The Vigor2928 is a Dual-WAN VPN Security Router featuring three 10G interfaces for Ethernet and fiber connectivity. Built for Multi-Gig and Wi-Fi 7 networks, it delivers high-performance networking, advanced VPN capabilities, and centralized management through Virtual Controller. Its 10G architecture enables the key benefits of Wi-Fi 7, including higher throughput, lower latency, and improved connectivity for more devices.
With support for DrayTek VigorShield services, including URL/IP Reputation and Threat Protection, the Vigor2928 leverages continuously updated cloud threat intelligence to help defend against evolving cyber threats, providing a future-ready platform for modern business networks.
10GbE WAN/LAN Switchable
10M/100M/1G/2.5G/10G Ethernet, RJ-45
10G SFP+
1G/10G SFP Slot
50 VPN
IPsec throughput up to 540 Mbps
60k Sessions
Recommended for a network of 50 hosts
(be model)
12x Wi-Fi Antenna (External)1x Wi-Fi Antenna (Internal)
2Reset Button
3LED Indicator
42x USB 2.0
5Fixed WAN Port: 1x GbE RJ-45
6Fixed WAN Port: 1x 10GbE SFP+*
7WAN/LAN Switchable Port: 1x 10GbE RJ-45*
8Fixed LAN Port: 1x 10G SFP+*
9Fixed LAN Port: 1x 2.5GbE RJ-45
10Fixed LAN Port: 3x GbE RJ-45
11Power On/Off Switch
12Power Input
*Only two of these ports can be active at the same time, and P2 & P3 cannot both act as WAN
Key Features
Wi-Fi 7 (be model only)
Features enhanced OFDMA and Multi-Link Operation (MLO) technologies to improve wireless efficiency and performance.
10G SFP+
Supports 10G-capable fiber SFP+ ports for high-speed fiber WAN or LAN connectivity.
10GbE
Provides ultra-fast 10G connectivity to meet the needs of high-demand network.
2.5GbE
Provides higher performance to Wi-Fi 6 AP and other Ethernet devices.
Load Balancing
Maximize throughput and reliability by using multiple Internet connections. Learn more
Bandwidth Management
Prevent one device using all the bandwidth by bandwidth limit policy, session limit policy, and QoS settings.
DrayDDNS
The free DDNS service for you to access the router by a fixed hostname of your choice. Learn more
VPN (Virtual Private Network)
Build a secure and private tunnel from the LAN of Vigor2928 Series to the remote offices and teleworkers over the Internet. Learn more
EasyVPN
Secure VPN in Seconds: No Keys, No Configs, Just Login.
Firewall & Content Filter
Filter web pages by URL keyword or web category to block access to insecure or inappropriate contents.
URL/IP Reputation
Improve network security by classifying URLs and IPs to control web access and protect against online threats. Learn more
Port Knocking
Add a stealth security layer to protect ports from unauthorized access.
IAM
A solution that manages digital identities, authentication, and access control to ensure the right users or groups have appropriate access to critical resources. Learn more
Threat Protection
Detect and mitigate cyber threats with cloud-assisted threat intelligence, helping protect users, devices, and networks from malicious activities. Learn more
Hotspot Web Portal
Market your business and communicate with the guests while offering hospitality WLAN. Learn more
Virtual AP/Switch controller
All-in-one management platform for Vigor2928 Series to maintain and monitor the VigorAPs and VigorSwitches.
Mesh (Wireless model only)
Easily link to other VigorAP to expand the wireless network. Learn more
Wireless WAN (be model only)
Get Internet access wirelessly from a wireless network, a mobile hotspot, or a personal hotspot set up on smartphones. Learn more
10 Gigabit Dual-WAN VPN Firewall Router
10G for Next-Gen Connectivity
Vigor2928 Series is a Dual-WAN VPN Router with high-speed 10G connectivity through three versatile interfaces.
Featuring VPN, QoS, route policy, web content filtering, hotspot web portal, and more.
The series includes built-in 802.11be model which offers Wi-Fi 7 feature such as Multi-Link Operation (MLO) and Multiple Resource Units (MRU).
It is ideal for companies that require high-performance 10G connectivity with an efficient network.
*VPN acceleration future supported
Multiple 10G WAN Load Balancing
WAN Load Balancing
Vigor2928 Series offers high throughput with load balancing, ideal for fiber and 10 Gigabit Internet. All active WAN interfaces join the Load Balance Pool to optimize bandwidth utilization.
