Peplink FusionHub HW1 Router Firmware 8.5.3

Improvements:

- [RC 1] [Remote User Access] Added DHCP reservation support based on Remote User Access usernames
- [RC 1] [BGP] Added support for BGP over route-based IPsec
- [Beta 2] [RADIUS] Added support for a secondary RADIUS server for Web Admin authentication fallback
- [Beta 1] [CLI] Added CLI command to display masked SIM PIN
- [Beta 1] [System] Added event log entry for approximate power-off time
- [Beta 1] [IPsec] Added support for DH Group 16 in IPsec Phase 1 and Phase 2 settings
- [Beta 1] [System] Added support for multiple NTP servers (Included in: 8.5.2s100)
- [Beta 1] [DPI] Added support for new protocols in the DPI engine, including Sonos, DingTalk, Paltalk, DICOM, LagoFast, GearUP Booster, Lustre, OpenWire, FLUTE, Ripe Atlas, ZUG, PFCP, LOL: Wild Rift, and Elder Scrolls Online
- [Beta 1] [DPI] Added support for new web protocols in the DPI engine, including NordVPN, Surfshark, CactusVPN, Windscribe, Naver, Shein, Temu, Taobao, Paramount Plus, Yandex Alice, Vivox, Rutube, Mozilla, Generative AI, and Cybersecurity
- [Beta 1] [SNMP] Added support for standard SNMP linkUp and linkDown traps (Included in: 8.5.2s122, 8.5.2s117)
- [Beta 1] [System] Updated client probing method from ICMP to ARP
- [Beta 1] [IPsec] Updated IPsec to allow customization of Dead Peer Detection settings
- [Beta 1] [SNMP] Updated SNMP to display full 36-bit Cell ID for LTE and 5G and deprecated outdated 3G-only identifiers
Compatible with All Models

- [Beta 1] [Starlink] Added “GPS Receiver” and “GPS Forwarding” when Starlink WAN is enabled
- [Beta 1] [HA] Added event log for HA sync failure when the configuration is not fetched from the master device
Compatible with All Models (Except FusionHub)

- [RC 2] [PrimeCare] Added a Web UI option to refresh Care Plan license information manually
Compatible with Device product code with the suffix "-PRM"

- [RC 2] [5000 EC] Added dual power supply status and system temperature display on Balance 5000 EC
Compatible with Balance: 5000 EC

- [RC 2] [Switch Controller] Added option in Switch Controller to preserve existing Port and VLAN settings when switches come online
- [Beta 1] [AP Controller] Added support for keyword and AP name filtering in event log search
- [Beta 1] [Switch Controller] Added support for Switch Controllers to report managed switch status and forward their reports to InControl
Compatible with Balance: All
Compatible with MAX: BR1 Pro 5G/HW7, BR2, BR2 Pro, 700, HD2/4, HD2 Mini, Transit, HD2/4 MBX, MBX Mini
Compatible with MediaFast: All
Compatible with UBR: Plus
Compatible with B One: B One, B One 5G/Plus
Compatible with PDX, SDX, SDX Pro, EPX

- [RC 2] [eSIM] Enhanced the Cellular state to remain in “No Peplink eSIM Subscription” when it is the only enabled SIM slot and the subscription status is unknown
- [Beta 1] [eSIM] Added specific prompt to enter confirmation code when missing during eSIM download
Compatible with Balance: 20X HW3, 310X HW3, 310 5G, 380X, 580X
Compatible with MAX: BR1 Mini/Mini Core HW3/Mini M2M, BR1 Pro 5G, BR1 Pro HW7, BR2 Pro, Transit Duo Pro/Pro E, HD2/4 MBX HW4, HD1 Dome Pro, HD2 Dome Pro E/LR, MBX Mini
Compatible with B One: B One Plus/5G
Compatible with UBR: Plus
Compatible with EPX, SDX Pro, SDX

- [RC 2] [2500 EC] SpeedFusion throughput updated to reflect actual performance
Compatible with Balance: 2500 EC

- [RC 1] [B One] Added IPv6 passthrough feature support for B One series (Included in: 8.5.2s133)
Compatible with B One: B One, B One Plus/5G

