The Vigor3912 series Multi-WAN routers are high-performance enterprise-level broadband routers with 2 x 10Gb SFP+ Fibre configurable WAN/LAN slots, 2 x 2.5GbE configurable WAN/LAN ports, 4 x 1GbE configurable WAN/LAN ports, and 4 x 1GbE fixed LAN ports with 15.6 Gbps max. NAT throughput and Software Acceleration (bi-directional), 1,000k NAT sessions and other enterprise-level features. With the capacity to handle up to 500 VPN tunnels including 200 OpenVPN /SSL-VPN tunnels, and 100 IP subnets simultaneously, Vigor3912 routers are an excellent solution for network applications in corporations, organisations and governments.

The session-based Load Balance feature allows the aggregation of multiple WAN connections to provide a higher speed internet connection. In addition to the Load Balance and Failover multi-WAN functions, the Vigor3912 supports High Availability (Common Address Redundancy Protocol) with hardware redundancy to ensure 24/7 system uptime for all WAN interfaces.

The Central Management feature provides a centralised console to manage your network. It includes AP Management to configure and manage up to 50 DrayTek Access Points, and Switch Management to configure and manage up to 30 DrayTek VigorSwitches.

The Vigor3912S model comes equipped with a 256GB SSD which supports Linux with Docker applications such as Suricata IDS and VigorConnect. Together with this router’s capacity, these powerful applications eliminate the need for additional servers, enforcing security options at the door.

Smart Action allows predefined events to trigger predefined actions. Vigor users can pre-configure up to 64 event-to-action profiles. Actions, such as sending alerts, emails, removing a VPN profile, etc., can be programmed for events such as network conditions, occurrence counts, etc., associated with specified time and date.

Smart Action will act on these events:

• Send an alert email when CPU usage reaches 90%
• Disable VPN profile at a specified time
• Limit the access of a LAN server by Schedule
• Remove VPN User profile on a specified date
• Wake up the PC when the office hours start
• Log Keyword Match (syslog log, console log, Suricata log) for Vigor3912S only

The Vigor3912S model comes equipped with a 256GB SSD pre-installed with Ubuntu OS and Docker applications such as Suricata IDS and VigorConnect to enhance network security:

The Vigor3912S router supports Docker applications such as VigorConnect directly on the device. This capability simplifies network management by allowing VigorConnect to monitor DrayTek devices without requiring an additional computer. The installation process is straightforward and can be completed through the router’s web user interface (WUI) with just a few clicks. This feature provides a convenient and efficient solution for network administrators to oversee and manage their network infrastructure.

A popular open-source threat detection application for detecting and preventing a wide range of network threats.

The Vigor3912S is pre-installed with the Linux-based application Suricata, an open-source threat detection system that supports more than 60,000 rules, including 6,000+ CVE (Common Vulnerabilities and Exposures) rules, and it can detect and prevent a wide range of network threats, such as malware, network intrusions, denial-of-service attacks and data breaches.

Suricata, an intrusion detection system (IDS), monitors LAN and WAN traffic through the router. A log is generated if any unusual activity is detected, which can be sent to the network administrator via the router’s Web Notification function.

Blocking can be achieved with the “Smart Action” feature in the router.

This feature monitors network traffic and detect malicious activity in real time. Suricata works by analysing packets and comparing them to a set of rules to determine whether the traffic is legitimate. If it detects suspicious activity, it can raise an alarm. Suricata is highly customisable and can monitor many network environments, from small homes to large enterprise networks.

Statistical Graph

Suricata Statistical Graph presents the timing and frequency of threats. When the mouse hovers over the point representing the most frequent threat, a small menu will pop up to display the number of occurrences of that threat. Additionally, a click on the item will display more details that are crucial for security enhancement.

Notifications via Smart Action

When Suricata detects a threat, the Vigor3912S can alert administrators through Smart Action using the following methods:

• Web Notification – Alerts are displayed directly within the router’s web interface, ensuring administrators see notifications immediately upon login.
• Telegram Notification – Alerts can be delivered to a designated Telegram account, enabling real-time notifications on mobile devices.

These notification options ensure that administrators are promptly informed of potential security threats, allowing faster incident response and improved network protection.