Seamless Failover
Supports automatic WAN failover to maintain seamless internet connectivity during ISP outages, minimizing downtime and associated costs.
Policy-Based Routing
Routing policies allows user to assign specific WAN interfaces to applications, VoIP, or traffic by source or destination, enhancing network efficiency and performance.
Effortless Secure Access with EasyVPN
Traditional VPN setup can be complex, with protocol choices and manual configuration. Vigor2928 Series supports IPsec, WireGuard, and OpenVPN, while EasyVPN streamlines Teleworker VPN, giving remote users secure access with a simple profile import.
With EasyVPN, users can establish secure connections without the hassle of:
- Generating WireGuard keys
- Importing OpenVPN configuration files
- Uploading certificates
By automating these steps, EasyVPN ensures a fast, secure, and user-friendly VPN experience for everyone.
Identity and Access Management (IAM)
Vigor2928 Series with the new DrayOS 5 is Zero Trust ready!
Precise Device Authentication
Using each device’s unique IP and MAC address provides a solid basis for identification and authentication.
Role-Based Access Control
IAM assigns access permissions based on user roles. IT team can manage high-security access according to department, authority level, and responsibilities.
Holistic Security
Combining user, device, and session-based policies strengthens security without relying on a single factor.
Enhanced Incident Response
When security incidents occurs, you can quickly pinpoint the devices involved and take appropriate actions.
IAM—Hotspot Web Portal
Vigor2928 Series with the new DrayOS 5 is Zero Trust ready!
IAM Integration with Hotspot Web Portal
Vigor2928 Series running DrayOS 5 provides built-in IAM and advanced security features, making it ready for Zero Trust deployments.
Various Authentication Types
A variety of login methods are supported to meet business need, including Click Through, IAM User Login, and external RADIUS authentication.
Adaptive Access Control
Hotspot offers simple yet powerful tools such as quota and bandwidth control, per-subnet or SSID policies, server bypass options, session timeout, and MAC binding—ensuring seamless guest access without disrupting internal services.
WiFi Marketing
Redirect hotspot guests to the company homepage, online surveys, or promotional messages for brand engagement and customer interaction.
URL Reputation
URL Reputation is a cloud-based technology to provide Threat Intelligence Service. This service adds an extra layer of security protection to LAN client for their online activities.
There are 82 categories in total, 10 of which are security-focused, providing comprehensive and up-to-date protection to your home network or office network.
The various categories cover network security, including malware, spyware, adware, parental control for child protection, business, social networking, and more to ensure a safe online environment while also boosting employee productivity and can reach efficient bandwidth management.
IP Reputation
Every communication over the internet involves IP addresses-source and destination. Cybercriminals often leverage known malicious IP addresses to carry out attacks using techniques like:
- Botnets
- TOR nodes and anonymous proxies
- Command-and-control (C2) servers
- Phishing servers
- DDoS attacks
Blocking communication with these harmful IPs is essential, but it requires dynamic, predictive intelligence-a challenge that static blocklists cannot meet. The IP Reputation Service solves this by providing real-time scoring and classification of IP addresses, enabling automatic blocking of:
- High-risk traffic
- Suspicious proxies
- Malware distributors
- IPs linked to recent malicious behavior
The system evaluates IPs across multiple criteria, including infection history, protocol usage, and attack frequency. Each IP is given a reputation score, which determines whether it should be trusted, monitored, or blocked outright.
Wi-Fi 7 Capacity
Wi-Fi 7 with advanced Multi-Link Operation (MLO) allows devices to leverage the 2.4 GHz, 5 GHz, and 6 GHz bands simultaneously, unlike traditional WiFi, which can only transmit data on a single band at a time. This enables faster speeds, lower latency, and more reliable connections.
MLO improves speed, reliability, and reduces latency, which significantly benefits business applications such as video conferencing, large file transfers, and business-critical platforms, as it reduces congestion and ensures a more stable connection.
Wi-Fi 7
Wi-Fi 6
Multiple Resource Units (MRU) enhances the OFDMA technology first introduced in WiFi 6. In WiFi 6, each client is limited to a single Resource Unit, which may leave portions of the channel bandwidth underutilized. With WiFi 7 MRU, clients can be assigned multiple RUs concurrently, eliminating this restriction and enabling more efficient spectrum utilization. This ensures that more of the available spectrum is actively used, resulting in higher overall throughput and lower latency.