- [RC 1] [USB] Added support for Fujisoft FS040W USB modem
Compatible with Balance: All
Compatible with MAX: BR1 ENT, BR2 Pro HW4, HD2/4 Indoor Series, HD2/4 MBX, MBX Mini
Compatible with MediaFast: All
Compatible with SDX, SDX Pro

- [Beta 2] [Docker] Added Docker support for --device /dev/net/tun to enable tunneling inside containers
Compatible with Balance: 310 5G/Fiber 5G, 310X, 380X, 580X, 710, 1350, 2500, 2500 EC, 5000 EC
Compatible with MAX: BR2 Pro, Transit Duo Pro, Transit Duo Pro E, MBX Mini, HD2/4 MBX
Compatible with MediaFast: 500, 750 PDX, SDX, SDX Pro, EPX (with EXM-LCDT)

- [Beta 1] [LAN PVID] Added PVID support in LAN Port Settings
Compatible with Balance: 20X, 310X, 380X, 580X, 310 5G/Fiber 5G, 305, 380, 580, 710 1350, 2500, 1350/2500/5000 EC
Compatible with MAX: MAX: BR1 Mini/Mini 5G/Core/M2M, BR2, HD2/4 MBX
Compatible with MediaFast: 500, 750
Compatible with UBR: Plus
Compatible with PDX, SDX, SDX Pro, EPX

- [Beta 1] [GPS] Added GPS source priority configuration and active source display on the dashboard
Compatible with Balance: 20X, 310X
Compatible with MAX: BR1/2, HD1/2/4, Transit, HD2/4 MBX, MBX Mini, HD2/4 with MFA
Compatible with UBR: Plus
Compatible with PDX, SDX, SDX Pro, EPX

- [Beta 1] [Cellular] Added IPv4-only PDP type enforcement for private SIM profiles (Included in: 8.5.2s058, 8.5.1s077, 8.5.1s044)
- [Beta 1] [Cellular & GLTE-S] Added SMS Control support for GLTE-S cellular devices (Included in: 8.5.2s073) (Device with Cellular and product code contains GLTE-S)
- [Beta 1] [Cellular & LTE-SB] Added support for LTE-SB cellular module firmware upgrade via Web UI (Device with Cellular and product code contains LTE-SB)
- [Beta 1] [Cellular & 5GN] Added support for site surveys that scan nearby cellular towers using InControl’s Connection Test feature (Device with Cellular and product code contains 5GN)
- [Beta 1] [Cellular] Improved Web UI and API to correctly display and handle Cell ID for 5G networks
- [Beta 1] [Cellular] Increased SMS content length limit
Compatible with Balance: 20X, 30 LTE/Pro, 310 5G/Fiber 5G, 310X, 380X, 580X
Compatible with MAX: BR1/2, HD1/2/4, Transit, HD2/4 MBX, MBX Mini
Compatible with B One: B One 5G/Plus
Compatible with MediaFast: HD2/4
Compatible with UBR: Plus
Compatible with PDX, SDX, SDX Pro, EPX

- [Beta 1] [802.1X] Added support for a second RADIUS server for wired 802.1X authentication
Compatible with Balance: 310X, 380X, 580X, 310 5G/Fiber 5G, 305/380 or above
Compatible with MAX: Transit Duo Pro, BR1/2 Pro, HD2/4 MBX
Compatible with MediaFast: 500, 750
Compatible with PDX, SDX, SDX Pro, EPX

- [Beta 1] [Virtual WAN on VLAN] Added support for Virtual WAN on VLAN in OSPF/RIPv2 settings
Compatible with Balance: All
Compatible with MAX: All
Compatible with MediaFast: All
Compatible with UBR Plus, SFE Cam
Compatible with PDX, SDX, SDX Pro, EPX

- [Beta 1] [Wi-Fi WAN] Improved Wi-Fi WAN roaming for static IP setups to avoid unnecessary disconnection events (Included in: 8.5.0s102)
Compatible with Balance: 20X, 310 Fiber 5G
Compatible with MAX: All (Exclude: BR1 ENT, BR1 Mini 5G/Core, BR2 Micro, Transit Core, HD2 Mini, HD1/2 Dome/IP67)
Compatible with B One: B One, B One 5G/Plus
Compatible with UBR: Plus
Compatible with MediaFast: HD2/4
Compatible with PDX, MBX