Auto-Blocking with Smart Action

When Suricata detects a network threat, Smart Action can automatically apply advanced filtering and blocking rules. Administrators define specific threat-related keywords in the Smart Action profile. If an event detected by Suricata matches one of these predefined keywords, the Vigor3912S will immediately block the associated IP address.

This proactive and automated response mechanism strengthens network security by mitigating threats in real-time without requiring constant manual intervention from administrators.

NAT throughput (1.9x times faster)

IPSec throughput
(2.1 times faster)

SSL-VPN throughput
(2.9 times faster)

Wireguard throughput
(3.2 times faster)

**bi-directional(TX+RX) performance

Enhance overall network performance with optimised data packet processing and forwarding. This feature improves network efficiency by improving transmission speed, and enhances user experience by minimising network latency, making it ideal for real-time applications such as large file transfers and voice calls.

High Performance with 10Gb SFP+

For both NAT and routing network, and for both 10Gb-WAN and 10Gb-LAN, Vigor3912 is ready to deliver high throughput to your business.

Layer 3 Routing with BGP and OSPF

With the most popular Exterior and Interior Gateway Protocols, Vigor3912 is ideal for ISP deployment.

Layer 2 Security with PPPoE Server and VLAN

With 200 PPPoE user accounts and 100 VLAN/LAN subnets, the Vigor3912 provides 15.6 Gbps (bi-directional; TX+RX) NAT throughput, making network infrastructure segmentation secure and easy.

12 Ports in total

8 ports from a total of 12 ports, can be configured as either a LAN port or a WAN interface. For example, the following port options are achievable:

• 8 x WAN interfaces and 4 x LAN Ports or
• 1 x WAN interface and 11 LAN Ports

For organisations that host multiple servers in their network, a policy of server load balance can be configured, such that the router can distribute the inbound NAT sessions evenly for the servers based on the configured load balance weight. This will avoid excessive load on a single server, prevent server failure due to overloading, and optimise resource usage.

VPN from LAN

This feature offers a more secure method for connecting to servers by restricting LAN clients’ access to LAN servers through a VPN only. This ensures that data transmission between LAN clients and servers is encrypted, protecting critical data and enhancing overall security.

VPN User Isolation

Activating a VPN connection to access a company’s internet for work has become a common routine for many employees.

Teleworkers need to connect to the company’s servers through VPN connections. However, it is often unnecessary for VPN users to access each other, which may pose security risks. By enabling the “Isolate VPN Users from each other” option, you can ensure that each VPN user is isolated and the VPN network is more secure.

2FA with AD/LDAP Server

Enhance the security of remote dial-in VPN connections with two-factor authentication integrated with AD/LDAP servers. DrayTek offers various authentication methods, including TOTP, email, SMS, and URL links. This approach not only adds an extra layer of security but also helps reduce costs associated with SMS messages and official authentication system license fees.

Packet Capture Tool for VPN Tunnel

By either mirroring all packets to a designated LAN port or VPN connection, whether LAN to LAN profiles or remote Dial-in users, or even downloading PCAP files via WUI remotely, spotting an issue is easier than ever.

Secure Router Management Access

• Allow router management access only after a successful knock sequence or through a secure internal server
• Completely eliminate direct exposure of the management interface to the open internet

VPN Service Control (WAN Binding)

• Keep VPN services invisible until the correct knock sequence is received
• Bind VPN availability to specific WAN interfaces and authorised IP addresses

How It Works

• By default, all protected ports remain closed and undetectable
• After the correct knock sequence is received, selected ports open temporarily for authorised access
• Once the configured time window expires, services automatically return to hidden mode

With DrayTek Port Knocking, your network operates in stealth mode, invisible to attackers yet instantly accessible to authorised administrators and remote users. It is the ideal solution for organisations that demand high-level security without compromising accessibility.

Auto-Discovery

Automatically discover LAN subnets and add detected VigorSwitches/APs into the managed list.

Provisioning

Most-frequently used settings can be pre-defined on the Vigor Router, which can then be provisioned to the managed VigorSwitch/AP.

Monitoring

Vigor Routers provide a centralised view of managed devices so you can always check if the managed Vigor Switch/AP is online.

System Maintenance

Support basic maintenance remotely via Vigor Router, such as remote reboot, factory reset, configuration backup/restore.