Published 12 May 2026
Maritime connectivity sits in a category of its own. On land, if a circuit drops, you pick up a phone and shout at your ISP. At sea, 40 nautical miles from the nearest coast, your options are considerably more limited. The vessel still needs chart updates, weather data, engine telemetry and position reports. The crew still wants to video-call home. And the operations team ashore still expects real-time visibility of where the vessel is, what it is carrying, and whether the refrigeration units are running at the correct temperature.
This article covers how we approach maritime network design using Peplink hardware and SpeedFusion bonding. It is not a product brochure. It is a practical breakdown of the problems you hit at sea and how we solve them across a range of vessel types, from coastal workboats to deep-sea supply vessels.
The problem with VSAT on its own
VSAT (Very Small Aperture Terminal) has been the backbone of maritime communications for decades. Ku-band and C-band services give you coverage in open ocean where nothing else reaches. That coverage comes at a cost: high latency (typically 600ms round-trip on geostationary satellite links), limited bandwidth (often 1-4 Mbps shared across the vessel), and per-megabyte pricing that makes an accountant's eyes water.
The latency problem is physics. Geostationary satellites orbit at roughly 35,786 km above the equator. The signal travels up, hits the satellite, comes back down to an earth station, traverses the terrestrial internet, and then the response makes the same journey in reverse. That is around 72,000 km of travel at the speed of light before you account for processing delays at each hop. You cannot engineer your way around the speed of light. A 600ms RTT is baked into the architecture.
For file transfers and email, 600ms latency is tolerable. For VoIP, it makes conversations feel stilted. For video conferencing, it is borderline unusable. For real-time applications like remote diagnostics or live CCTV feeds to shore, it creates a noticeable lag that frustrates everyone involved.
The bandwidth problem is partly commercial and partly technical. VSAT airtime is expensive because satellite capacity is finite and the operators who own the transponders price accordingly. Most maritime VSAT contracts offer a committed information rate (CIR) of 512 Kbps to 2 Mbps, with burst rates somewhat higher if the beam is not congested. When you spread that across bridge systems, engine monitoring, cargo tracking and 25 crew members who all want to stream video in the evening, the maths does not work.
Then there is weather. Heavy rain attenuates Ku-band signals significantly. A tropical downpour in the Gulf of Guinea or a squall in the North Sea can degrade or drop a VSAT link for minutes at a time. C-band handles rain fade better but the hardware is larger, the antennas are heavier, and the service costs more.
VSAT is essential for blue-water coverage. But relying on it as your sole connectivity path is a design choice that guarantees frustration.
Bonding VSAT and cellular with SpeedFusion
The fundamental shift in maritime network design over the past five years has been the recognition that vessels spend a significant portion of their operational time within cellular range. Coastal vessels, ferries, offshore supply boats, and even deep-sea cargo ships spend time in port, in anchorage, transiting coastal lanes, and navigating busy shipping channels. During those periods, 4G and increasingly 5G coverage is available from shore-based towers.
SpeedFusion allows you to bond the VSAT link with one or more cellular connections into a single encrypted tunnel. The Peplink router on the vessel maintains persistent VPN tunnels to a FusionHub instance (either cloud-hosted or at the shore-side operations centre). Traffic is distributed across all available WAN paths based on their current performance characteristics: latency, jitter, packet loss and available bandwidth.
When the vessel is alongside or within 10-15 nautical miles of shore, the cellular connections typically deliver 20-80 Mbps aggregate throughput with 30-50ms latency. SpeedFusion routes latency-sensitive traffic (VoIP, video, remote desktop) over the cellular paths and bulk traffic (software updates, log uploads, non-urgent file transfers) over the VSAT or holds it for later. As the vessel moves offshore and cellular signal degrades, SpeedFusion automatically shifts traffic back to VSAT without dropping sessions.
This is not theoretical. We have deployed this architecture on vessels operating in the North Sea, the English Channel, the Irish Sea and the Mediterranean. The difference in usable connectivity between a VSAT-only vessel and one running SpeedFusion with bonded cellular is stark. Crew welfare improves measurably. Bridge officers can run cloud-based chart services without waiting 30 seconds for a tile to load. And the operations team ashore gets reliable, near-real-time telemetry instead of batch uploads every four hours.