- [Beta 1] [B One Plus HW2] Increased remote user access limit to 15 for PPTP, L2TP, and OpenVPN on BOne Plus HW2
Compatible with B One Plus HW2

- [Beta 1] LTE-E and LTE-US cellular firmware upgrade now supported on additional models
- [Beta 1] Upgraded Web Content Blocking to include full category support on specific models
Compatible with MAX: HD1/2 Dome Pro series, Transit Duo Pro, BR1/2 Pro

- [Beta 1] [Edge Computing] Updated the default storage partition layout to exclude MediaFast and ContentHub partitions; users can add them manually if needed
Compatible with Balance: 1350 EC, 2500 EC, 5000 EC
Compatible with MAX: BR1 Pro HW3, BR2 Pro HW4, Transit Duo Pro, Transit Duo Pro E, HD2/4 MBX with Edge Computing
Compatible with MediaFast: 500, 750
Compatible with SDX Pro, EPX (with EXM-LCDT)

Resolved Issues:

- [RC 2] [System] Fixed an issue where changing IP Passthrough to VLAN may fail in the Web UI
- [RC 2] [System] Fixed an issue where InControl might not be able to apply configuration to devices
- [RC 1] [Remote User Access] Fixed an issue where dropped OpenVPN connections during setup could leave Remote User Access DHCP leases permanently assigned (Fixed in: 8.5.2s063)
- [RC 1] [System] Updated the expiration date of the default CA certificates for Web Proxy, ContentHub, and OpenVPN of Remote User Access
- [Beta 2] [LAN] Fixed an issue that prevented the DNS Proxy from resolving hostnames when one of multiple configured DNS resolvers was unreachable
- [Beta 2] [WAN] Fixed the issue of GRE WAN not working in 8.5.3 Beta 1
- [Beta 2] [WAN] Fixed the issue of Management IP access not working on DHCP WAN in 8.5.3 Beta 1
- [Beta 1] [CLI] Fixed CLI issue where cellular operator settings could not be retrieved
- [Beta 1] [LAN] Fixed issue where DHCP relay remained active after being disabled
- [Beta 1] [LAN] Fixed issue where incorrect system time caused abnormal DHCP lease durations (Fixed in: 8.5.2s038)
- [Beta 1] [DPI] Fixed issue where WhatsApp messages were not fully blocked by Application Blocking
- [Beta 1] [SNMP] Fixed missing interface table entries in the public SNMP MIB on FusionHub (Fixed in: 8.5.2s013)
- [Beta 1] [System] Fixed rare issue that prevented device from communicating with InControl
- [Beta 1] [System] Fixed the CVE-2025-26466 vulnerability
- [Beta 1] [LAN] Fixed the issue where LAN static routes might not work briefly during Apply Changes (Fixed in: 8.5.2s021)
Compatible with All Model

- [Beta 2] [Outbound Policy] Fixed an issue where Least Used outbound policy misrouted traffic when selected WANs exceeded their bandwidth setting
- [Beta 1] [Captive Portal] Fixed a stability issue in Captive Portal
- [Beta 1] [Bonjour Forwarding] Fixed Bonjour forwarding failure when device has more than 32 VLAN interfaces (Fixed in: 8.5.2s115)
- [Beta 1] [Outbound Policy] Fixed intermittent Outbound Policy routing failures causing random packet loss through SpeedFusion tunnels (Fixed in: 8.5.2s123, 8.5.2s116, 8.5.2s109)
- [Beta 1] [DNS Proxy] Fixed the issue where LAN DNS Proxy might stop working when using DoH (Fixed in: 8.5.2s049)
Compatible with All Models (Except MediaFast, PDX)

- [Beta 1] [FusionSIM Agent] Fixed memory usage increasing over time on FusionSIM Farm devices when proxying to SIM Injectors (Fixed in: 8.5.2s091)
- [Beta 1] [FusionSIM Agent] Fixed SIM retrieval failure over SpeedFusion when using FusionSIM Agent WAN IP
Compatible with All Models (Except FusionHub))

