Vigor2928 Series

(be model)

*Only two of these ports can be active at the same time, and P2 & P3 cannot both act as WAN

10 Gigabit Multi-WAN VPN Firewall Router

10G for Next-Gen Connectivity

The Vigor2928 Series is a Multi-WAN VPN router with high-speed 10G connectivity through three versatile interfaces. It features VPN, QoS, route policy, web content filtering, a hotspot web portal, and more.
The series includes a model with built-in 802.11be that offers Wi-Fi 7 features such as Multi-Link Operation (MLO) and Multiple Resource Units (MRU). It is ideal for companies that need high-performance 10G connectivity and an efficient network.

Multiple 10G WAN Load Balancing

WAN Load Balancing

The Vigor2928 Series delivers high throughput with load balancing, making it ideal for fiber and 10 Gigabit internet. All active WAN interfaces join the Load Balance Pool to make the best use of available bandwidth.

Seamless Failover

Automatic WAN failover keeps your internet connection running during ISP outages, minimizing downtime and the costs that come with it.

Policy-Based Routing

Routing policies let you assign specific WAN interfaces to applications, VoIP, or traffic based on source or destination, improving network efficiency and performance.

Effortless Secure Access with EasyVPN

Setting up a traditional VPN can be complicated, with protocols to choose and settings to configure by hand. The Vigor2928 Series supports IPsec, WireGuard, and OpenVPN, and EasyVPN simplifies Teleworker VPN: remote users get secure access just by importing a profile.

EasyVPN lets users set up secure connections without the hassle of:

• Generating WireGuard keys
• Importing OpenVPN configuration files
• Uploading certificates

Because EasyVPN automates these steps, every user gets a fast, secure, and easy VPN experience.

Identity and Access Management (IAM)

The Vigor2928 Series, running the new DrayOS 5, is Zero Trust ready.

Precise Device Authentication

Each device’s unique IP and MAC address provides a solid basis for identification and authentication.

Role-Based Access Control

IAM assigns access permissions based on user roles, so the IT team can manage high-security access by department, authority level, and responsibilities.

Holistic Security

Combining user-, device-, and session-based policies strengthens security without relying on any single factor.

Enhanced Incident Response

When a security incident occurs, you can quickly pinpoint the devices involved and take appropriate action.

IAM—Hotspot Web Portal

Vigor2928 Series with the new DrayOS 5 is Zero Trust ready!

IAM Integration with Hotspot Web Portal

The Vigor2928 Series running DrayOS 5 provides built-in IAM and advanced security features, so it is ready for Zero Trust deployments.

Various Authentication Types

It supports a variety of login methods to meet business needs, including Click Through, IAM User Login, and external RADIUS authentication.

Adaptive Access Control

Hotspot offers simple but powerful tools, including quota and bandwidth control, per-subnet or per-SSID policies, server bypass options, session timeouts, and MAC binding, giving guests seamless access without disrupting internal services.

WiFi Marketing

Redirect hotspot guests to your company homepage, online surveys, or promotional messages to build brand engagement and customer interaction.

URL Reputation

URL Reputation is a cloud-based Threat Intelligence Service that adds an extra layer of security for LAN clients during their online activities.

It offers 82 categories in total, 10 of them security-focused, to provide comprehensive, up-to-date protection for your home or office network.

The categories span network security (including malware, spyware, and adware), parental controls for child protection, business, social networking, and more. Together they help keep the online environment safe, boost employee productivity, and support efficient bandwidth management.

IP Reputation

Every internet communication involves two IP addresses: a source and a destination. Cybercriminals often use known malicious IP addresses to launch attacks with techniques such as:

• Botnets
• TOR nodes and anonymous proxies
• Command-and-control (C2) servers
• Phishing servers
• DDoS attacks

Blocking communication with these harmful IPs is essential, but it takes dynamic, predictive intelligence—something static blocklists can’t provide. The IP Reputation Service solves this by scoring and classifying IP addresses in real time, so it can automatically block:

• High-risk traffic
• Suspicious proxies
• Malware distributors
• IPs linked to recent malicious behavior

The system evaluates each IP against multiple criteria, including infection history, protocol usage, and attack frequency. Each IP receives a reputation score that determines whether it is trusted, monitored, or blocked outright.

Threat Protection Guardian AI-assisted Firewall

Up to 200 LAN Devices • Multi-Layer Defense • Cloud-Enhanced Security

Unified Protection

Router Protection

• Anti-DoS/DDoS, Port Scan Blocker, Brute Force Defense, IP/URL Reputation

Network Protection

• Device fingerprinting, anomaly detection, auto-quarantine of risky devices

IoT / Unmanaged Device Security

• DPI virtual hot patching, exploit prevention, command injection blocking

Web Protection

• Safe Browsing, Category Filtering, Service Filtering, user-assigned policy

Cloud-Driven Intelligence

• Real-time threat analytics
• Updated malicious IP/URL lists
• Centralized reports & event visibility

*Note: URL/IP Reputation and Threat Protection cannot be enabled at the same time; each router can run only one of these services.

Wi-Fi 7 Capacity

Wi-Fi 7 with advanced Multi-Link Operation (MLO) lets devices use the 2.4 GHz, 5 GHz, and 6 GHz bands simultaneously, unlike traditional Wi-Fi, which can transmit data on only one band at a time. The result is faster speeds, lower latency, and more reliable connections.

By improving speed and reliability and reducing latency, MLO greatly benefits business applications such as video conferencing, large file transfers, and business-critical platforms, because it reduces congestion and keeps connections more stable.

