Handleiding Draytek Vigor 2133 series (pagina 687 van 706) (Engels)

Vigor2133 Series User’s Guide

ii

Vigor2133 Series

Gigabit Broadband Router

User’s Guide

Version: 1.2

Firmware Version: V3.8.8

(For future update, please visit DrayTek web site)

Date: April 24, 2018

Vigor2133 Series User’s Guide

iii

Copyrights

reproduced, transmitted, transcribed, stored in a retrieval system, or translated into any language without

written permission from the copyright holders.

Trademarks

The following trademarks are used in this document:

 Microsoft is a registered trademark of Microsoft Corp.

 Windows, Windows 95, 98, Me, NT, 2000, XP, Vista, 7 and Explorer are trademarks of Microsoft Corp.

 Apple and Mac OS are registered trademarks of Apple Inc.

 Other products may be trademarks or registered trademarks of their respective manufacturers.

Safety Instructions



Read the installation guide thoroughly before you set up the router.

 The router is a complicated electronic unit that may be repaired only be authorized and qualified personnel.

Do not try to open or repair the router yourself.

 Do not place the router in a damp or humid place, e.g. a bathroom.

 The router should be used in a sheltered area, within a temperature range of +5 to +40 Celsius.

 Do not expose the router to direct sunlight or other heat sources. The housing and electronic components

may be damaged by direct sunlight or heat sources.

 Do not deploy the cable for LAN connection outdoor to prevent electronic shock hazards.

 Keep the package out of reach of children.

 When you want to dispose of the router, please follow local regulations on conservation of the environment.

Warranty

 We warrant to the original end user (purchaser) that the router will be free from any defects in workmanship

or materials for a period of two (2) years from the date of purchase from the dealer. Please keep your

purchase receipt in a safe place as it serves as proof of date of purchase. During the warranty period, and upon

proof of purchase, should the product have indications of failure due to faulty workmanship and/or materials,

we will, at our discretion, repair or replace the defective products or components, without charge for either

parts or labor, to whatever extent we deem necessary tore-store the product to proper operating condition.

Any replacement will consist of a new or re-manufactured functionally equivalent product of equal value, and

will be offered solely at our discretion. This warranty will not apply if the product is modified, misused,

tampered with, damaged by an act of God, or subjected to abnormal working conditions. The warranty does

not cover the bundled or licensed software of other vendors. Defects which do not significantly affect the

usability of the product will not be covered by the warranty. We reserve the right to revise the manual and

online documentation and to make changes from time to time in the contents hereof without obligation to

notify any person of such revision or changes.

Be a Registered Owner

 Web registration is preferred. You can register your Vigor router via http://www.DrayTek.com.

Firmware & Tools Updates

 Due to the continuous evolution of DrayTek technology, all routers will be regularly upgraded. Please consult

the DrayTek web site for more information on newest firmware, tools and documents.

More update, please visit www.draytek.com.

Vigor2133 Series User’s Guide

iv

T

a

b

l

e

o

f

C

o

n

t

e

n

t

s

Part I Installation.................................................................................................................i

I-1 Introduction ................................................................................................................................... 1

I-1-1 Indicators and Connectors .................................................................................................. 2

I-2 Hardware Installation .................................................................................................................... 4

I-2-1 Installing Vigor Router ......................................................................................................... 4

I-2-2 Wall-Mounted Installation .................................................................................................... 5

I-2-3 Installing USB Printer to Vigor Router................................................................................. 6

I-3 Accessing Web Page.................................................................................................................. 13

I-4 Changing Password.................................................................................................................... 15

I-5 Dashboard................................................................................................................................... 16

I-5-1 Virtual Panel ...................................................................................................................... 17

I-5-2 Name with a Link............................................................................................................... 17

I-5-3 Quick Access for Common Used Menu ............................................................................ 18

I-5-4 GUI Map ............................................................................................................................ 19

I-5-5 Web Console..................................................................................................................... 20

I-5-6 Config Backup ................................................................................................................... 20

I-5-7 Logout................................................................................................................................ 21

I-5-8 Online Status..................................................................................................................... 21

I-5-8-1 Physical Connection ......................................................................21

I-5-8-2 Virtual WAN ...............................................................................23

I-6 Quick Start Wizard ...................................................................................................................... 24

I-7 Service Activation Wizard ........................................................................................................... 33

I-8 Registering Vigor Router............................................................................................................. 35

Part II Connectivity ..........................................................................................................37

II-1 WAN........................................................................................................................................... 38

Web User Interface.................................................................................................................... 39

II-1-1 General Setup .................................................................................................................. 39

II-1-1-1 WAN1.......................................................................................39

II-1-1-2 WAN3 (USB) ...............................................................................42

II-1-2 Internet Access................................................................................................................. 43

II-1-2-1 Details Page for PPPoE..................................................................44

II-1-2-2 Details Page for Static or Dynamic IP.................................................47

II-1-2-3 Details Page for PPTP/L2TP ............................................................50

II-1-2-4 Details Page for IPv6 – Offline.........................................................52

II-1-2-5 Details Page for IPv6 – PPP .............................................................52

II-1-2-6 Details Page for IPv6 – TSPC............................................................53

II-1-2-7 Details Page for IPv6 – AICCU ..........................................................55

II-1-2-8 Details Page for IPv6 – DHCPv6 Client ................................................56

II-1-2-9 Details Page for IPv6 – Static IPv6.....................................................58

II-1-2-10 Details Page for IPv6 – 6in4 Static Tunnel..........................................59

II-1-2-11 Details Page for IPv6 – 6rd ............................................................61

II-1-3 Multi-VLAN ....................................................................................................................... 63

II-1-4 WAN Budget..................................................................................................................... 67

Vigor2133 Series User’s Guide

v

II-1-4-1 General Setup ............................................................................67

II-1-4-2 Status ......................................................................................70

Application Notes....................................................................................................................... 71

A-1 How to configure IPv6 on WAN interface? ................................................71

