Short answer
Users and apps connect to Cloudflare whatever router sits on site. A site tunnel from Peplink to Cloudflare is designed and tested per site.
In detail: Does Peplink connect to Cloudflare?
How traffic reaches Cloudflare:
- Users: the Cloudflare One Client on laptops and phones sends traffic to Cloudflare, behind any router and on any network
- Private apps: Cloudflare Tunnel publishes apps through an outbound-only connection from your server or cloud, with no open inbound ports
- Whole sites: a Peplink router can send site traffic to Cloudflare over an IPsec tunnel, which also protects printers, cameras and other devices that cannot run an app
The site tunnel is validated for each design before go-live. Where Peplink SpeedFusion bonding is used for hot failover, FirstNet designs how bonded traffic then reaches Cloudflare, so both work together.
Peplink is the SD-WAN edge with basic firewalling, not a full next-generation firewall: firewall policy runs in Cloudflare, or on a Fortinet or Sophos firewall in the Advanced package.