* Switchable WAN/LAN Port, up to 2 simultaneous WANs
** P1/P4/P5/P6: PoE-Out ports (Vigor2962P)
High Performance 2.5GbE VPN Security Routers

Vigor2962 series are high performance and dynamic firewall routers with configurable GbE WAN/LAN ports. From the supported 2.5GbE port, 1GbE SFP port, and 2 x 1GbE ports, users can set 2 WANs for Load Balancing/Failover purposes and receive a maximum of 2.2 Gbps NAT throughput.
The Vigor2962P router is a PoE capable router with 4 x GbE PoE LAN ports providing a total of 65 Watts of power, and is an ideal solution where PoE devices such as Wireless Access Points or IP cameras are deployed on the network.
Vigor2962 series are high performance and dynamic firewall routers with configurable GbE WAN/LAN ports. From the supported 2.5GbE port, 1GbE SFP port, and 2 x 1GbE ports, users can set 2 WANs for Load Balancing and Failover purposes and receive a maximum of 2.2 Gbps NAT throughput.

* Switchable WAN/LAN Port, up to 2 simultaneous WANs
** P1/P4/P5/P6: PoE-Out ports (Vigor2962P)
Performance Comparison: Vigor2962 vs. Vigor2960
Vigor2962 users can choose a single WAN (1 x 2.5GbE) or dual WAN (2 x 1GbE) for Load Balancing and Failover, for up to 2.2Gbps of high NAT throughput. The PoE model (Vigor2962P) supports 4 x PoE ports and provides a total power budget of 65Watts.
NAT throughput (2.4 times faster)
Vigor2962
Vigor2960
IPSec throughput (1.7 times faster)
Vigor2962
Vigor2960
SSL-VPN throughput (2.3 times faster)
Vigor2962
Vigor2960
Key Features
Flexible WAN/LAN Ports
Vigor2962 series routers feature four configurable WAN/LAN ports, including one 2.5GbE port, one SFP/GbE combo port, and two GbE ports. A maximum of two of the four ports can be used as WAN ports concurrently. Dual WAN for Load Balancing/Failover improves Internet resilience of your business networks.

Hardware Redundancy with High Availability
To avoid a single point of failure, Vigor2962 supports Hot-Standby and Active-Standby modes for Hardware Redundancy. Upon detecting a hardware failure, the Failover function will switch over to the standby router within 1 second.
PoE (Vigor2962P)
With a total power budget of 65W, each IEEE802.3at PoE port provides up to 32W power to devices such as IP camera, Wireless AP, IP phone, etc.
VPN Hub with High Dialing Speed
Up to 200 concurrent VPN tunnels for branches (LAN-to-LAN) and remote workers (remote dial-in) are supported.
Vigor2962P – PoE (Power over Ethernet Function)

URL Reputation
URL Reputation is a cloud-based threat intelligence service that adds an extra layer of security to protect LAN clients during their online activities.
With a total of 82 content categories, including 10 security-focused ones, it provides comprehensive and up-to-date protection for both home and business networks.
These categories cover a wide range of areas—from malware, spyware, and adware, to parental controls, business productivity, and social networking—helping to create a safer online environment, enhance employee productivity, and support efficient bandwidth management.

IP Reputation
Every internet communication involves source and destination IP addresses. Cybercriminals often exploit known malicious IPs to launch attacks using various techniques, including:
- Botnets
- TOR nodes and anonymous proxies
- Command-and-Control (C2) servers
- Phishing servers
- Distributed Denial of Service (DDoS) attacks

IP Reputation helps identify and block traffic from these high-risk IP addresses, adding an essential layer of network protection against cyber threats.
Blocking communication with malicious IP addresses is critical for network security. However, relying on static blocklists is no longer effective, as they lack the real-time, predictive intelligence needed to combat evolving threats. The IP Reputation Service addresses this challenge by delivering dynamic, real-time scoring and classification of IP addresses. It enables the automatic blocking of:
- High-risk traffic
- Suspicious proxies
- Malware distributors
- IPs associated with recent malicious activity
The system evaluates IPs based on multiple factors, including infection history, protocol behaviour, and attack frequency. Each IP is assigned a reputation score, which determines whether it should be trusted, monitored, or blocked, ensuring proactive and intelligent network protection.
You can purchase a URL Reputation Silver Card for your Vigor2962 series
Hotspot Web Portal
Market your business while offering free Wi-Fi
Wi-Fi Marketing
Redirect hotspot guests to the company homepage, online surveys, or display a promotion message.
Grow Customer Mailing List
Require guests to leave contact info or social media accounts before they can use the Internet services.