II-2 LAN ............................................................................................................................................ 76

Web User Interface.................................................................................................................... 78

II-2-1 General Setup .................................................................................................................. 78

II-2-1-1 Details Page for LAN1 – Ethernet TCP/IP and DHCP Setup........................81

II-2-1-2 Details Page for LAN2 ~ LAN4..........................................................83

II-2-1-3 Details Page for IP Routed Subnet ....................................................85

II-2-1-4 Details Page for LAN IPv6 Setup.......................................................86

II-2-1-5 Advanced DHCP Options ................................................................90

II-2-2 VLAN ................................................................................................................................ 92

II-2-3 Bind IP to MAC................................................................................................................. 95

II-2-4 LAN Port Mirror................................................................................................................. 99

II-2-5 Wired 802.1x .................................................................................................................. 100

II-3 Hardware Acceleration............................................................................................................. 101

II-4 NAT .......................................................................................................................................... 103

Web User Interface.................................................................................................................. 104

II-4-1 Port Redirection.............................................................................................................. 104

II-4-2 DMZ Host ....................................................................................................................... 108

II-4-3 Open Ports ..................................................................................................................... 111

II-4-4 Port Triggering................................................................................................................ 114

II-4-5 ALG................................................................................................................................. 116

II-5 Applications...............................................................................................................................117

Web User Interface.................................................................................................................. 119

II-5-1 Dynamic DNS................................................................................................................. 119

II-5-2 LAN DNS / DNS Forwarding .......................................................................................... 123

II-5-3 DNS Security.................................................................................................................. 126

II-5-3-1 General Setup .......................................................................... 126

II-5-3-2 Domain Diagnose ....................................................................... 126

II-5-4 Schedule......................................................................................................................... 128

II-5-5 RADIUS.......................................................................................................................... 131

II-5-6 UPnP .............................................................................................................................. 132

II-5-7 IGMP............................................................................................................................... 133

II-5-7-1 General Setting ........................................................................ 133

II-5-7-1 Working Group ......................................................................... 134

II-5-8 Wake on LAN ................................................................................................................. 135

II-5-9 SMS / Mail Alert Service................................................................................................. 136

II-5-9-1 SMS Alert ................................................................................ 136

II-5-9-2 Mail Alert ............................................................................... 137

II-5-10 Bonjour ......................................................................................................................... 138

Application Notes..................................................................................................................... 141

A-1 How to use DrayDDNS? ..................................................................... 141

A-2 How to Configure Customized DDNS?.................................................... 146

Vigor2133 Series User’s Guide

vi

II-6 Routing..................................................................................................................................... 150

Web User Interface.................................................................................................................. 151

II-6-1 Static Route.................................................................................................................... 151

II-6-2 Route Policy ................................................................................................................... 155

II-6-2-1 General Setup .......................................................................... 155

II-6-2-2 Diagnose................................................................................. 159

Application Notes..................................................................................................................... 162

A-1 How to set up Address Mapping with Route Policy? .................................. 162

Part III Wireless LAN......................................................................................................165

III-1 Wireless LAN (2.4 GHz/5 GHz) .............................................................................................. 166

Web User Interface.................................................................................................................. 170

III-1-1 Wireless Wizard............................................................................................................. 170

III-1-2 General Setup ............................................................................................................... 174

III-1-3 Security.......................................................................................................................... 176

III-1-4 Access Control .............................................................................................................. 178

III-1-5 WPS............................................................................................................................... 179

III-1-6 WDS .............................................................................................................................. 181

III-1-7 Advanced Setting .......................................................................................................... 184

III-1-8 Station Control............................................................................................................... 187

III-1-9 AP Discovery................................................................................................................. 187

III-1-10 Bandwidth Management.............................................................................................. 189

III-1-11 Airtime Fairness........................................................................................................... 190

III-1-12 Band Steering.............................................................................................................. 192

III-1-13 Roaming ...................................................................................................................... 196

III-1-14 Station List................................................................................................................... 197

Part IV VPN.....................................................................................................................199

IV-1 VPN and Remote Access ....................................................................................................... 200

Web User Interface.................................................................................................................. 201

IV-1-1 VPN Client Wizard ........................................................................................................ 201

IV-1-2 VPN Server Wizard....................................................................................................... 207

IV-1-3 Remote Access Control ................................................................................................ 211

IV-1-4 PPP General Setup....................................................................................................... 212

IV-1-5 IPsec General Setup..................................................................................................... 214

IV-1-6 IPsec Peer Identity........................................................................................................ 215

IV-1-7 Remote Dial-in User...................................................................................................... 217

IV-1-8 LAN to LAN ................................................................................................................... 220

IV-1-9 Connection Management.............................................................................................. 230

Application Notes..................................................................................................................... 231

A-1 How to Build a LAN-to-LAN VPN Between Remote Office and Headquarter via IPsec

Tunnel (Main Mode) ............................................................................. 231

IV-2 SSL VPN................................................................................................................................. 236

Vigor2133 Series User’s Guide

vii

Web User Interface.................................................................................................................. 237

IV-2-1 General Setup............................................................................................................... 237

IV-2-2 User Account................................................................................................................. 238

IV-2-3 Online User Status........................................................................................................ 242

IV-3 Certificate Management.......................................................................................................... 243

Web User Interface.................................................................................................................. 244

IV-3-1 Local Certificate ............................................................................................................ 244

IV-3-2 Trusted CA Certificate................................................................................................... 248

IV-3-3 Certificate Backup......................................................................................................... 250

Part V Security ...............................................................................................................251

V-1 Firewall..................................................................................................................................... 252

Web User Interface.................................................................................................................. 254

V-1-1 General Setup................................................................................................................ 254

V-1-2 Filter Setup..................................................................................................................... 259

V-1-3 DoS Defense.................................................................................................................. 270

V-1-4 Diagnose........................................................................................................................ 274

Application Notes..................................................................................................................... 277

A-1 How to Configure Certain Computers Accessing to Internet ........................ 277