Wi-Fi 7

Wi-Fi 6

Multiple Resource Units (MRU) enhances the OFDMA technology first introduced in Wi-Fi 6. In Wi-Fi 6, each client is limited to a single Resource Unit (RU), which can leave parts of the channel bandwidth unused. Wi-Fi 7 MRU removes this restriction by letting clients use multiple RUs at once, for more efficient use of the spectrum. With more of the available spectrum in active use, overall throughput rises and latency drops.

Wi-Fi 7

Wi-Fi 6

Zero-Wait DFS lets a Wi-Fi router monitor DFS channels for radar signals without interrupting service. The router has a dedicated 5G antenna for Zero-Wait DFS, so it can detect radar independently while maintaining active communication. When it detects radar interference, the router can quickly switch to a standby block that has already passed the CAC.

In the example below, the wireless device operates on an 80 MHz block (Channels 52, 56, 60, 64). When radar is detected on Channel 64, DFS rules require the device to vacate the entire block. With Zero-Wait DFS, a standby block (Channels 100, 104, 108, 112) is already prepared, so the router can switch instantly and keep service running smoothly.

Stealth Security Protection with Port Knocking

DrayTek’s Port Knocking technology adds an advanced stealth layer of security by hiding critical network services from unauthorized users. Instead of exposing management ports or VPN services to the public internet, Port Knocking requires a predefined “knock” sequence before it grants access, so only trusted users can find and use these services.

Port Knocking combines three key functions to deliver strong protection against port scanning, brute-force attacks, and unauthorized access.

Port Redirection

• Hide your real service ports from the public internet.
• Redirect unauthorized requests to non-existent services, preventing detection.

Router Management Access

• Allow router management only through a secure internal server or after successful knocking.
• Eliminate exposure of the management interface to the open internet.

VPN Service Control (WAN Binding)

• Keep VPN services invisible and inaccessible until the correct knock sequence is received.
• Bind VPN availability to specific WAN interfaces and authorized IP addresses.

How It Works

• In normal state, all targeted ports remain closed and undetectable.
• After the correct knock sequence, selected ports open temporarily for authorized access.
• Once the time window expires, services return to hidden mode automatically.

With DrayTek Port Knocking, your network runs in stealth mode: invisible to attackers, yet instantly available to authorized administrators and remote users. That makes it an ideal solution for organizations that need high security without giving up accessibility.

Management Solution

Virtual Controller

On-Device Network Management with DrayTek Virtual Controller

DrayTek’s Virtual Controller is a management platform built into supported routers and firewalls. It provides centralized control without depending on the cloud, which reduces data exposure risk and improves network privacy.

Wireless Management

• Mesh Controller: Easily build and manage wireless mesh networks, with auto-routing and self-healing capabilities.
• AP Management (APM): Automatically discover, configure, and monitor connected VigorAPs – ideal for deploying multiple APs with unified settings.

Switch Management

• Central Switch Manager (SWM): Detect and manage supported VigorSwitches, push configurations, monitor status, and apply VLAN or QoS settings – all from one local interface.

Wireless

Switch

Unified Mesh & AP Management

Virtual Controller offers two modes for flexible deployment.

Mesh Mode

Automatically builds a self-healing wireless mesh, with the Vigor2928 Series as the Root AP and up to 7 Node APs, for easy, scalable Wi-Fi coverage.

AP Management Mode

In networks with more than 8 APs, Virtual Controller switches to AP Management mode, so you can centrally control up to 20 APs from the router’s interface.

SWM

The Vigor2928 Series can act as the master to manage and monitor up to 10 switches. It also gives you visibility into the PD devices connected behind each switch, such as IP cameras and access points.

Device Management

Monitor switch status, current firmware version, and uptime for every managed device.

Port Profile

Create multiple port profiles to provision PoE, VLAN, QoS, and other settings on selected switches.

Maintenance

Back up and restore configurations, reboot switches remotely, or reset them to factory defaults.

Flexible 10G SFP+ Connectivity

Extend the Vigor2928 Series 10G SFP+ WAN with flexible connectivity options for both short- and long-distance deployments.
From equipment racks to campuses, factories, and large venues, choose the right 10G connection for each deployment.

Long-Distance Fiber

Pair it with the DAM-FX10-20K Series SFP+ Module to extend 10G Ethernet over single-mode fiber for up to 20 km.

Short-Distance DAC

Use the DAC-CX10 DAC Cable to connect directly to a VigorSwitch PX2060 or VigorSwitch PQ2300xb for short-distance 10G links within or between equipment racks.

Software Management

VigorACS 3

• Zero Touch Deployment & Provisioning
• Auto VPN
• Interface Quality & SLA
• VoIP Optimization & Monitoring
• Application Visibility
• Application Based SD-WAN Policy
  *Click here to check the support model list.
• Customized Hotspot Page with Multilingual
• Hotspot Clients Analytics
• ACS Server Load Balancing / Failover

View More

In the Box

• Vigor2928 Series
• Antenna x 2
  (be model)
• RJ-45 Cable (Ethernet)
• Power Adapter
• Quick Start Guide

Wireless

Unified Mesh & AP Management

Virtual Controller offers two modes for flexible deployment.

Mesh Mode

Automatically builds a self-healing wireless mesh, with the Vigor2928 Series as the Root AP and up to 7 Node APs, for easy, scalable Wi-Fi coverage.

AP Management Mode

In networks with more than 8 APs, Virtual Controller switches to AP Management mode, so you can centrally control up to 20 APs from the router’s interface.

Switch

SWM

The Vigor2928 Series can act as the master to manage and monitor up to 10 switches. It also gives you visibility into the PD devices connected behind each switch, such as IP cameras and access points.

Device Management

Monitor switch status, current firmware version, and uptime for every managed device.

Port Profile

Create multiple port profiles to provision PoE, VLAN, QoS, and other settings on selected switches.

Maintenance

Back up and restore configurations, reboot switches remotely, or reset them to factory defaults.