Various Authentication Types
A variety of login methods are supported to meet your business needs, including Facebook Login, Google Login, SMS PIN, Voucher PIN, and RADIUS.
3rd-Party Service Compliant
Supports external captive portal authentication so you can keep using the Wi-Fi marketing solution you prefer.
Data Quota Management
Bandwidth management is integrated into the Hotspot features to control the bandwidth and session usage of the Hotspot guests.
Effortless and Secure VPN Access with EasyVPN
Setting up a VPN can often be complex, involving protocol selection, manual configurations, and troubleshooting, especially for non-technical users. While Vigor routers support advanced VPN protocols such as IPsec, WireGuard, and OpenVPN, traditional setup methods can be time-consuming and daunting.
EasyVPN simplifies this process by offering a streamlined, hassle-free solution for secure remote connectivity. With EasyVPN, users can quickly establish encrypted connections without the need to:
- Manually generate WireGuard keys
- Import OpenVPN configuration files
- Upload certificates
By automating these steps, EasyVPN delivers a fast, secure, and intuitive VPN experience—perfect for businesses and users who want robust protection without the technical complexity.

Stealth Security Protection with Port Knocking
DrayTek’s Port Knocking technology adds an advanced stealth security layer by keeping critical network services completely invisible to unauthorised users. Instead of exposing management ports or VPN services to the public internet, Port Knocking requires a predefined “knock” sequence before access is granted, ensuring that only trusted users can discover and use these services.
By integrating three powerful functions, Port Knocking provides robust protection against port scanning, brute-force attacks, and unauthorised access.
Port Redirection
- Conceal real service ports from the public internet
- Redirect unauthorised requests to non-existent services to prevent detection

Secure Router Management Access
- Allow router management access only after a successful knock sequence or through a secure internal server
- Completely eliminate direct exposure of the management interface to the open internet
VPN Service Control (WAN Binding)
- Keep VPN services invisible until the correct knock sequence is received
- Bind VPN availability to specific WAN interfaces and authorised IP addresses
How It Works
- By default, all protected ports remain closed and undetectable
- After the correct knock sequence is received, selected ports open temporarily for authorised access
- Once the configured time window expires, services automatically return to hidden mode
With DrayTek Port Knocking, your network operates in stealth mode, invisible to attackers yet instantly accessible to authorised administrators and remote users. It is the ideal solution for organisations that demand high-level security without compromising accessibility.
Management Solution
| Software Management |
|---|
| All-in-One Management |
|---|
In-the-Box

Vigor2962/Vigor2962P

Rack Mount Kit
(brackets)

RJ-45 Cable
(Ethernet)