V-2 Central Security Management (CSM)...................................................................................... 281

Web User Interface.................................................................................................................. 282

V-2-1 APP Enforcement Profile ............................................................................................... 282

V-2-2 URL Content Filter Profile .............................................................................................. 286

V-2-3 Web Content Filter Profile.............................................................................................. 290

V-2-4 DNS Filter Profile ........................................................................................................... 294

Application Notes..................................................................................................................... 296

A-1 How to Create an Account for MyVigor ................................................. 296

A-2 How to Block Facebook Service Accessed by the Users via Web Content Filter / URL

Content Filter.................................................................................... 304

Part VI Management ......................................................................................................311

VI-1 System Maintenance.............................................................................................................. 312

Web User Interface.................................................................................................................. 313

VI-1-1 System Status............................................................................................................... 313

VI-1-2 TR-069 .......................................................................................................................... 315

VI-1-3 Administrator Password................................................................................................ 318

VI-1-4 User Password.............................................................................................................. 320

VI-1-5 Login Page Greeting..................................................................................................... 323

VI-1-6 Configuration Backup.................................................................................................... 325

VI-1-7 Syslog/Mail Alert ........................................................................................................... 329

VI-1-8 Time and Date............................................................................................................... 332

VI-1-9 SNMP............................................................................................................................ 333

VI-1-10 Management ............................................................................................................... 335

Vigor2133 Series User’s Guide

viii

VI-1-11 Panel Control .............................................................................................................. 339

VI-1-12 Self-Signed Certificate ................................................................................................ 343

VI-1-13 Reboot System............................................................................................................ 345

VI-1-14 Firmware Upgrade ...................................................................................................... 346

VI-1-15 Activation..................................................................................................................... 347

VI-2 Bandwidth Management......................................................................................................... 349

Web User Interface.................................................................................................................. 351

VI-2-1 Sessions Limit............................................................................................................... 351

VI-2-2 Bandwidth Limit............................................................................................................. 353

VI-2-3 Quality of Service.......................................................................................................... 355

VI-2-4 APP QoS....................................................................................................................... 362

Application Notes..................................................................................................................... 364

A-1 How to Optimize the Bandwidth through QoS Technology .......................... 364

VI-3 Hotspot Web Portal................................................................................................................. 368

Web User Interface.................................................................................................................. 369

VI-3-1 Profile Setup.................................................................................................................. 369

VI-4-1-1 Login Modes............................................................................ 369

VI-4-1-2 Steps for Configuring a Web Portal Profile....................................... 372

Application Notes..................................................................................................................... 384

A-1 How to create Facebook APP for Web Portal Authentication? ...................... 384

A-2 How to create Google APP for Web Portal Authentication? ......................... 390

VI-4 Central Management (AP)...................................................................................................... 392

Web User Interface.................................................................................................................. 393

VI-4-1 Status............................................................................................................................ 393

VI-4-2 WLAN Profile................................................................................................................. 395

VI-4-3 AP Maintenance............................................................................................................ 400

VI-4-4 Traffic Graph ................................................................................................................. 401

VI-4-5 Load Balance ................................................................................................................ 402

VI-4-6 Function Support List.................................................................................................... 403

VI-5 Central Management (External Devices) ............................................................................... 404

VI-5-1 All Devices .................................................................................................................... 404

Part VII Others................................................................................................................407

VII-1 Objects Settings..................................................................................................................... 408

Web User Interface.................................................................................................................. 409

VII-1-1 IP Object ...................................................................................................................... 409

VII-1-2 IP Group....................................................................................................................... 413

VII-1-3 IPv6 Object................................................................................................................... 414

VII-1-4 IPv6 Group................................................................................................................... 416

VII-1-5 Service Type Object..................................................................................................... 417

VII-1-6 Service Type Group ..................................................................................................... 419

VII-1-7 Keyword Object............................................................................................................ 421

Vigor2133 Series User’s Guide

ix

VII-1-8 Keyword Group ............................................................................................................ 423

VII-1-9 File Extension Object................................................................................................... 424

VII-1-10 SMS/Mail Service Object ........................................................................................... 426

VII-1-11 Notification Object...................................................................................................... 431

VII-1-12 String Object .............................................................................................................. 433

Application Notes..................................................................................................................... 434

A-1 How to Send a Notification to Specified Phone Number via SMS Service in WAN

Disconnection .................................................................................... 434

VII-2 USB Application..................................................................................................................... 438

Web User Interface.................................................................................................................. 439

VII-2-1 USB General Settings.................................................................................................. 439

VII-2-2 USB User Management............................................................................................... 440

VII-2-3 File Explorer................................................................................................................. 442

VII-2-4 USB Device Status....................................................................................................... 443

VII-2-5 Temperature Sensor.................................................................................................... 444

VII-2-6 Modem Support List..................................................................................................... 446

VII-2-7 SMB Client Support List............................................................................................... 447

Application Notes..................................................................................................................... 448

A-1 How can I get the files from USB storage device connecting to Vigor router? ... 448

Part VIII Troubleshooting ..............................................................................................451

VIII-1 Diagnostics ........................................................................................................................... 452

Web User Interface.................................................................................................................. 453

VIII-1-1 Dial-out Triggering....................................................................................................... 453

VIII-1-2 Routing Table.............................................................................................................. 454

VIII-1-3 ARP Cache Table ....................................................................................................... 455

VIII-1-4 IPv6 Neighbour Table ................................................................................................. 456

VIII-1-5 DHCP Table................................................................................................................ 457

VIII-1-6 NAT Sessions Table ................................................................................................... 458

VIII-1-7 DNS Cache Table ....................................................................................................... 459

VIII-1-8 Ping Diagnosis ............................................................................................................ 460

VIII-1-9 Data Flow Monitor....................................................................................................... 461

VIII-1-10 Traffic Graph ............................................................................................................. 463

VIII-1-11 Trace Route .............................................................................................................. 464