- [RC 2] [Cellular] Fixed "Bandwidth Allowance Monitor" allowing both “Disconnect” and “Reserve for management traffic” to be enabled simultaneously.
- [RC 1] [Cellular & 5GD] Fixed the issue where the 5GD cellular device could not work on Optus networks (Device with Cellular and product code contains 5GD)
- [Beta 1] [Cellular & 5GD] Fixed 5GD cellular device occasionally unable to connect to the network (Fixed in: 8.5.2s086, 8.5.2s072, 8.5.2s065) (Device with Cellular and product code contains 5GD)
- [Beta 1] [Cellular] Fixed an issue where active eSIM profiles could not be removed on 5GD and 5GN cellular devices
- [Beta 1] [Cellular] Fixed an issue where incorrect APN was used on some global roaming SIMs
- [Beta 1] [Cellular & 5GN] Fixed cellular firmware upgrade issue that might not work on 5GN cellular devices (Device with Cellular and product code contains 5GN)
- [Beta 1] [Cellular] Fixed failure to retry highest priority custom PLMN during carrier selection (Fixed in: 8.5.2s047)
- [Beta 1] [Cellular] Fixed issue where device did not stay connected on SIM restricted to management traffic (Fixed in: 8.5.2s046)
- [Beta 1] [Cellular & LTEA-B] Fixed LTEA-B cellular device not reconnecting to the network after APN change (Fixed in: 8.5.2s113) (Device with Cellular and product code contains LTEA-B)
- [Beta 1] [Cellular & LTEA-B] Fixed LTEA-B cellular device remaining in reset state (Fixed in: 8.5.2s089) (Device with Cellular and product code contains LTEA-B)
Compatible with Balance: 20X, 30 LTE/Pro, 310 5G/Fiber 5G, 310X, 380X, 580X
Compatible with MAX: BR1/2, HD1/2/4, Transit, HD2/4 MBX, MBX Mini
Compatible with B One: B One 5G/Plus
Compatible with MediaFast: HD2/4
Compatible with UBR: Plus
Compatible with PDX, SDX, SDX Pro, EPX

- [RC 2] [B One] Fixed Bluetooth not being disabled after initial setup when it was never used
Compatible with B One: B One, B One Plus/5G

- [RC 2] [Wi-Fi] Fixed a Wi-Fi stability issue (Fixed in: 8.5.3 s002)
Compatible with Balance: 20X, 30 Pro, One, 310 Fiber 5G
Compatible with MAX: All (Exclude: BR1 ENT, BR1 Mini 5G/Core, BR2 Micro, Transit Core, HD2 Mini, HD1/2 Dome/IP67)
Compatible with B One: B One, B One 5G/Plus
Compatible with MediaFast: 200, HD2/4
Compatible with PDX

- [Beta 1] [Wi-Fi AP] Fixed RADIUS Accounting being disabled for InControl-managed SSIDs (Fixed in: 8.5.2s088)
Compatible with Balance: 20X, 30 Pro, One, 310 Fiber 5G
Compatible with MAX: All (Exclude: BR1 ENT, BR1 Mini 5G/Core, BR2 Micro, Transit Core, HD2 Mini, HD1/2 Dome/IP67)
Compatible with B One: B One, B One 5G/Plus
Compatible with UBR: Plus
Compatible with MediaFast: 200, HD2/4
Compatible with PDX

- [RC 2] [Wi-Fi WAN] Fixed missing Wi-Fi WAN Quality reporting to InControl when roaming was enabled (Fixed in: 8.5.0s110)
- [Beta 2] [Wi-Fi WAN] Fixed an issue where Wi-Fi WAN could not reconnect after repeated disable and enable actions (Fixed in: 8.5.0s109)
- [Beta 1] [Wi-Fi WAN] Fixed the issue where Wi-Fi WAN might not be able to connect to some access points (Fixed in: 8.5.2s033, 8.5.2s032)
Balance: 20X, 310 Fiber 5G
- [Beta 1] [Wi-Fi WAN] Fixed Wi-Fi WAN might not work when roaming option is enabled
Compatible with Balance: 20X, 310 Fiber 5G
Compatible with MAX: All (Exclude: BR1 ENT, BR1 Mini 5G/Core, BR2 Micro, Transit Core, HD2 Mini, HD1/2 Dome/IP67)
Compatible with B One: B One, B One 5G/Plus
Compatible with UBR: Plus
Compatible with MediaFast: HD2/4
Compatible with PDX, MBX

