Upon Recovery” may not work as expected (all models except FusionHub)
5Gstore Take
Beta 2 is unusually feature-dense, and most of what shipped is the kind of thing customers have been asking us about for months. OneWeb support and WireGuard remote access are the two we expect the most demand for, and 5G SA on 5GD modules will quietly improve performance for a lot of existing fleet deployments without requiring any hardware change.
That said: this is a beta. We do not recommend deploying 8.6.0 Beta 2 on production routers carrying mission-critical traffic, especially given the open known issues around HA resume behavior and the new certificate requirements that may surprise you if your config still has older keys. Lab it. Test your specific WAN mix. Validate any custom outbound policies and SpeedFusion profiles. Then plan a staged rollout once 8.6.0 reaches General Availability.
If you want help testing this firmware against your specific deployment or want guidance on which model fits a new project, contact us and we will work through it with you.
FAQ
When will Peplink Firmware 8.6.0 reach General Availability?
Peplink has not announced a GA date for 8.6.0. Beta 2 was released May 7, 2026. Historically Peplink runs two to four beta cycles before GA, depending on issue counts. We will update this post when GA lands.
Can I run 8.6.0 Beta 2 on a production router?
We do not recommend it. Betas can contain regressions, and 8.6.0 specifically introduces stricter certificate requirements that could leave your device falling back to the secure default certificate if any of your existing certs are outdated. Test in a lab first.
My Balance 210 HW5 is on the EOL list. What do I do?
It will keep receiving 8.5.x maintenance updates, but no new features. Plan a refresh. The closest current equivalent depends on your throughput and WAN count. Our team can map your existing config to a current model. Reach out via the contact page.
Does the WireGuard support replace SpeedFusion VPN?
No. WireGuard is for client-to-router remote user access, like a road warrior connecting their laptop to the corporate network. SpeedFusion is for site-to-site bonded VPN tunnels and remains the recommended option for branch connectivity, mobile platforms, and any use case needing bonded multi-WAN.
Will OneWeb integration work with any OneWeb terminal?
The release notes confirm OneWeb integration was added as a WAN type for all models, but specific terminal compatibility details have not been published yet. We will update this post as Peplink and OneWeb publish a compatibility matrix.
What is 5G Standalone (SA) and why does it matter?
SA mode connects directly to a 5G core network instead of anchoring on a 4G/LTE control plane (Non-Standalone, or NSA). SA generally delivers lower latency, supports network slicing, and unlocks more of the performance carriers advertise for 5G. Whether you actually see SA on your SIM depends on your carrier and your geography.
Does 8.6.0 affect my BR1 Pro 5G?
Yes. The BR1 Pro 5G is in the supported device list and benefits from many of the cellular improvements, the WireGuard remote access feature, and OneWeb integration. It is not on the EOL list.
Where do I download Beta 2?
Peplink betas are typically distributed through the Peplink forum. Sign in with your Peplink ID, find the 8.6.0 Beta 2 thread, and download from there.