VIII-1-12 Syslog Explorer......................................................................................................... 465

VIII-1-13 IPv6 TSPC Status ..................................................................................................... 466

VIII-1-14 DoS Flood Table....................................................................................................... 467

VIII-1-15 Route Policy Diagnosis............................................................................................. 469

VIII-2 Checking If the Hardware Status Is OK or Not..................................................................... 471

VIII-3 Checking If the Network Connection Settings on Your Computer Is OK or Not................... 472

VIII-4 Pinging the Router from Your Computer .............................................................................. 475

VIII-5 Checking If the ISP Settings are OK or Not ......................................................................... 477

Vigor2133 Series User’s Guide

x

VIII-6 Backing to Factory Default Setting If Necessary.................................................................. 478

VIII-7 Contacting DrayTek .............................................................................................................. 479

Appendix I: VLAN Applications on Vigor Router ............................................................................ 480

Part IX Telnet Commands..............................................................................................489

Accessing Telnet of Vigor2133....................................................................................................... 490

Index ...............................................................................................................................688

P

a

r

t

I

n

s

t

a

l

a

t

i

o

n

This part will introduce Vigor router and guide to

install the device in hardware and software.

Vigor2133 Series User’s Guide

1

I

-

1

I

n

t

r

o

d

u

c

t

i

o

n

T

h

i

s

i

s

a

g

e

n

e

r

i

c

I

n

t

e

r

n

a

t

i

o

n

a

l

v

e

r

s

i

o

n

o

f

t

h

e

u

s

e

r

g

u

i

d

e

.

S

p

e

c

i

f

i

c

a

t

i

o

n

,

c

o

m

p

a

t

i

b

i

l

i

t

y

a

n

d

f

e

a

t

u

r

e

s

v

a

r

y

b

y

r

e

g

i

o

n

.

F

o

r

s

p

e

c

i

f

i

c

u

s

e

r

g

u

i

d

e

s

u

i

t

a

b

l

e

f

o

r

y

o

u

r

e

g

i

o

n

o

r

p

r

o

d

u

c

t

,

p

l

e

a

s

e

c

o

n

t

a

c

t

l

o

c

a

l

d

i

s

t

r

i

b

u

t

o

r

.

Vigor2133 series integrates IP layer QoS, NAT session/bandwidth management to help users

control works well with large bandwidth.

By adopting hardware-based VPN platform and hardware encryption of AES/DES/3DES, the

router increases the performance of VPN greatly, and offers several protocols (such as

IPSec/PPTP/L2TP) with VPN tunnels.

The object-based design used in SPI (Stateful Packet Inspection) firewall allows users to set

firewall policy with ease. CSM (Content Security Management) provides users control and

management in IM (Instant Messenger) and P2P (Peer to Peer) more efficiency than before. By

the way, DoS/DDoS prevention and URL/Web content filter strengthen the security outside

and control inside. Object-based firewall is flexible and allows your network be safe.

User Management implemented on your router firmware can allow you to prevent any

computer from accessing your Internet connection without a username or password. You can

also allocate time budgets to your employees within office network.

With the 6-port Gigabit switch on the LAN side provides extremely high speed connectivity for

the highest speed local data transfer of any server or local PCs. The tagged VLANs

(IEEE802.1Q) can mark data with a VLAN identifier. This identifier can be carried through an

onward Ethernet switch to specific ports. The specific VLAN clients can also pick up this

identifier as it is just passed to the LAN. You can set the priorities for LAN-side QoS. You can

assign each of VLANs to each of the different IP subnets that the router may also be operating,

to provide even more isolation.

On the Wireless-equipped models each of the wireless SSIDs can also be grouped within one of

the VLANs.

Vigor2133 series provides two-level management to simplify the configuration of network

connection. The user mode allows user accessing into WEB interface via simple configuration.

However, if users want to have advanced configurations, they can access into WEB interface

through admin mode.

Vigor2133 Series User’s Guide

2

I

-

1

-

1

I

n

d

i

c

a

t

o

r

s

a

n

d

C

o

n

e

c

t

o

r

s

Before you use the Vigor router, please get acquainted with the LED indicators and

connectors first.

LED Status Explanation

Blinking The router is powered on and running normally.

Blinking When ACT and WLAN LEDs blink quickly and

simultaneously is enabled and the system waits for

wireless station of connection.

(Activity)

Off The router is powered off.

On The phone connected to this port is off-hook.

Off The phone connected to this port is on-hook.

Blinking A phone call comes.

On A USB device is connected and active.

USB

Blinking The data is transmitting.

On Wireless access point is ready.

Blinking Ethernet packets are transmitting over wireless LAN.

Blinking When ACT and WLAN LEDs blink quickly and

simultaneously is enabled and the system waits for

wireless station of connection.

~

WLAN

Off The WLAN function is inactive.

On Internet connection is ready.

Blinking The data is transmitting.

WAN

Off Internet connection is not ready.

On The WAN port is connected with Ethernet cable.

Blinking The data is transmitting through WAN port.

Off The WAN port is disconnected.

On The LAN port is connected.

Blinking The data is transmitting.

~

Off The LAN port is disconnected.

Vigor2133 Series User’s Guide

3

LAN1/2/3/4

Interface Description

Factory Reset Restore the default settings.

Usage: Turn on the router (ACT LED is blinking). Press the hole and keep

for more than 5 seconds. When you see the ACT LED begins to blink

rapidly than usual, release the button. Then the router will restart with

the factory default configuration.

Wireless LAN

ON/OFF/WPS

(for “n / ac”

model)

WLAN On - Press the button and release it within 2 seconds. When the

wireless function is ready, the green LED will be on.

WLAN Off - Press the button and release it within 2 seconds to turn off

the WLAN function. When the wireless function is not ready, the LED

will be off.

WPS - When WPS function is enabled by web user interface, press this

button for more than 2 seconds to wait for client’s device making

network connection through WPS.

USB1~USB2 Connector for a USB device (for 3G/4G USB Modem or printer).