- [RC 1] [FusionHub] OSPF page may keep loading and not display OSPF Area and RIPv2 sections on FusionHub 8.5.3b02
- [Beta 1] [FusionHub] Fixed issue where OpenVPN clients could not access web admin on FusionHub (Fixed in: 8.5.2s085)
Compatible with FusionHub

- [Beta 2] [Wi-Fi WAN] Fixed a stability issue that occurred when 2.4GHz Wi-Fi WAN was enabled (Fixed in: 8.5.2s056)
Compatible with MAX: HD1/2 Dome Pro series, Transit Duo Pro, BR1/2 Pro

- [Beta 2] [Switch Controller] Added support for selecting “Untagged LAN” in VLAN Trunk custom settings for Switch ports
- [Beta 1] [Switch Controller] Fixed an issue where VLANs for Virtual WAN on LAN were not included in the managed switch configuration (Fixed in: 8.5.2s076)
- [Beta 1] [AP Controller] Fixed repeated config sync and apply logs when InControl-managed SSIDs were used with AP Controller (Fixed in: 8.5.2s104)
Compatible with Balance: All
Compatible with MAX: BR1 Pro 5G/HW7, BR2, BR2 Pro, 700, HD2/4, HD2 Mini, Transit, HD2/4 MBX, MBX Mini
Compatible with MediaFast: All
Compatible with UBR: Plus
Compatible with B One: B One, B One 5G/Plus
Compatible with PDX, SDX, SDX Pro, EPX

- [Beta 1] [GPS] Fixed an issue where enabling the “forward GPS data with GPIO status” option did not update the forwarded GPS message
Compatible with Balance: 20X, 310X
Compatible with MAX: BR1/2, HD1/2/4, Transit, HD2/4 MBX, MBX Mini, HD2/4 with MFA
Compatible with UBR: Plus
Compatible with PDX, SDX, SDX Pro, EPX

- [Beta 1] [MBX Mini HW2] Fixed an issue where PoE stopped working after factory reset on MBX Mini HW2 (Fixed in: 8.5.2s075)
Compatible with MBX Mini HW2

- [Beta 1] [RemoteSIM] Fixed an issue where RemoteSIM firmware appeared invalid after a successful upgrade
Compatible with Balance: 20X, 310X, 380X, 580X, 310 5G/Fiber 5G
Compatible with MAX: BR1 Pro, Transit Core/Pro, HD2 Mini, HD1/2 Dome/Dome Pro, HD2/4 MBX
Compatible with UBR: Plus
Compatible with PDX

- [Beta 1] [FusionSIM] Fixed FusionSIM connection failure when Auto LAN Discovery was disabled (Fixed in: 8.5.2s113)
- [Beta 1] [FusionSIM] Fixed FusionSIM issue caused by uptime overflow (Fixed in: 8.5.2s105)
Compatible with Balance: 310 5G, 20X, 310X, 380X, 580X
Compatible with MAX: BR1 Pro, Transit Core/Pro, HD2 Mini, HD1/2 Dome/Dome Pro, HD2/4 MBX
Compatible with UBR: Plus
Compatible with PDX

- [Beta 1] [Synergy Mode] Fixed an issue where Synergy WAN interfaces could be dropped after applying configuration from InControl
- [Beta 1] [Synergy Mode] Fixed issue where SIM Card B was not detected on Synergy Cellular WANs
- [Beta 1] [Synergy Mode] Fixed the issue where a synergized device might appear offline in InControl after losing connection with the controller
Compatible with Synergized Device: Balance, MAX, MediaFast, UBR: All, PDX
Compatible with Synergy Controller: Balance: 20X, 30 LTE/Pro, One/Two, 210/310 HW4 or above, 310 5G/Fiber 5G, 310X, 380X, 580X / MAX: BR1 Mini HW3, BR1 ENT, BR1 Pro 5G, BR1 Pro HW7, BR2 Pro HW4, Transit, 700 HW3 or above, HD1 Dome/Dome Pro, HD2 Dome, HD2 HW5 or above, HD2 Mini, HD4 / B One: B One, B One 5G/Plus / MediaFast: All / UBR: Plus / SDX, SDX Pro, PDX, EPX

- [Beta 1] [BR1 Mini 5G] Fixed an issue where the BR1 Mini 5G failed to detect the cellular module after a software reset
Compatible with BR1 Mini 5G