Power Adaptor

Quick Start Guide
Note :
The throughput figures are maximum, based on DrayTek internal testing with optimal conditions. The actual performance may vary depending on the different network conditions and applications activated.
Models
![]() | ![]() | |
|---|---|---|
| Model | Vigor2962 | Vigor2962P |
| Configurable WAN/LAN port | 1 1 x 2.5GbE (RJ-45) 2 1 x 1GbE SFP/GbE Combo 3 2 x GbE (RJ-45) | 1 1 x PoE 2.5GbE (RJ-45) 2 1 x 1GbE SFP/GbE Combo 3 1 x GbE (RJ-45) 4 1 x PoE GbE (RJ-45) |
| Fixed LAN Port | 4 2 x GbE (RJ-45) | 5 2 x PoE GbE (RJ-45) |
| PoE Budget | 65W | |
| USB Port | 5 1 x USB 2.0 + 1 x USB 3.0 | 6 1 x USB 2.0 + 1 x USB 3.0 |
| NAT Throughput | 2.2 Gbps | |
| VPN | 200 (IPsec VPN throughput up to 1 Gbps)) | |
| NAT sessions | 300,000 NAT sessions | |
High Performance VPN Gateway Comparison
![]() | ![]() | ![]() | ![]() | |
|---|---|---|---|---|
| Model | Vigor3910 | Vigor2962 | Vigor2960 | Vigor2952 |
| Configurable WAN/LAN port | 2 x 10 Gigabit SFP+ 2 x 2.5 GbE RJ-45 4 x GbE RJ-45 | 1 x 2.5GbE 1 x SFP / GbE Combo 2 x GbE *up to 2 simultaneous WANs | ||
| Fixed WAN port | 2 x GbE RJ-45 | 1 x SFP/GbE 1 x GBE RJ-45 | ||
| Fixed LAN port | 4 x GbE RJ-45 | 2x GbE (PoE for Vigor2962P) | 4 x GbE RJ-45 | 4 x GbE RJ-45 |
| USB Port | 2 x USB 3.0 | 1 x USB 2.0 1 x USB 3.0 | 2 x USB 2.0 | 1 x USB 2.0 1 x USB 3.0 |
| Console Port | 1 x RJ-45 | |||
| PoE Budget (P model) | 60 Watts | 60 Watts | ||
| NAT Throughput | 9.4 Gbps (with built-in Hardware acceleration) | 2.2 Gbps (with built-in Hardware acceleration) | 900 Mbps | 500 Mbps |
| IPSec VPN Performance | 3.3 Gbps (AES 256 bits) | 800 Mbps (AES 256 bits) | 600 Mbps (AES 256 bits) | 200 Mbps |
| SSL VPN Performance | 1.6 Gbps | 500 Mbps | 300 Mbps | 90 Mbps |
| Max. Number of NAT Sessions | 1000k | 300k | 80k | 60k |
| Max. Concurrent VPN Tunnels | 500 | 200 | 200 | 200 |
| Max. Concurrent SSL Tunnels | 200 | 50 | 50 | 50 |
| Max. Number of VLAN | 50 | 20 | 20 | 8 |
| Central AP Management | 50 | 50 | 50 | 50 |
| Central Switch Management | 30 | 30 | 10 | 10 |
| Central VPN Management | 12 | 8 |
Specifications
Interface (DISABLE)
| Interface | |
|---|---|
| LAN/WAN Configurable Port | 1x 2.5G Ethernet, RJ-45 (PoE capable port for P model) 1x GbE/SFP Combo 2x GbE, RJ-45 (PoE capable port(P4) for P model) * up to 2 simultaneous WANs |
| Fixed LAN Port | 2x GbE, RJ-45 (PoE capable ports for P model) |
| USB Port | 1x USB 2.0 + 1x USB 3.0 for USB disk storage (since f/w v3.9.4) |
Performance (DISABLE)
| Performance | |
|---|---|
| NAT Throughput w/ Hardware Acceleration | 2.2 Gbps |
| IPsec VPN Performance | 1 Gbps (AES 256 bits) |
| SSL VPN Performance | 800 Mbps |
| Max. Number of NAT Sessions | 300,000 NAT sessions (since f/w v3.9.6) |
| Max. Concurrent VPN Tunnels | 200 |
| Max. Concurrent OpenVPN/ SSL-VPN | 50 |
PoE (P model) (DISABLE)
| PoE (P model) | |
|---|---|
| PoE Capable Ports | 4 (P1/P4/P5/P6) |
| PoE Standards | PoE/PoE+ (802.3af/802.3at) |
| Power Budget | 65 watts |
| PD Device Check | |
Internet Connection (DISABLE)
| Internet Connection | |
|---|---|
| IPv4 | PPPoE, DHCP, Static IP |
| IPv6 | PPP, DHCPv6, Static IPv6, TSPC, AICCU, 6rd, 6in4 Static Tunnel |
| 802.1p/q Multi-VLAN Tagging | |
| Multi-VLAN/PVC | |
| Load Balancing | IP-based, Session-based |
| WAN Active on Demand | Link Failure, Traffic Threshold |
| Connection Detection | ARP, Ping, Strict ARP |
| WAN Data Budget | (since f/w v3.9.6) |
| Dynamic DNS | |
| DrayDDNS | |
LAN Management (DISABLE)
| LAN Management | |
|---|---|
| VLAN | 802.1q Tag-based, Port-based |
| Max. Number of VLAN | 20 |
| Number of LAN Subnet | 20 |
| DHCP Server | Multiple IP Subnet, Custom DHCP Options, Bind-IP-to-MAC |
| LAN IP Alias | |
| Wired 802.1x Authentication | |
| Port Mirroring | |
| Local DNS Server | |
| Conditional DNS Forwarding | |
| Hotspot Web Portal | |
| Hotspot Authentication | Click-Through, Social Login, SMS PIN, RADIUS, External Portal Server |
Networking (DISABLE)
| Networking | |
|---|---|
| Routing | IPv4 Static Routing, IPv6 Static Routing, Inter-VLAN Routing, RIP, OSPF, BGP (IPv4) |
| Policy-based Routing | Protocol, IP Address, Port, Domain, Country |
| High Availability | |
| DNS Security (DNSSEC) | |
| IGMP | IGMP v2/v3, IGMP Proxy, IGMP Snooping & Fast Leave |
| Local RADIUS server | |
VPN (DISABLE)
| VPN | |
|---|---|
| LAN-to-LAN | |
| Teleworker-to-LAN | |
| Protocols | PPTP, L2TP, IPsec, L2TP over IPsec, SSL, GRE, IKEv2, IKEv2-EAP, IPsec-XAuth, OpenVPN (Host to LAN) |
| User Authentication | Local, RADIUS, LDAP, TACACS+, mOTP |
| IKE Authentication | Pre-Shared Key, X.509 |
| IPsec Authentication | SHA-1, SHA-256, MD5 |
| Encryption | MPPE, DES, 3DES, AES |
| VPN Trunk (Redundancy) | Load Balancing, Failover |
| Single-Armed VPN | |
| NAT-Traversal (NAT-T) | |
| DrayTek VPN Matcher | |
Firewall & Content Filtering (DISABLE)
| Firewall & Content Filtering | |
|---|---|
| NAT | Port Redirection, Open Ports, Port Triggering, DMZ Host |
| ALG (Application Layer Gateway) | SIP, RTSP, FTP, H.323 |
| VPN Pass-Through | PPTP, L2TP, IPsec |
| IP-based Firewall Policy | |
| Content Filtering | Application, URL, DNS Keyword, Web Features, Web Category* (* subscription required) |
| DoS Attack Defense | |
| Spoofing Defense | |
Bandwidth Management (DISABLE)
| Bandwidth Management | |
|---|---|
| IP-based Bandwidth Limit | |
| IP-based Session Limit | |
| QoS (Quality of Service) | TOS, DSCP, 802.1p, IP Address, Service Type |
| VoIP Prioritisation | |
Management (DISABLE)
| Management | |
|---|---|
| Local Service | HTTP, HTTPS, Telnet, SSH v2, FTP, TR-069 |
| Config File Export & Import | |
| Firmware Upgrade | TFTP, HTTP, TR-069 |
| 2-Level Administration Privilege | |
| Access Control | Access List, Brute Force Protection |
| Notification Alert | SMS, E-mail |
| SNMP | v1, v2c, v3 |
| Syslog | |
| Managed by VigorACS | |
| Central AP Management | 50 VigorAPs |
| Central Switch Management | 30 VigorSwitches |
Physical (DISABLE)
Note :
- All specifications are subject to change without notice.
- The throughput figures are maximum, based on DrayTek internal testing with optimal conditions. The actual performance may vary depending on the different network conditions and applications activated.
Multi-subnets