GigaLAN1~LAN4 Connectors for local networked devices.

WAN Connector for remote networked devices.

Phone2/Phone1

(for “V” model)

Connector of analog phone for VoIP communication.

ON/OFF Power Switch.

PWR Connector for a power adapter.

Vigor2133 Series User’s Guide

4

I

-

2

H

a

r

d

w

a

r

e

I

n

s

t

a

l

a

t

i

o

n

I

-

2

-

1

I

n

s

t

a

l

i

n

g

V

i

g

o

r

R

o

u

t

e

r

Before starting to configure the router, you have to connect your devices correctly. In this

section, Vigor2133n is taken as an example.

1. Connect the cable Modem/DSL Modem/Media Converter to any WAN port of router with

Ethernet cable (RJ-45).

2. Connect one port of 4-port switch to your computer with a RJ-45 cable. This device

allows you to connect 4 PCs directly.

3. Connect detachable antennas to the router (for n/ac model only).

4. Connect one end of the power cord to the power port of this device. Connect the other

end to the wall outlet of electricity.

5. Power on the router.

6. Check the ACT and WAN, LAN LEDs to assure network connection.

(For the hardware connection, we take “n” model as an example.)

Vigor2133 Series User’s Guide

5

I

-

2

-

2

W

a

l

-

M

o

u

n

t

e

d

I

n

s

t

a

l

a

t

i

o

n

Vigor2133 has keyhole type mounting slots on the underside.

1. A template is provided on the Vigor2133 packaging box to enable you to space the screws

correctly on the wall.

2. Place the template on the wall and drill the holes according to the recommended

instruction.

3. Fit screws into the wall using the appropriate type of wall plug.

Note

The recommended drill diameter shall be 6.5mm (1/4”).

4. When you finished about procedure, the router has been mounted on the wall firmly.

Vigor2133 Series User’s Guide

6

I

-

2

-

3

I

n

s

t

a

l

i

n

g

U

S

B

P

r

i

n

t

e

r

t

o

V

i

g

o

r

R

o

u

t

e

r

You can install a printer onto the router for sharing printing. All the PCs connected this router

can print documents via the router. The example provided here is made based on Windows 7.

For other Windows system, please visit www.DrayTek.com.

Before using it, please follow the steps below to configure settings for connected computers

(or wireless clients).

1. Connect the printer with the router through USB/parallel port.

2. Open All Programs>>Getting Started>>Devices and Printers.

3. Click Add a printer.

Vigor2133 Series User’s Guide

7

4. A dialog will appear. Click Add a local printer and click Next.

5. In this dialog, choose Create a new port. In the field of Type of port, use the drop down

list to select Standard TCP/IP Port. Then, click Next.

Vigor2133 Series User’s Guide

8

6. In the following dialog, type 192.168.1.1 (router’s LAN IP) in the field of Hostname or

IP Address and type 192.168.1.1 as the Port name. Then, click Next.

7. Click Standard and choose Generic Network Card.

Vigor2133 Series User’s Guide

9

8. Now, your system will ask you to choose right name of the printer that you installed onto

the router. Such step can make correct driver loaded onto your PC. When you finish the

selection, click Next.

9. Type a name for the chosen printer. Click Next.

Vigor2133 Series User’s Guide

1

0

10. Choose Do not share this printer and click Next.

11. Then, in the following dialog, click Finish.

Vigor2133 Series User’s Guide

11

12. The new printer has been added and displayed under Printers and Faxes. Click the new

printer icon and click Printer server properties.

13. Edit the property of the new printer you have added by clicking Configure Port.

Vigor2133 Series User’s Guide

12

14. Select "LPR" on Protocol, type p1 (number 1) as Queue Name. Then click OK. Next

please refer to the red rectangle for choosing the correct protocol and LPR name.

The printer can be used for printing now. Most of the printers with different manufacturers

are compatible with vigor router.

Info

Some printers with the fax/scanning or other additional functions are not

supported.

Vigor router supports printing request from computers via LAN ports but not WAN

port.

Vigor2133 Series User’s Guide

13

I

-

3

A

c

e

s

i

n

g

W

e

b

P

a

g

e

1. Make sure your PC connects to the router correctly.

You may either simply set up your computer to get IP dynamically from the router or set

up the IP address of the computer to be the same subnet as the default IP address of

Vigor router 192.168.1.1. For the detailed information, please refer to the later

section - Trouble Shooting of the guide.

2. Open a web browser on your PC and type http://192.168.1.1. The following window

will be open to ask for username and password.

3. Please type “admin/admin” as the Username/Password and click Login.

Info

If you fail to access to the web configuration, please go to “Trouble

Shooting” for detecting and solving your problem.

Vigor2133 Series User’s Guide

1

4

4. Now, the Main Screen will appear. Take Vigor2133Vac as as example.

Info

The home page will be different slightly in accordance with the type of the

router you have.

5. The web page can be logged out according to the chosen condition. The default setting

is Auto Logout, which means the web configuration system will logout after 5 minutes

without any operation. Change the setting for your necessity.

Vigor2133 Series User’s Guide

15

I

-

4

C

h

a

n

g

i

n

g

P

a

s

w

o

r

d

Please change the password for the original security of the router.

1. Open a web browser on your PC and type http://192.168.1.1. A pop-up window will

open to ask for username and password.

2. Please type “admin/admin” as Username/Password for accessing into the web user

interface with admin mode.

3. Go to System Maintenance page and choose Administrator Password.

4. Enter the login password (the default is “admin”) on the field of Old Password. Type

New Password and Confirm Password. Then click OK to continue.

Info

The maximum length of the password you can set is 23 characters.

5. Now, the password has been changed. Next time, use the new password to access the

Web user interface for this router.

Info

Even the password is changed, the Username for logging onto the web user

interface is still “admin”.