- [Beta 1] [SDX] Fixed IGMP packets being dropped on SDX LAN ports (Fixed in: 8.5.2s059)
Compatible with SDX, SDX Pro

- [Beta 1] [EPX] Fixed issue where Starlink GPS status was not applied on EPX without cellular modules (Fixed in: 8.5.2s070)
Compatible with EPX

- [Beta 1] [Balance One] Fixed LAN ports not forwarding traffic when LAN1–3 were assigned as WAN ports
Compatible with Balance: One

- [Beta 1] Fixed missing LTEA-B cellular device firmware upgrade support on certain devices (Fixed in: 8.5.2s101)
Compatible with Balance: 30 LTE, 30 Pro, 210/310 HW4, One, One Core
Compatible with MAX: 700, BR1 ENT, HD1 Dome, HD2/Dome/IP67/Mini, HD4/IP67, Transit/Duo/Duo Pro E/5G/Core
Compatible with MediaFast: 200, HD2, HD4
Compatible with SFE: SFE Cam

- [Beta 1] [SpeedFusion] Fixed SpeedFusion profiles not loading on HA devices after reboot when no WAN connection is available (Fixed in: 8.5.1s119)
Compatible with Balance: 210 or above
Compatible with MAX: 700, HD2/4, Transit
Compatible with UBR: UBR LTE
Compatible with MediaFast: All
Compatible with SFE
Compatible with X Series: All (Except 20X)
Compatible with FusionHub
Compatible with Device with PrimeCare license

- [Beta 1] Fixed system stability issue on B20X and UBR Plus (Fixed in: 8.5.2s051, 8.5.2s026)
Compatible with Balance: 20X
Compatible with UBR: Plus

- [Beta 1] [FlexModule Mini] Fixed the issue where LTEA-B Cellular FlexModule Mini could not be detected (Fixed in: 8.5.2s035)
Compatible with Balance: 20X, 380X, 580X

Known Issues:

- [Switch Controller] Configured “External Access” to VLAN may cause the SD Switch device to go offline after syncing with the Switch Controller
- [Switch Controller] Changing the port PVID may not apply properly
Affected Balance: All
Affected MAX: BR1 Pro 5G/HW7, BR2, BR2 Pro, 700, HD2/4, HD2 Mini, Transit, HD2/4 MBX, MBX Mini
Affected MediaFast: All
Affected UBR: Plus
Affected B One: B One, B One 5G/Plus
Affected PDX, SDX, SDX Pro, EPX

- [System] LAN clients in ports 1 or 2 may fail to obtain an IP with Multiple IP passthrough WAN support
- [System] YouTube blocking may not work if YouTube traffic is using QUIC
Affected All Models

- [Docker] Docker container cannot be run on a device that doesn't have an active DHCP server running
Affected Balance: 310 5G/Fiber 5G, 310X, 380X, 580X, 710, 1350, 2500, 2500 EC
Affected MAX: BR2 Pro, Transit Pro E/Duo Pro/Duo Pro E, MBX Mini, HD2/4 MBX
Affected MediaFast: 500, 750 PDX, SDX, SDX Pro, EPX (with EXM-LCDT)

About Router Firmware:

Before you consider downloading this firmware, go to the system information page of the router and make sure that the currently installed version isn't either newer or matching this release.

Due to the large variety of router models and different methods for upgrading the device, it is highly recommended that you read and, above all, understand the installation steps before you apply the new firmware, even if you are a power user.

In theory, these steps shouldn't be much of a hassle for anyone, because manufacturers try to make them as easy as possible, even if they don't always succeed. Basically, you must upload the new firmware to the router through its administration page and allow it to upgrade.

If you install a new version, you can expect increased security levels, different vulnerability issues to be resolved, improved overall performance and transfer speeds, enhanced compatibility with other devices, added support for newly developed technologies, as well as several other changes.

If you're looking for certain safety measures, remember that it would be best if you perform the upload using an Ethernet cable rather than a wireless connection, which can be interrupted easily. Also, make sure you don't power off the router or use its buttons during the installation, if you wish avoid any malfunctions.

If this firmware meets your current needs, get the desired version and apply it to your router unit; if not, check with our website as often as possible so that you don't miss the update that will improve your device.