Wi-Fi 7
Wi-Fi 6
Zero-Wait DFS allows WiFi router to monitor radar signals on DFS channels without interrupting service. The wireless router features a dedicated 5G antenna for Zero-Wait DFS, enabling it to detect radar signals independently while maintaining active communication. When radar interference is detected, the router can quickly switch to a standby block that has already passed the CAC.
In the example below, the wireless device is operating on an 80 MHz block (Channels 52, 56, 60, 64). Once radar is detected on Channel 64, DFS rules require the entire block to be vacated. With Zero-Wait DFS, a standby block (Channels 100, 104, 108, 112) is ready, so the router can instantly switch, ensuring smooth service.
Stealth Security Protection with Port Knocking
DrayTek’s Port Knocking technology provides an advanced stealth security layer by keeping critical network services invisible to unauthorized users. Instead of exposing management ports or VPN services to the public internet, Port Knocking requires a predefined “knock” sequence before granting access, ensuring that only trusted users can find and use these services.
By integrating three key functions, Port Knocking delivers unmatched protection against port scanning, brute-force attacks, and unauthorized access
Port Redirection
- Hide your real service ports from the public internet.
- Redirect unauthorized requests to non-existent services, preventing detection.
Router Management Access
- Allow router management only through a secure internal server or after successful knocking.
- Eliminate exposure of the management interface to the open internet.
VPN Service Control (WAN Binding)
- Keep VPN services invisible and inaccessible until the correct knock sequence is received.
- Bind VPN availability to specific WAN interfaces and authorized IP addresses.
How It Works
- In normal state, all targeted ports remain closed and undetectable.
- After the correct knock sequence, selected ports open temporarily for authorized access.
- Once the time window expires, services return to hidden mode automatically.
With DrayTek Port Knocking, your network operates in stealth mode, invisible to attackers, yet instantly accessible to authorized administrators and remote users. This makes it an ideal solution for organizations demanding high security without sacrificing accessibility.
Management Solution
Virtual Controller
On-Device Network Management with DrayTek Virtual Controller
DrayTek's Virtual Controller is an on-device management platform built into supported routers and firewalls. It enables centralized control without cloud dependency - reducing data exposure risks and enhancing network privacy.
Wireless Management
- Mesh Controller: Easily build and manage wireless mesh networks, with auto-routing and self-healing capabilities.
- AP Management (APM): Automatically discover, configure, and monitor connected VigorAPs - ideal for deploying multiple APs with unified settings.
Switch Management
- Central Switch Manager (SWM): Detect and manage supported VigorSwitches, push configurations, monitor status, and apply VLAN or QoS settings - all from one local interface.
Unified Mesh & AP Management
Virtual Controller supports two modes for flexible deployment.
Mesh Mode
Automatically creates a self-healing wireless mesh with the Vigor2928 Series as the Root AP and up to 7 Node APs for easy, scalable Wi-Fi coverage.
AP Management Mode
For networks with more than 8 APs, Virtual Controller switches to AP Management mode, enabling centralized control of up to 20 APs via the router's interface.
Seamless Mesh Role Assignment
Devices power on and automatically discover each other, assigning roles as Root or Node APs without manual setup. This auto device role assignment enables quick mesh network formation with optimized coverage and self-healing capabilities.
SWM
Vigor2928 Series can act as master to manage and monitor up to 10 switches. It also provides visibility into PD devices behind the switch, such as IP cameras and access points.
Device Management
Monitor switch status, current firmware version, and uptime across all managed devices.
Port Profile
Create multiple port profiles to provision the PoE, VLAN, QoS, and other settings to selected switches.
Maintenance
Perform configuration backup and restore, remote reboot, or factory reset.
Software Management
VigorACS 3
- Zero Touch Deployment & Provisioning
- Auto VPN
- Interface Quality & SLA
- VoIP Optimization & Monitoring
- Application Visibility
- Application Based SD-WAN Policy
*Click here to check the support model list. - Customized Hotspot Page with Multilingual
- Hotspot Clients Analytics
- ACS Server Load Balancing / Failover
In the Box
Antenna x 2
(be model)
RJ-45 Cable (Ethernet)
Power Adapter
Quick Start Guide
Note: The stated throughput performance figures are the maximum derived from DrayTek internal testing, conducted under optimal conditions, with Hardware Acceleration enabled where available. The actual performance may vary based on network conditions and activated applications.