Vigor2133 Series User’s Guide

16

I

-

5

D

a

s

h

b

o

a

r

d

Dashboard shows the connection status including System Information, IPv4 Internet Access,

IPv6 Internet Access, Interface (physical connection), Security and Quick Access.

Click Dashboard from the main menu on the left side of the main page.

A web page with default selections will be displayed on the screen. Refer to the following

figure:

Vigor2133 Series User’s Guide

1

7

I

-

5

-

1

V

i

r

t

u

a

l

P

a

n

e

l

On the top of the Dashboard, a virtual panel (simulating the physical panel of the router)

displays the physical interface connection. It will be refreshed every five seconds. When you

move and click the mouse cursor on LEDs (except ACT), USB ports, or LAN1 – LAN4, related

web setting page will be open for you to configure if required.

Port Color Description

Black It means the router or the function is not working. LED (left

side)

Green It means the router or the function is working.

Black It means no USB device is connected. USB

Green It means a USB device is connected.

Black It means such port is disconnected.

Green It means such port is connected (with Giga transmission

rate, 1Gbps) physically.

Ethernet

Port

(WAN/LAN)

Orange It means such port is connected (with 10/100 Mbps)

physically.

For detailed information about the LED display, refer to I-1-1 LED Indicators and

Connectors.

I

-

5

-

2

N

a

m

e

w

i

t

h

a

L

i

n

k

A name with a link (e.g., Router Name, Current Time, WAN1 and etc.) below means you can

click it to open the configuration page for modification.

Vigor2133 Series User’s Guide

18

I

-

5

-

3

Q

u

i

c

k

A

c

e

s

f

o

r

C

o

m

o

n

U

s

e

d

M

e

n

u

All the menu items can be accessed and arranged orderly on the left side of the main page for

your request. However, some important and common used menu items which can be

accessed in a quick way just for convenience.

Look at the right side of the Dashboard. You will find a group of common used functions

grouped under Quick Access.

The function links of System Status, Dynamic DDNS, TR-069, IM/P2P Block, Schedule,

Syslog/Mail Alert, RADIUS, Firewall Object Setting and Data Flow Monitor are displayed here.

Move your mouse cursor on any one of the links and click on it. The corresponding setting

page will be open immediately.

In addition, quick access for VPN security settings such as Remote Dial-in User and LAN to

LAN are located on the bottom of this page. Scroll down the page to find them and use them

if required.

Note that there is a plus (

) icon located on the left side of LAN/WLAN/VPN/MyVigor. Click

it to review the LAN/WLAN/VPN/MyVigor connection(s) used presently.

Vigor2133 Series User’s Guide

1

9

Host connected physically to the router via LAN port(s) will be displayed with green circles in

the field of Connected.

All of the hosts (including wireless clients) displayed with Host ID, IP Address and MAC address

indicates that the traffic would be transmitted through LAN port(s) and then the WAN port.

The purpose is to perform the traffic monitor of the host(s).

I

-

5

-

4

G

U

I

M

a

p

All the functions the router supports are listed with table clearly in this page. Users can click

the function link to access into the setting page of the function for detailed configuration.

Click the icon on the top of the main screen to display all the functions.

Vigor2133 Series User’s Guide

2

0

I

-

5

-

5

W

e

b

C

o

n

s

o

l

e

It is not necessary to use the telnet command via DOS prompt. The changes made by using

web console have the same effects as modified through web user interface. The

functions/settings modified under Web Console also can be reviewed on the web user

interface.

Click the Web Console icon on the top of the main screen to open the following screen.

I

-

5

-

6

C

o

n

f

i

g

B

a

c

k

u

p

There is one way to store current used settings quickly by clicking the Config Backup icon. It

allows you to backup current settings as a file. Such configuration file can be restored by

using System Maintenance>>Configuration Backup.

Simply click the icon on the top of the main screen and a pop up dialog will appear.

Click Save to store the setting.

Vigor2133 Series User’s Guide

21

I

-

5

-

7

L

o

g

o

u

t

Click this icon to exit the web user interface.

I

-

5

-

8

O

n

l

i

n

e

S

t

a

t

u

s

I

-

5

-

8

-

1

P

h

y

s

i

c

a

l

C

o

n

e

c

t

i

o

n

Such page displays the physical connection status such as LAN connection status, WAN

connection status, ADSL information, and so on.

P

h

y

s

i

c

a

l

C

o

n

e

c

t

i

o

n

f

o

r

I

P

v

4

P

r

o

t

o

c

o

l

Vigor2133 Series User’s Guide

22

P

h

y

s

i

c

a

l

C

o

n

e

c

t

i

o

n

f

o

r

I

P

v

6

P

r

o

t

o

c

o

l

Detailed explanation (for IPv4) is shown below:

Item Description

LAN Status Primary DNS-Displays the primary DNS server address for

WAN interface.

Secondary DNS -Displays the secondary DNS server address

for WAN interface.

IP Address-Displays the IP address of the LAN interface.

TX Packets-Displays the total transmitted packets at the LAN

interface.

RX Packets-Displays the total received packets at the LAN

interface.

WAN1/WAN2/WAN3

/WAN4 Status

Enable – Yes in red means such interface is available but not

enabled. Yes in green means such interface is enabled.

Line – Displays the physical connection (VDSL, ADSL,

Ethernet, or USB) of this interface.

Name – Display the name of the router.

Mode - Displays the type of WAN connection (e.g., PPPoE).

Up Time - Displays the total uptime of the interface.

IP - Displays the IP address of the WAN interface.

GW IP - Displays the IP address of the default gateway.

TX Packets - Displays the total transmitted packets at the

WAN interface.

TX Rate - Displays the speed of transmitted octets at the

WAN interface.

RX Packets - Displays the total number of received packets

at the WAN interface.

RX Rate - Displays the speed of received octets at the WAN

interface.

Detailed explanation (for IPv6) is shown below:

Vigor2133 Series User’s Guide

23

Item Description

LAN Status IP Address- Displays the IPv6 address of the LAN interface..

TX Packets-Displays the total transmitted packets at the LAN

interface.