Traffic separation: bridge systems vs crew welfare
One of the most common mistakes in maritime network design is treating the vessel as a single flat network. Operationally critical traffic and crew welfare traffic have fundamentally different requirements, and mixing them on the same network segment with no separation is asking for trouble.
Bridge systems need reliable, low-bandwidth connectivity for chart updates, weather data feeds, AIS reporting, and communications with vessel traffic services. Engine monitoring and cargo telemetry generate a steady stream of small data packets that need to get ashore reliably but do not need high bandwidth. These systems have strict requirements: they must work, and crew internet usage must never be allowed to interfere with them.
Crew welfare traffic is the opposite: high bandwidth demand, tolerance for some latency, and a usage pattern that peaks in the evening when the off-watch crew all get on their phones simultaneously. Video streaming, social media, messaging apps, and video calls home. This traffic will consume every available megabyte if you let it.
On Peplink hardware, we implement this separation using VLANs, multiple SSIDs (if the vessel has Wi-Fi access points), and outbound policy routing. The bridge network and engine monitoring systems sit on a dedicated VLAN with guaranteed bandwidth allocation. Crew welfare traffic sits on a separate VLAN with its own bandwidth cap and fair-usage policies.
SpeedFusion supports multiple profiles, so we configure separate tunnel policies for each traffic class. Bridge traffic gets priority routing over the most reliable available path. If the cellular connections are available, bridge traffic still routes over them for the lower latency, but it has absolute priority in the bonding algorithm. Crew welfare traffic uses whatever bandwidth is left over, and when the vessel is on VSAT only, crew access may be restricted to messaging and basic web browsing to preserve capacity for operational needs.
This separation is not optional. Classification societies and flag state regulations increasingly require demonstrable segregation between safety-critical and non-critical network traffic. Building it in from the start, at the router level, is far simpler than trying to retrofit it after the vessel is in service.
Bandwidth management and fair usage
Bandwidth management on a vessel is different from managing bandwidth in an office. In an office, if someone is hammering the connection with a large download, you have a conversation with them or you set a QoS policy and move on. On a vessel with 20 crew members sharing 2 Mbps of VSAT, one person running a system update on their personal laptop can make the connection unusable for everyone else for an hour.
Peplink's bandwidth management tools are particularly well suited to this environment. Per-user bandwidth limits ensure that no single device can monopolise the connection. You can set different limits for different user groups: officers might get 1 Mbps each, ratings might get 512 Kbps each, and guest connections (surveyors, inspectors, riding crews) might get 256 Kbps. These limits apply dynamically based on available capacity, so when the vessel is alongside with 50 Mbps of cellular bandwidth, everyone gets a decent connection. When it drops to VSAT only, the limits tighten automatically.
Content filtering is another tool we use extensively. Blocking video streaming services (or throttling them to a quality level that is usable on VSAT bandwidth) prevents a single Netflix session from consuming the entire vessel's allocation. We typically configure a content policy that allows streaming at reduced quality during high-bandwidth periods (cellular coverage) and blocks it entirely when the vessel is on VSAT only.
Usage tracking is equally important for cost management. VSAT airtime on metered plans can cost anywhere from $3 to $15 per megabyte depending on the service and the coverage zone. Without detailed tracking of who is using what, the monthly VSAT bill becomes an unpleasant surprise. Peplink routers log per-device usage, and InControl2 aggregates this data across the fleet, making it straightforward to identify vessels or individual users that are driving costs up.
InControl2 for fleet visibility
Managing a single vessel's network is one thing. Managing 15 or 50 vessels scattered across different oceans is a different problem entirely. You cannot send an engineer to troubleshoot a router configuration when the vessel is three days from the nearest port.
InControl2 is Peplink's cloud management platform. For fleet operators, it provides a single dashboard showing the status of every Peplink device across every vessel: WAN link status, bandwidth utilisation, SpeedFusion tunnel health, connected clients, and device alerts. When a VSAT link drops on a vessel in the Bay of Biscay, the shore-side network team sees it immediately and can assess whether the cellular backup has taken over correctly.
Remote configuration is where InControl2 becomes essential for fleet operations. Firmware updates, configuration changes, new firewall rules, updated bandwidth policies: all of these can be pushed to vessels remotely without requiring anyone on board to touch the equipment. For a fleet of 30 vessels, the alternative (sending configuration files via email and asking the master or chief officer to apply them) is slow, error-prone, and relies on crew members who have better things to do than troubleshoot router firmware.