The Vigor2926 supports up to 8 LAN IP subnets, an IP Routed subnet and a DMZ port.
The 8 LAN IP subnets can be assigned to 16 VLANS allowing the creation of logical workgroups to provide additional security and traffic management within an organisation.
For example, within a building each tenant or workgroup can be assigned their own IP network. In addition, workgroups can also be located in different physical locations or floors within a building. For example, a Sales Department may be located on the 1st floor of a building, but some of the sales people are located on the second floor and still be part of the sales VLAN.
The IEEE 802.1q VLAN trunk feature means that only a single LAN cable connection is required between the router and the VigorSwitch, create a number of VLANs for different departments.
The VLAN Tag Priority setting can be used to prioritise traffic for certain VLANS or workgroups.
Multi-site business deployment

Increase remote access security to your office by combining both VPN and Firewall features in the Vigor2926.
The Vigor2926 supports up to 50 simultaneous VPN tunnels (such as IPSec/PPTP/L2TP/SSL protocols) for secure data exchange and communication. In addition, 25 SSL VPN tunnels are available for teleworkers to access the office LAN. Teleworkers can be authenticated directly with your LDAP server if preferred. The SSL technology is same as the encryption used for secure web sites such as online banking.
Security is enhanced by utilising firewall features such as web content and URL filtering in addition to restricting access to P2P traffic and Instant Messaging applications.
The Vigor2926 series is equipped with two Gigabit Ethernet ports and two USB WAN ports for WAN load-balancing and backup. This allows backup VPN tunnels to be created to branch office networks to ensure maximum VPN connectivity uptime. In addition, the VPN Trunking feature can be used to set up dual VPN tunnel links to branch office networks to increase bandwidth and provide redundancy and backup to prevent downtime due to one of the WAN connections failing.
Comprehensive Firewall