RX Packets-Displays the total received packets at the LAN

interface.

TX Bytes - Displays the speed of transmitted octets at the

LAN interface.

RX Bytes - Displays the speed of received octets at the LAN

interface.

WAN IPv6 Status Enable – No in red means such interface is available but not

enabled. Yes in green means such interface is enabled. No in

red means such interface is not available.

Mode - Displays the type of WAN connection (e.g., TSPC).

Up Time - Displays the total uptime of the interface.

IP - Displays the IP address of the WAN interface.

Gateway IP - Displays the IP address of the default gateway.

Info

The words in green mean that the WAN connection of that interface is ready for

accessing Internet; the words in red mean that the WAN connection of that interface

is not ready for accessing Internet.

I

-

5

-

8

-

2

V

i

r

t

u

a

l

W

A

N

Such page displays the virtual WAN connection information.

Virtual WAN are used by TR-069 management, and so on.

The field of Application will list the purpose of such WAN connection.

Vigor2133 Series User’s Guide

2

4

I

-

6

Q

u

i

c

k

S

t

a

r

t

W

i

z

a

r

d

Quick Start Wizard can help you to deploy and use the router easily and quickly. Go to

Wizards>>Quick Start Wizard. The first screen of Quick Start Wizard is entering login

password. After typing the password, please click Next.

On the next page as shown below, please select the appropriate Internet access type

according to the information from your ISP. For example, you should select PPPoE mode if the

ISP provides you PPPoE interface. Then click Next for next step.

Vigor2133 Series User’s Guide

25

P

o

E

1. If you click PPPoE as the protocol, after clicking Next, you will get the following web

page. Please manually enter the Username/Password provided by your ISP. Then click

Next.

Available settings are explained as follows:

Item Description

Service Name

(Optional)

Enter the description of the specific network service.

Username Assign a specific valid user name provided by the ISP.

Note: The maximum length of the user name you can set is

63 characters.

Password Assign a valid password provided by the ISP.

Note: The maximum length of the password you can set is 62

characters.

Confirm Password Retype the password.

Back Click it to return to previous setting page.

Next Click it to get into the next setting page.

Cancel Click it to give up the quick start wizard.

Vigor2133 Series User’s Guide

26

2. Please manually enter the Username/Password provided by your ISP. Click Next for

viewing summary of such connection.

3. Click Finish. A page of Quick Start Wizard Setup OK!!! will appear. Then, the system

status of this protocol will be shown.

4. Now, you can enjoy surfing on the Internet.

Vigor2133 Series User’s Guide

2

7

P

T

P

/

L

2

T

P

1. Choose PPTP/L2TP as the WAN Interface and click the Next button.

2. The following page will be open for you to type in all the information originally provided

by your ISP.

Available settings are explained as follows:

Item Description

Username Assign a specific valid user name provided by the ISP.

Note: The maximum length of the user name you can set is

63 characters.

Password Assign a valid password provided by the ISP.

Note: The maximum length of the password you can set is 62

characters.

Confirm Password Retype the password.

WAN IP Configuration

Obtain an IP address automatically – the router will get an

IP address automatically from DHCP server.

Specify an IP address – you have to type relational settings

Vigor2133 Series User’s Guide

28

manually.

IP Address - Type the IP address.

Subnet Mask –Type the subnet mask.

Gateway – Type the IP address of the gateway.

PPTP Server / L2TP

Server

Type the IP address of the server.

Back Click it to return to previous setting page.

Next Click it to get into the next setting page.

Cancel Click it to give up the quick start wizard.

3. Please type in the IP address/mask/gateway information originally provided by your ISP.

Then click Next for viewing summary of such connection.

4. Click Finish. A page of Quick Start Wizard Setup OK!!! will appear. Then, the system

status of this protocol will be shown.

5. Now, you can enjoy surfing on the Internet.

Vigor2133 Series User’s Guide

2

9

S

t

a

t

i

c

I

P

1. Click Static IP as the Internet Access type and click the Next button.

2. The following page will be open for you to type in the IP address information originally

provided by your ISP.

Available settings are explained as follows:

Item Description

WAN IP Type the IP address.

Subnet Mask Type the subnet mask.

Gateway Type the IP address of gateway.

Primary DNS Type in the primary IP address for the router.

Secondary DNS Type in secondary IP address for necessity in the future.

Back Click it to return to previous setting page.

Next Click it to get into the next setting page.

Vigor2133 Series User’s Guide

3

0

Cancel Click it to give up the quick start wizard.

3. Please type in the IP address information originally provided by your ISP. Then click Next

for next step.

4. Click Finish. A page of Quick Start Wizard Setup OK!!! will appear. Then, the system

status of this protocol will be shown.

5. Now, you can enjoy surfing on the Internet.

D

H

C

P

1. Click DHCP as the Internet Access type and click the Next button.

Vigor2133 Series User’s Guide

31

2. The following page will be open for you to type in the IP address information originally

provided by your ISP.

Available settings are explained as follows:

Item Description

Host Name Type the name of the host.

Note: The maximum length of the host name you can set is

39 characters.

MAC Some Cable service providers specify a specific MAC address

for access authentication. In such cases you need to enter

the MAC address.

Back Click it to return to previous setting page.

Next Click it to get into the next setting page.

Cancel Click it to give up the quick start wizard.

3. After finished the settings above, click Next for viewing summary of such connection.

Vigor2133 Series User’s Guide

32

4. Click Finish. A page of Quick Start Wizard Setup OK!!! will appear. Then, the system

status of this protocol will be shown.

5. Now, you can enjoy surfing on the Internet.

Vigor2133 Series User’s Guide

33

I

-

7

S

e

r

v

i

c

e

A

c

t

i

v

a

t

i

o

n

W

i

z

a

r

d

Service Activation Wizard can guide you to activate WCF service (Web Content Filter) with a

quick and easy way. For the Service Activation Wizard is only available for admin

operation, please type “admin/admin” on Username/Password while Logging into the web

user interface.