InControl2 also supports configuration templates. You define a standard vessel configuration, a template that specifies VLAN structure, firewall rules, bandwidth policies, SpeedFusion profiles, and Wi-Fi settings, and then apply that template across the fleet. When you need to change a policy (say, updating the content filter or adjusting bandwidth limits for a new VSAT contract), you update the template and it propagates to every vessel automatically.
For compliance purposes, InControl2 maintains audit logs of every configuration change, who made it, and when. This matters when you are dealing with maritime cyber security requirements under IMO Resolution MSC.428(98) and the ISM Code. Demonstrating that you have centralised, auditable control of your vessel networks is increasingly a requirement rather than a nice-to-have.
Hardware selection for marine environments
Putting networking hardware on a vessel is not the same as putting it in a server room. The environment is hostile in ways that land-based equipment never has to cope with. Vibration is constant. Temperature ranges are extreme, from engine rooms at 50 degrees Celsius to unheated compartments in northern waters where it drops below freezing. Salt air corrodes anything that is not properly sealed or coated. And the power supply on many vessels is not the clean, stable 230V AC that shore-side equipment expects.
We standardise on two Peplink product lines for maritime deployments: the MAX Transit series for primary routing and cellular connectivity, and the Balance series for vessel LAN distribution and multi-WAN management.
The MAX Transit is the workhorse. It handles the cellular modem connections (typically dual or quad SIM with Cat-18 or Cat-20 modems), the SpeedFusion tunnel termination, and the WAN bonding. The hardware is compact enough to mount in a bridge console or a small network cabinet, and it operates across -40 to 65 degrees Celsius. The transit mounts are designed to handle vibration, and the unit draws modest power, typically 15-25W, which matters on vessels where every watt counts against generator load.
For larger vessels with more complex LAN requirements, we add a Balance router to handle internal network distribution. The Balance manages VLANs, handles DHCP for multiple network segments (bridge, engine room, accommodation, guest), runs the captive portal for crew Wi-Fi access, and provides the firewall between network zones. On a well-designed vessel network, the MAX Transit faces outward (managing WAN connections and SpeedFusion tunnels) and the Balance faces inward (managing the vessel LAN).
Mounting and cabling deserve more attention than they usually get. Marine-grade cable glands, UV-resistant cable ties, and proper grounding are not glamorous, but a connector that corrodes after six months in a salt-air environment will take your network down just as effectively as a hardware failure. We specify IP67-rated enclosures for any equipment mounted in exposed locations, and we use shielded Ethernet cabling throughout to reduce interference from the vessel's electrical systems.
Power conditioning is also critical. Many vessels have dirty power: voltage spikes, brownouts, and frequency variations that can damage sensitive electronics. We install marine-rated UPS units on all network equipment. The UPS serves a dual purpose: it protects against power quality issues, and it keeps the network running during generator changeovers, which on some vessels cause a brief power interruption that is long enough to reboot a router.
Antenna considerations at sea
Antenna selection and placement are where many maritime connectivity projects succeed or fail. The best router in the world is useless if the antenna is poorly positioned, incorrectly specified, or mounted where the vessel's superstructure blocks the signal path.
For cellular connectivity, we use marine-rated omnidirectional antennas mounted at the highest practical point on the vessel, typically on the mast or on a dedicated antenna platform above the wheelhouse. Height matters enormously at sea. Cellular tower coverage extends further over water than over land (fewer obstructions), but the vessel antenna needs line of sight to the tower. An antenna mounted at 15 metres above the waterline will maintain a cellular connection significantly further offshore than one mounted at 5 metres.
MIMO (Multiple Input, Multiple Output) antenna configurations improve cellular throughput considerably, but they require proper spacing between antenna elements. On a vessel with limited mounting space, achieving the recommended separation (typically 30-50cm for 4G MIMO, more for 5G) requires careful planning. We use combination antennas that integrate multiple cellular elements, GPS, and Wi-Fi into a single marine-rated dome where space is constrained.
Cable runs between the antenna and the router must be kept as short as possible. Every metre of coaxial cable introduces signal loss, and on a vessel where the antenna might be 20 metres above the radio room, the losses can be substantial. We use low-loss cable (LMR-400 or equivalent) and keep runs under 15 metres where possible. If longer runs are unavoidable, we consider mounting the router closer to the antenna and running Ethernet back to the vessel LAN instead, since Ethernet cable can run 100 metres without signal degradation.