The comprehensive firewall in the Vigor2926 router protects your network by using Stateful Packet Inspection (SPI) and extensive firewall filtering rules. Stateful Packet Inspection monitors incoming and outgoing data packets at layer 3. It maintains a table of open connections and inspects the payload to determine its data will be passed or blocked by matching known active legitimate connections.
The DoS (Denial of Service) Defense also protects your network against a number of attacks from the Internet.
The URL and Web content filters are also available to restrict access to certain websites (such as Social Networking, Gambling, etc.) for some users and it can be enforced according to a time schedule.
The DMZ Host feature allows you to place a server in the DMZ so it can be access from the Internet but not exposing your main network to the Internet.
USB Thermometer

The optional USB thermometer can be attached to the Vigor2926 to provide logging of the ambient temperature in the server room. Upper and lower temperature thresholds can be set and when the temperature exceeds these thresholds and alarm is generated. This alarm can be sent to the network administrator via email or SMS to alert them of the environmental issue.
802.11ac Wave 2 (for ac/Vac model)
802.11ac Wave 2 can simultaneously stream to multiple users to maximise bandwidth utilisation.

Vigor2926ac routers now operate 802.11ac Wave 2 Wi-Fi with support for MU-MIMO, TX Beam Forming, 1733Mb/s Link Rate and up to 4 spatial streams. This allows up to 4 wireless clients such as laptops or smartphones to have simultaneous access to a Wi-Fi channel. The result is an increased performance of the Wi-Fi network.
Central Management – AP / Switch / VPN Management

The central management features allow the network administrator to monitor and configure Vigor devices including VigorAPs, Vigor Switches, and even Vigor Routers from a central management console built into the Vigor2926 series router. Maintenance tasks such as firmware upgrades, configuration backup and restoration as well as and monitoring be done from a single portal.
Three options are available in Central Management. These are:
- VPN Management
- AP Management
- Switch Management
VPN management supports 8 external CPE devices and allows the creation and management of IPSec, PPTP or SSL VPN tunnels from the central Vigor2926 router to the remote routers.
The AP Management feature allows the monitoring and auto-configuration of up to 20 DrayTek Access Points connected to the Vigor2926 LAN. Automatic Provisioning can be triggered when a new Access point is connected to the LAN. Other features include client or traffic history of the AP and configuration of load balancing rules for the Access Points.
Switch Management allows you to manage up to 10 VigorSwitches. It simplifies the task of configuring VLANS in attached VigorSwitches matching the router’s VLAN settings. It also displays the switch status as well as the network topology through the switch hierarchy feature.
Flexible Installation with Rackmount

The Vigor2926 series router can be rack mounted into a standard 19’ rack or cabinet. The 1RU rack mounting kit allows the front panel of the router to be easily accessible as well as keeping it secure in the communications rack.
Resources
* Switchable WAN/LAN Port, up to 2 simultaneous WANs
** P1/P4/P5/P6: PoE-Out ports (Vigor2962P)
High Performance 2.5GbE VPN Security Routers

Vigor2962 series are high performance and dynamic firewall routers with configurable GbE WAN/LAN ports. From the supported 2.5GbE port, 1GbE SFP port, and 2 x 1GbE ports, users can set 2 WANs for Load Balancing/Failover purposes and receive a maximum of 2.2 Gbps NAT throughput.
The Vigor2962P router is a PoE capable router with 4 x GbE PoE LAN ports providing a total of 60 Watts of power, and is an ideal solution where PoE devices such as Wireless Access Points or IP cameras are deployed on the network.

