V. VPN (Virtual Private Networking)

Vigor 3900 to Vigor 2860 LAN-to-LAN IPsec VPN Configuration Guide

Vigor 2620Ln
Vigor 2760
Vigor 2762
Vigor 2765
Show all


A LAN-to-LAN Virtual Private Network (VPN) connection links two private networks to allow traffic to route directly between them in a private and secure manner while passing through the internet, which could otherwise be susceptible to eavesdropping or tampering.

This guide will demonstrate how to configure a Vigor 3900 or Vigor 2960 router to create a secure IPsec VPN tunnel with a Vigor 2860 or other DrayOS router.

This setup guide will demonstrate how to configure the VPN tunnel for Static IPs (Main Mode) or Dynamic IP(s) (Aggressive Mode)

Static IP - Main Mode

An IPsec Main Mode VPN tunnel requires that both ends of the VPN have fixed IP addresses, the table below shows the setup details required for the VPN connection between the London router, which will be set up with a Dial-In connection and the Liverpool router which will be set up with a Dial-Out connection:




LAN Address

LAN Subnet Mask

Router's Address

Public IP Address


VPN Profile Name



Call Direction




IPsec only

IPsec only

Pre-Shared Key



Dial In VPN - London Router:

Go to [VPN and Remote Access] > [VPN Profile] and click Add to create a new profile, select the Basic tab:

  • Give the Profile a suitable name, please note that this cannot be changed after clicking Apply to save the VPN profile for the first time
  • Configure the Dial-Out Through option with the correct WAN interface and if necessary Alias IP address so that the router allows this VPN connection on that WAN interface or IP address
  • Set the Local IP / Subnet Mask with the local network address, in this example, the router IP is, this needs to be entered as the Network address which for the 192.168.1.x network with a /24 subnet mask, would be, the subnet mask specified should be the same as the subnet mask specified in the LAN configuration
  • Specify the Remote Host as the WAN IP address of the other router, in this example, the WAN IP of the remote side is
  • Set the Remote IP/ Subnet Mask with the remote network's Network address, in this example that is with a subnet mask of
  • Set the IKE Phase 1 setting to Main Mode
  • Set the Auth Type to PSK
  • Enter the Preshared Key for the connection and ensure that this is the same for both routers
  • Set the Security Protocol to ESP, which gives an encrypted and authenticated VPN tunnel. If this is set to AH mode, the VPN tunnel will be authenticated (to ensure packets are not tampered with), but will not be encrypted

The VPN profile is ready to use with just the Basic tab configured. The setup of the Advanced and Proposal tabs is provided for additional reference information and other setup options.

Go to the Advanced tab, which has additional settings for the VPN:

  • The Phase1/2 Key Life Time settings should be left on their default values
  • The Dead Peer Detection Status option enables or disables Dead Peer Detection, which is necessary for an IPsec VPN connection to determine whether it can pass traffic or not, this should be set to Enable with its default values. On high latency connections, increasing the values here can help with VPN stability
  • Ping to Keep Alive, when enabled, will need a target IP address configured. This will ping the target IP, which should be an IP address accessible only through the VPN connection i.e. a remote server or the remote router IP. If the IP fails to respond, the router will re-start the VPN connection
  • Route / NAT Mode should be left in Route mode for this example, NAT mode would give a one-way connection and should usually only be used for connecting to remote teleworker VPN connections
  • Apply NAT Policy is covered in this guide
  • Netbios Naming Packet allows Netbios packets (using by Windows networking for network computer discovery) to pass across the VPN tunnel. This can be set to Enable to match other DrayTek (DrayOS) routers
  • Multicast via VPN allows Multicast packets to be passed through the VPN tunnel
  • RIP via VPN allows RIP (Routing Information Protocol) to go through the VPN, if that is in use on the local or remote router's network

Go to the Proposal tab, which has the IPsec protocol options available:

These settings can be left on their defaults, the VPN will use 3DES Encryption with SHA1 Authentication by default.

The [Dial-Out] proposal settings specified here control which protocols are used in a proposal when dialling out, so are not used for this side of the VPN.

The [Dial-In] setting controls which protocols are allowed; this can be left on its default setting of "acceptall". If this is set to "acceptabove", it will only allow IPsec connections using the protocols specified in the [Dial-Out] settings above.

Click Apply on that VPN profile to save and apply it.

Dial-Out VPN – Liverpool Router:

This needs to be configured as a Dial-Out VPN connection to initiate the connection with the London router. Go to [VPN and Remote Access] > [LAN to LAN] and select the first un-used profile.
On that page, configure the Common Settings like so:

This needs to be Enabled, configured as a Dial-Out VPN and the Always on tickbox will need to be ticked so that the VPN is always active.

The next step is to configure the Dial-Out Settings of the VPN tunnel:

  1. Set the Type of VPN to IPsec Tunnel

  2. Set the Server IP/Host Name for VPN to the address of the VPN server, in this example, London is

  3. Set the Pre-Shared Key to the key required for the VPN tunnel, this can be entered directly or by clicking the IKE Pre-Shared Key button to enter it twice so that it can be validated

  4. Set the IPsec Security Method to High(ESP) and select 3DES with Authentication from the drop-down list

The IP address details for the VPN then need to be configured under TCP/IP Network Settings:

  1. The My WAN IP and Remote Gateway IP fields should be left blank

  2. Specify the Network Address of the remote network under Remote Network IP and configure the subnet if required

  3. Ensure that the Local Network IP details are correct, these are pre-set and should not need changing generally but if the local router has multiple subnets, this could be changed to the subnet that will be used for the VPN tunnel

Click OK on that VPN profile to save and apply it.

Once both sides of the VPN have been configured, if all of the details are correct and the routers are able to contact each other without issue, the VPN should establish, this can be checked from [VPN and Remote Access] > [Connection Management], which will show the VPN listed in the status window:

How do you rate this article?

1 1 1 1 1 1 1 1 1 1