For VSAT, the stabilised antenna dome must be correctly sized for the service band and the vessel's operational area. Ku-band domes range from 60cm to over a metre in diameter. Larger domes track more accurately in heavy seas but weigh more and require a stronger mounting structure. Placement must account for radar interference, exhaust plume blockage, and the arc of the vessel's cranes or cargo gear. We have seen installations where the VSAT dome was mounted in a location that gave perfect coverage in port but lost signal every time the crane swung over it during cargo operations.
Fleet deployment patterns
How you deploy connectivity across a fleet depends on the fleet's operational profile. A coastal ferry fleet operating on fixed routes has very different requirements from a fleet of offshore supply vessels that repositions between the North Sea, West Africa, and the Middle East.
For coastal and short-sea vessels that spend most of their time within cellular range, the design can be cellular-primary with VSAT as a backup or even omitted entirely. A dual-cellular MAX Transit with SpeedFusion bonding, using SIMs from two or three carriers, delivers reliable connectivity for the majority of the route. VSAT is only needed for the open-water crossings, and even then, a lightweight L-band service (Iridium Certus or similar) may be sufficient for operational traffic while the crew accepts that streaming will not work for a few hours.
For deep-sea vessels, VSAT is the primary path and cellular is supplementary. The design centres on maximising the value of the VSAT bandwidth through aggressive traffic management, with cellular bonding activated automatically when the vessel enters coastal waters. This hybrid approach means the vessel gets the best of both worlds: global coverage from VSAT, and high-bandwidth, low-latency connectivity whenever cellular is available.
For mixed fleets with vessels in different operational profiles, InControl2 templates become invaluable. You create a "coastal" template and a "deep-sea" template with different bandwidth policies, SpeedFusion profiles, and content filtering rules, and assign each vessel to the appropriate template. When a vessel changes operational area (rechartered from coastal work to an offshore contract, for example), you reassign the template and the configuration updates automatically.
SIM management for international waters
SIM management is one of the most operationally painful aspects of maritime connectivity, and it is the one that catches most organisations off guard.
A vessel transiting from the UK to West Africa might pass through the cellular coverage zones of six or seven countries. Each country has different carriers, different frequencies, and different roaming agreements. A UK SIM that gives you 50 GB of data per month at home might cost £8 per megabyte on roaming data in international waters, or it might not work at all if the carrier has no roaming agreement with the coastal state's mobile operators.
There are several approaches to this problem, and the right one depends on the fleet's trading pattern.
Multi-network SIMs from specialist maritime providers offer coverage across multiple countries on a single SIM, with a single billing relationship and (usually) more reasonable roaming rates. The trade-off is that throughput is often lower than a local SIM, because the traffic routes through the SIM provider's core network rather than the local carrier's, adding latency and sometimes bandwidth constraints.
Local SIM procurement works well for vessels on fixed routes. If the vessel always operates between two or three countries, buying local SIMs in each country and loading them into the router's SIM slots is the cheapest option. Peplink routers with multiple SIM slots can be configured to prefer the appropriate SIM based on the vessel's GPS position. When the vessel enters Spanish waters, the router activates the Spanish SIM. When it moves into French coverage, it switches to the French SIM. This requires someone to manage the SIM inventory and top up or renew contracts, but the cost savings over roaming can be substantial.
eSIM is starting to change this picture. Peplink's newer hardware supports eSIM profiles, which means you can provision new carrier profiles remotely via InControl2 without physically swapping SIMs on the vessel. For a fleet operator managing 40 vessels, the ability to switch a vessel's cellular provider without sending someone on board with a new SIM card is a significant operational improvement.
Regardless of the SIM strategy, data usage monitoring is essential. We configure alerts in InControl2 that fire when a vessel's cellular data usage exceeds predefined thresholds. This prevents the nasty surprise of a £15,000 roaming bill because a crew member's phone connected to the vessel Wi-Fi and ran a system update over a satellite-roaming cellular connection.
Real-world deployment: offshore supply fleet
One deployment we completed involved a fleet of eight offshore supply vessels operating primarily in the North Sea, with occasional repositioning to West Africa. The existing connectivity was a single Ku-band VSAT service with a 1 Mbps CIR and no crew internet provision. The operations team ashore had limited visibility of vessel systems between port calls, and the crew had been asking for internet access for years.
