Vigor 3912 Series

*bi-directional(TX+RX) performance

*WAN/LAN Switchable

High Performance 10G Router*

Quad-Core CPU

Delivers 15.6 Gbps of NAT throughput (bi-directional).

*bi-directional(TX+RX) performance

Flexible WAN & LAN Port

12 Ports in total

Eight ports can be configured as either LAN or WAN, allowing up to:

• 8 WAN interfaces with 4 LAN Ports or
• 1 WAN interface with 11 LAN Ports

Advanced VPN Features

VPN from LAN (Zero Trust)

Never trust, always verify. VPN from LAN puts Zero Trust into practice. It raises the security level of your network by protecting vital servers from potential threats posed by other LAN devices: even devices on the LAN can reach the servers only through a VPN.

VPN User Isolation

Remote dial-in accounts are isolated from one another to protect VPN users. Each user can reach the company’s servers but not other users’ devices. This helps prevent unauthorized access to sensitive data and protects the network from malware and other intrusions.

VPN 2FA on AD/LDAP Server

New Two-Factor Authentication strengthens the security of VPN connections cost-effectively, with no SMS charges or license fees.

Packet Capture Tool for VPN tunnel

Troubleshooting is easier than ever: mirror all packets to a designated LAN port, or now to a VPN connection (whether a LAN-to-LAN profile or remote dial-in users), and even download a .pcap file remotely through the WUI.

Server Load Balancing

Hosting multiple servers to share the traffic load for the same service is common practice. Distributing the load keeps any single server from being overloaded, optimizes resource usage, and helps prevent single-server failures.

With Server Load Balance, when a large number of connections reach the router, it distributes the inbound NAT sessions among the servers according to the configured load-balance weights.

Stealth Security Protection with Port Knocking

DrayTek’s Port Knocking technology adds an advanced stealth layer of security by keeping critical network services invisible to unauthorized users. Rather than exposing management ports or VPN services to the public internet, Port Knocking requires a predefined “knock” sequence before granting access, so only trusted users can find and use these services.

By integrating three key functions, Port Knocking provides strong protection against port scanning, brute-force attacks, and unauthorized access.

Port Redirection

• Hide your real service ports from the public internet.
• Redirect unauthorized requests to non-existent services, preventing detection.

Router Management Access

• Allow router management only through a secure internal server or after successful knocking.
• Eliminate exposure of the management interface to the open internet.

VPN Service Control (WAN Binding)

• Keep VPN services invisible and inaccessible until the correct knock sequence is received.
• Bind VPN availability to specific WAN interfaces and authorized IP addresses.

How It Works

• In normal state, all targeted ports remain closed and undetectable.
• After the correct knock sequence, selected ports open temporarily for authorized access.
• Once the time window expires, services return to hidden mode automatically.

With DrayTek Port Knocking, your network runs in stealth mode: invisible to attackers, yet instantly accessible to authorized administrators and remote users. That makes it an ideal solution for organizations that need high security without sacrificing accessibility.

Linux Applications 3912S Only

• VigorConnect
• Suricata
• Applications on Ubuntu

Linux Application VigorConnect

*S Model Only

The Vigor3912S router supports Docker, so you can install and run the VigorConnect server directly on the device. This simplifies network management, because the VigorConnect server can monitor DrayTek devices without an additional computer. Installation is straightforward and takes just a few clicks in the router’s web user interface (WUI). It gives network administrators a convenient, efficient way to oversee and manage their network infrastructure.

Linux Application Suricata

*S Model Only

Well-known open-source threat detection software that effectively detects and prevents a wide range of network threats.

Suricata is an open-source threat detection system. It supports more than 60,000 rules, including 6,000+ CVE rules, and detects and prevents a wide range of network threats, such as malware, network intrusions, denial-of-service attacks, and data breaches.

The Vigor3912S supports the Suricata Linux application, so you can install this powerful software and use it to protect your network.

image source : https://suricata.io/

Suricata Features

*S Model Only

Statistical Graph

The Suricata Statistical Graph shows clearly which threats occur most frequently. Hovering the mouse over the point for the most frequent threat opens a small pop-up showing how many times it has occurred. The points are also clickable: clicking one opens a detailed view (shown in the second image) with more comprehensive information.

Notifications by Smart Action

When Suricata detects threats, the Vigor3912S can notify the admin through Smart Action using the following methods:

• Web Notification: Notifications are displayed directly on the router’s web user interface , allowing admins to see alerts when they log in.
• Telegram by Smart Action: Notifications can be sent to a designated Telegram account, ensuring that admins receive alerts in real-time on their mobile devices.

These methods keep admins promptly informed of potential threats, so they can respond faster to network security issues.

Auto Blocking by Smart Action

Suricata detects network threats, and Smart Action can carry out advanced filtering and blocking. Admins define keywords related to specific network threats in a Smart Action Profile. When Suricata detects a threat that matches one of these keywords, the Vigor3912S automatically blocks the associated IP address.

This enables proactive, automated threat mitigation, improving network security without constant manual intervention.

In the Box

• Vigor3912 Series
• Rack Mount Kit (brackets)
• Console Connector + Console Flat Cable
• RJ-45 Cable (Ethernet)
• Power Cord
• Quick Start Guide