* Switchable WAN/LAN Port, up to 2 simultaneous WANs
** P1/P4/P5/P6: PoE-Out ports (Vigor2962P)
Performance Comparison: Vigor2962 vs. Vigor2960
Vigor2962 users can choose a single WAN (1 x 2.5GbE) or dual WAN (2 x 1GbE) for Load Balancing and Failover, for up to 2.2Gbps of high NAT throughput. The PoE model (Vigor2962P) supports 4 x PoE ports and provides a total power budget of 65Watts.
NAT throughput (2.4 times faster)
Vigor2962
Vigor2960
IPSec throughput (1.7 times faster)
Vigor2962
Vigor2960
SSL-VPN throughput (2.3 times faster)
Vigor2962
Vigor2960
Key Features
Flexible WAN/LAN Ports
Vigor2962 series routers feature four configurable WAN/LAN ports, including one 2.5GbE port, one SFP/GbE combo port, and two GbE ports. A maximum of two of the four ports can be used as WAN ports concurrently. Dual WAN for Load Balancing/Failover improves Internet resilience of your business networks.

Hardware Redundancy with High Availability
To avoid a single point of failure, Vigor2962 supports Hot-Standby and Active-Standby modes for Hardware Redundancy. Upon detecting a hardware failure, the Failover function will switch over to the standby router within 1 second.
PoE (Vigor2962P)
With a total power budget of 65W, each IEEE802.3at PoE port provides up to 32W power to devices such as IP camera, Wireless AP, IP phone, etc.
VPN Hub with High Dialing Speed
Up to 200 concurrent VPN tunnels for branches (LAN-to-LAN) and remote workers (remote dial-in) are supported.
Vigor2962P – PoE (Power over Ethernet Function)

URL Reputation
URL Reputation is a cloud-based threat intelligence service that adds an extra layer of security to protect LAN clients during their online activities.
With a total of 82 content categories, including 10 security-focused ones, it provides comprehensive and up-to-date protection for both home and business networks.
These categories cover a wide range of areas—from malware, spyware, and adware, to parental controls, business productivity, and social networking—helping to create a safer online environment, enhance employee productivity, and support efficient bandwidth management.

IP Reputation
Every internet communication involves source and destination IP addresses. Cybercriminals often exploit known malicious IPs to launch attacks using various techniques, including:
- Botnets
- TOR nodes and anonymous proxies
- Command-and-Control (C2) servers
- Phishing servers
- Distributed Denial of Service (DDoS) attacks

IP Reputation helps identify and block traffic from these high-risk IP addresses, adding an essential layer of network protection against cyber threats.
Blocking communication with malicious IP addresses is critical for network security. However, relying on static blocklists is no longer effective, as they lack the real-time, predictive intelligence needed to combat evolving threats. The IP Reputation Service addresses this challenge by delivering dynamic, real-time scoring and classification of IP addresses. It enables the automatic blocking of:
- High-risk traffic
- Suspicious proxies
- Malware distributors
- IPs associated with recent malicious activity
The system evaluates IPs based on multiple factors, including infection history, protocol behaviour, and attack frequency. Each IP is assigned a reputation score, which determines whether it should be trusted, monitored, or blocked, ensuring proactive and intelligent network protection.
You can purchase a URL Reputation Silver Card for your Vigor2962 series
Hotspot Web Portal
Market your business while offering free Wi-Fi
Wi-Fi Marketing
Redirect hotspot guests to the company homepage, online surveys, or display a promotion message.
Grow Customer Mailing List
Require guests to leave contact info or social media accounts before they can use the Internet services.

Various Authentication Types
A variety of login methods are supported to meet your business needs, including Facebook Login, Google Login, SMS PIN, Voucher PIN, and RADIUS.
3rd-Party Service Compliant
Supports external captive portal authentication so you can keep using the Wi-Fi marketing solution you prefer.
Data Quota Management
Bandwidth management is integrated into the Hotspot features to control the bandwidth and session usage of the Hotspot guests.
Effortless and Secure VPN Access with EasyVPN
Setting up a VPN can often be complex, involving protocol selection, manual configurations, and troubleshooting, especially for non-technical users. While Vigor routers support advanced VPN protocols such as IPsec, WireGuard, and OpenVPN, traditional setup methods can be time-consuming and daunting.
EasyVPN simplifies this process by offering a streamlined, hassle-free solution for secure remote connectivity. With EasyVPN, users can quickly establish encrypted connections without the need to:
- Manually generate WireGuard keys
- Import OpenVPN configuration files
- Upload certificates
By automating these steps, EasyVPN delivers a fast, secure, and intuitive VPN experience—perfect for businesses and users who want robust protection without the technical complexity.