We installed a Peplink MAX Transit with dual cellular modems and a Balance 310X on each vessel. The MAX Transit connected to the existing VSAT terminal (via Ethernet from the below-decks unit) and to two marine-rated cellular antennas mounted on the mast. SpeedFusion tunnels terminated at a FusionHub virtual appliance hosted in a London data centre.
The vessel LAN was restructured into four VLANs: bridge operations, engine monitoring, vessel administration (for the master and chief officer), and crew welfare. Each VLAN had its own bandwidth allocation and content policy. Bridge and engine traffic had absolute priority. Crew welfare was limited to 512 Kbps per user on VSAT and uncapped on cellular.
The results were significant. During North Sea operations, vessels were within cellular range for approximately 60-70% of their operational time. During those periods, aggregate bandwidth increased from 1 Mbps (VSAT only) to 30-60 Mbps (bonded cellular). The operations team gained real-time visibility of all eight vessels via InControl2. Crew satisfaction improved substantially once internet access was available, and the feedback from the masters was that the connectivity was more reliable than what they had experienced on competing operators' vessels.
The VSAT bill actually decreased, despite increased overall data consumption. By offloading the majority of traffic to cellular when available, the VSAT was used primarily for operational traffic during open-water transits. The monthly cellular costs were lower than the VSAT overage charges the fleet had been incurring previously.
Real-world deployment: coastal ferry operator
A different pattern emerged for a coastal ferry operator running four vessels on fixed routes in UK waters. These vessels were within cellular range for their entire route, typically within 5-8 nautical miles of shore at all times.
VSAT was removed entirely from the design. Each vessel received a Peplink MAX Transit HD4 with four cellular modems and SIMs from three UK carriers. SpeedFusion bonded all four cellular connections, delivering 80-120 Mbps aggregate bandwidth with 25-40ms latency. The vessels offered passenger Wi-Fi as a revenue-generating service, with a captive portal managed by the Balance router and bandwidth caps per passenger session.
Crew operations, CCTV backhaul, and point-of-sale systems ran on separate VLANs with guaranteed bandwidth allocation. Even with 200 passengers connected to the Wi-Fi, the crew and operational systems experienced no degradation because the traffic separation and QoS policies ensured they always had sufficient bandwidth reserved.
The total connectivity cost per vessel was under £400 per month in SIM contracts. The previous VSAT service had cost over £2,000 per month per vessel with significantly worse performance.
Common mistakes to avoid
After deploying maritime connectivity on dozens of vessels, certain mistakes come up repeatedly.
Underestimating antenna placement is the most frequent. Saving money by mounting the cellular antenna on the bridge wing instead of the mast can halve the effective range. Spend the time and money to get antennas as high as possible with clear sight lines in all directions.
Ignoring cable quality is another. Standard Cat5e cable and consumer-grade coaxial will corrode in a marine environment within months. Specify marine-grade, UV-resistant, shielded cabling throughout and use proper cable glands at every penetration point.
Failing to separate traffic before deployment causes problems that are difficult to fix later. Retrofitting VLANs and QoS policies on a vessel network that was built as a flat network requires reconfiguring every switch, access point, and connected device. Build the separation in from day one.
Not testing in realistic conditions is surprisingly common. A connectivity solution that works perfectly alongside in port, with strong cellular signal and shore power, may behave very differently at sea with the vessel rolling, the generator providing inconsistent power, and the cellular signal dropping in and out. Sea trials should be part of every deployment, not an afterthought.
Neglecting physical security of network equipment is a regulatory issue as well as a practical one. Maritime cyber security guidelines require that network infrastructure is physically secured against unauthorised access. Routers, switches, and access points should be in locked cabinets with restricted key access, and configuration ports should be disabled or password-protected.
Getting started
If you are running a fleet with inadequate connectivity, or building new vessels and want to get the network design right from the start, the process is straightforward. Start with a survey of each vessel's operational profile: where does it operate, how much time does it spend in coastal waters, what systems need connectivity, and what are the crew expectations? From there, the hardware selection, antenna specification, network architecture, and SIM strategy all follow logically.
We design and deploy maritime Peplink solutions for vessel operators across the UK and internationally. We handle the hardware specification, the network design, the SpeedFusion configuration, the InControl2 setup, and the ongoing management. If you want to discuss what is achievable for your fleet, get in touch or browse Peplink hardware in our shop.