Stealth Security Protection with Port Knocking
DrayTek’s Port Knocking technology adds an advanced stealth security layer by keeping critical network services completely invisible to unauthorised users. Instead of exposing management ports or VPN services to the public internet, Port Knocking requires a predefined “knock” sequence before access is granted, ensuring that only trusted users can discover and use these services.
By integrating three powerful functions, Port Knocking provides robust protection against port scanning, brute-force attacks, and unauthorised access.
Port Redirection
- Conceal real service ports from the public internet
- Redirect unauthorised requests to non-existent services to prevent detection

Secure Router Management Access
- Allow router management access only after a successful knock sequence or through a secure internal server
- Completely eliminate direct exposure of the management interface to the open internet
VPN Service Control (WAN Binding)
- Keep VPN services invisible until the correct knock sequence is received
- Bind VPN availability to specific WAN interfaces and authorised IP addresses
How It Works
- By default, all protected ports remain closed and undetectable
- After the correct knock sequence is received, selected ports open temporarily for authorised access
- Once the configured time window expires, services automatically return to hidden mode
With DrayTek Port Knocking, your network operates in stealth mode, invisible to attackers yet instantly accessible to authorised administrators and remote users. It is the ideal solution for organisations that demand high-level security without compromising accessibility.
Management Solution
| Software Management |
|---|
| All-in-One Management |
|---|
In-the-Box

Vigor2962/Vigor2962P

Rack Mount Kit
(brackets)

RJ-45 Cable
(Ethernet)

Power Adaptor

Quick Start Guide
Note :
The throughput figures are maximum, based on DrayTek internal testing with optimal conditions. The actual performance may vary depending on the different network conditions and applications activated.
Models
| Vigor2962 | |
|---|---|
![]() | |
| Configurable WAN/LAN port: 1 1 x 2.5GbE (RJ-45) 2 1 x 1GbE SFP/GbE Combo 3 2 x GbE (RJ-45) | |
| Fixed LAN Port: 4 2 x GbE (RJ-45) | |
| PoE Budget: | |
| USB Port: 5 1 x USB 2.0 + 1 x USB 3.0 | |
| NAT Throughput: 2.2 Gbps | |
| VPN: 200 (IPSec throughput up to 1 Gbps) | |
| NAT sessions: 300,000 NAT sessions | |
| Vigor2962P | |
|---|---|
![]() | |
| Configurable WAN/LAN port: 1 1 x PoE 2.5GbE (RJ-45) 2 1 x 1GbE SFP/GbE Combo 3 1 x GbE (RJ-45) 4 1 x PoE GbE (RJ-45) | |
| Fixed LAN Port: 5 2 x PoE GbE (RJ-45) | |
| PoE Budget: 65W | |
| USB Port: 6 1 x USB 2.0 + 1 x USB 3.0 | |
| NAT Throughput: 2.2 Gbps | |
| VPN: 200 (IPSec throughput up to 1 Gbps) | |
| NAT sessions: 300,000 NAT sessions |
High Performance VPN Gateway Comparison
| Vigor3910 |
|---|
![]() |
| Vigor2962/P |
|---|
![]() |
| Vigor2960 |
|---|
![]() |
| Vigor2952 |
|---|
![]() |
Specifications
Interface (DISABLE)
| Interface | |
|---|---|
| LAN/WAN Configurable Port: 1x 2.5G Ethernet, RJ-45 (PoE capable port for P model) 1x GbE/SFP Combo 2x GbE, RJ-45 (PoE capable port(P4) for P model) * up to 2 simultaneous WANs | |
| Fixed LAN Port: 2x GbE, RJ-45 (PoE capable ports for P model) | |
| USB Port: 1x USB 2.0 + 1x USB 3.0 for USB disk storage (since f/w v3.9.4) |
Performance (DISABLE)
| Performance | |
|---|---|
| NAT Throughput w/ Hardware Acceleration: 2.2 Gbps | |
| IPsec VPN Performance: 1 Gbps (AES 256 bits) | |
| SSL VPN Performance: 800 Mbps | |
| Max. Number of NAT Sessions: 300,000 NAT sessions (since f/w v3.9.6) | |
| Max. Concurrent VPN Tunnels: 200 | |
| Max. Concurrent OpenVPN / SSL-VPN: 50 |
PoE (P model) (DISABLE)
| PoE (P model) | |
|---|---|
| PoE Capable Ports: 4 (P1/P4/P5/P6) | |
| PoE Standards: PoE/PoE+ (802.3af/802.3at) | |
| Power Budget: 65 watts | |
| PD Device Check | |
Internet Connection (DISABLE)
| Internet Connection | |
|---|---|
| IPv4: PPPoE, DHCP, Static IP | |
| IPv6: PPP, DHCPv6, Static IPv6, TSPC, AICCU, 6rd, 6in4 Static Tunnel | |
| 802.1p/q Multi-VLAN Tagging | |
| Multi-VLAN/PVC | |
| Load Balancing: IP-based, Session-based | |
| WAN Active on Demand: Link Failure, Traffic Threshold | |
| Connection Detection: ARP, Ping, Strict ARP | |
| WAN Data Budget (since f/w v3.9.6) | |
| Dynamic DNS | |
| DrayDDNS | |
LAN Management (DISABLE)
| LAN Management | |
|---|---|
| VLAN: 802.1q Tag-based, Port-based | |
| Max. Number of VLAN: 20 | |
| Number of LAN Subnet: 20 | |
| DHCP Server: Multiple IP Subnet, Custom DHCP Options, Bind-IP-to-MAC | |
| LAN IP Alias | |
| Wired 802.1x Authentication | |
| Port Mirroring | |
| Local DNS Server | |
| Conditional DNS Forwarding | |
| Hotspot Web Portal | |
| Hotspot Authentication: Click-Through, Social Login, SMS PIN, RADIUS, External Portal Server | |
Networking (DISABLE)
| Networking | |
|---|---|
| Routing: IPv4 Static Routing, IPv6 Static Routing, Inter-VLAN Routing, RIP, OSPF, BGP (IPv4) | |
| Policy-based Routing: Protocol, IP Address, Port, Domain, Country | |
| High Availability | |
| DNS Security (DNSSEC) | |
| IGMP: IGMP v2/v3, IGMP Proxy, IGMP Snooping & Fast Leave | |
| Local RADIUS server | |
VPN (DISABLE)
| VPN | |
|---|---|
| LAN-to-LAN | |
| Teleworker-to-LAN | |
| Protocols: PPTP, L2TP, IPsec, L2TP over IPsec, SSL, GRE, IKEv2, IKEv2-EAP, IPsec-XAuth, OpenVPN (Host to LAN) | |
| User Authentication: Local, RADIUS, LDAP, TACACS+, mOTP | |
| IKE Authentication: Pre-Shared Key, X.509 | |
| IPsec Authentication: SHA-1, SHA-256, MD5 | |
| Encryption: MPPE, DES, 3DES, AES | |
| VPN Trunk (Redundancy): Load Balancing, Failover | |
| Single-Armed VPN | |
| NAT-Traversal (NAT-T) | |
| DrayTek VPN Matcher | |
Firewall & Content Filtering (DISABLE)
| Firewall & Content Filtering | |
|---|---|
| NAT: Port Redirection, Open Ports, Port Triggering, DMZ Host, UPnP | |
| ALG (Application Layer Gateway): SIP, RTSP, FTP, H.323 | |
| VPN Pass-Through: PPTP, L2TP, IPsec | |
| IP-based Firewall Policy | |
| Content Filtering: Application, URL, DNS Keyword, Web Features, Web Category* (* subscription required) | |
| DoS Attack Defense | |
| Spoofing Defense | |
Bandwidth Management (DISABLE)
| Bandwidth Management | |
|---|---|
| IP-based Bandwidth Limit | |
| IP-based Session Limit | |
| QoS (Quality of Service): TOS, DSCP, 802.1p, IP Address, Service Type | |
| VoIP Prioritisation | |
Management (DISABLE)
| Management | |
|---|---|
| Local Service: HTTP, HTTPS, Telnet, SSH v2, FTP, TR-069 | |
| Config File Export & Import | |
| Firmware Upgrade: TFTP, HTTP, TR-069 | |
| 2-Level Administration Privilege | |
| Access Control: Access List, Brute Force Protection | |
| Notification Alert: SMS, E-mail | |
| SNMP: v1, v2c, v3 | |
| Syslog | |
| Managed by VigorACS | |
| Central AP Management: 50 VigorAPs | |
| Central Switch Management: 30 VigorSwitches | |
Physical (DISABLE)
Note :
- All specifications are subject to change without notice.
- The throughput figures are maximum, based on DrayTek internal testing with optimal conditions. The actual performance may vary depending on the different network conditions and applications activated.