Service Activation Wizard is a tool which allows you to activate services without accessing

into the server (MyVigor) located on http://myvigor.draytek.com.

Info

Such function is available only for Admin Mode.

1. Open Wizards>>Service Activation Wizard.

2. In the following page, you can activate the Web content filter services and APPE

Enforcement service at the same time or individually. When you finish the selection,

please click Next.

Info

BPjM is web content filter (WCF) for German Speaking users. It is ideal for your

Vigor2133 Series User’s Guide

34

family to provide more Internet security for youngsters.

Cryan 30-day trial is WCF which offers 30-day trial period. After trial, you can

purchase DrayTek's prepared Cryan GlobalView WCF package from retailing

outlets.

DT-APPE, developed by DrayTek, offers a mechanism to upgrade APPE

signature automatically.

3. Setting confirmation page will be displayed as follows, please click Activate.

Info

The service will be activated and applied as the default rule configured in

Firewall>>General Setup.

4. Now, the web page will display the service that you have activated according to your

selection(s). The valid time for the free trial of these services is one month.

Vigor2133 Series User’s Guide

35

I

-

8

R

e

g

i

s

t

e

r

i

n

g

V

i

g

o

r

R

o

u

t

e

r

You have finished the configuration of Quick Start Wizard and you can surf the Internet at any

time. Now it is the time to register your Vigor router to MyVigor website for getting more

service. Please follow the steps below to finish the router registration.

1 Please login the web configuration interface of Vigor router by typing “admin/admin” as

User Name / Password.

2 Click Support Area>>Production Registration from the home page.

3 A Login page will be shown on the screen. Please type the account and password that

you created previously. And click Login.

Info

If you haven’t an accessing account, please refer to section Creating an

Account for MyVigor to create your own one. Please read the articles on the

Agreement regarding user rights carefully while creating a user account.

Vigor2133 Series User’s Guide

36

4 The following page will be displayed after you logging in MyVigor. When the following

page appears, please type in Nickname (for the router) and choose the right registration

date from the popup calendar (it appears when you click on the box of Registration

Date). Click Add.

5 When the following page appears, your router information has been added to the

database.

6 After clicking OK, you will see the following page. Your router has been registered to

myvigor website successfully.

Vigor2133 Series User’s Guide

3

7

P

a

r

t

I

C

o

n

e

c

t

i

v

i

t

y

It means wide area network. Public IP will be used in

WAN.

It means local area network. Private IP will be used in

LAN. Local Area Network (LAN) is a group of subnets

regulated and ruled by router. The design of network

structure is related to what type of public IP addresses

coming from your ISP.

When the data flow passing through, the Network

Address Translation (NAT) function of the router will

dedicate to translate public/private addresses, and

the packets will be delivered to the correct host PC in

the local area network.

DNS, LAN DNS, IGMP, UPnP, WOL, RADIUS, SMS.

Static Route, Route Policy

Vigor2133 Series User’s Guide

38

I

-

1

W

A

N

It allows users to access Internet.

B

a

s

i

c

s

o

f

I

n

t

e

r

n

e

t

P

r

o

t

o

c

o

l

(

I

P

)

N

e

t

w

o

r

k

IP means Internet Protocol. Every device in an IP-based Network including routers, print

server, and host PCs, needs an IP address to identify its location on the network. To avoid

address conflicts, IP addresses are publicly registered with the Network Information Centre

(NIC). Having a unique IP address is mandatory for those devices participated in the public

network but not in the private TCP/IP local area networks (LANs), such as host PCs under the

management of a router since they do not need to be accessed by the public. Hence, the NIC

has reserved certain addresses that will never be registered publicly. These are known as

private IP addresses, and are listed in the following ranges:

From 10.0.0.0 to 10.255.255.255

From 172.16.0.0 to 172.31.255.255

From 192.168.0.0 to 192.168.255.255

W

h

a

t

a

r

e

P

u

b

l

i

c

I

P

A

d

r

e

s

a

n

d

P

r

i

v

a

t

e

I

P

A

d

r

e

s

As the router plays a role to manage and further protect its LAN, it interconnects groups of

host PCs. Each of them has a private IP address assigned by the built-in DHCP server of the

Vigor router. The router itself will also use the default private IP address: 192.168.1.1 to

communicate with the local hosts. Meanwhile, Vigor router will communicate with other

network devices through a public IP address. When the data flow passing through, the

Network Address Translation (NAT) function of the router will dedicate to translate

public/private addresses, and the packets will be delivered to the correct host PC in the local

area network. Thus, all the host PCs can share a common Internet connection.

G

e

t

Y

o

u

r

P

u

b

l

i

c

I

P

A

d

r

e

s

f

r

o

m

I

S

P

In ADSL deployment, the PPP (Point to Point)-style authentication and authorization is

required for bridging customer premises equipment (CPE). Point to Point Protocol over

Ethernet (PPPoE) connects a network of hosts via an access device to a remote access

concentrator or aggregation concentrator. This implementation provides users with

significant ease of use. Meanwhile it provides access control, billing, and type of service

according to user requirement.

When a router begins to connect to your ISP, a serial of discovery process will occur to ask for

a connection. Then a session will be created. Your user ID and password is authenticated via

PAP or CHAP with RADIUS authentication system. And your IP address, DNS server, and other

related information will usually be assigned by your ISP.

Vigor2133 Series User’s Guide

3

9

W

e

b

U

s

e

r

I

n

t

e

r

f

a

c

e

I

-

1

-

1

G

e

n

e

r

a

l

S

e

t

u

p

This section will introduce some general settings of Internet and explain the connection

modes for WAN in details.

I

-

1

-

1

-

1

W

A

N

1

This webpage allows you to set general setup for WAN1and WAN3 respectively.

Available settings are explained as follows:

Item Description

Index Click the WAN interface link under Index to access into the

WAN configuration page.

Enable V means such WAN interface is enabled and ready to be used.

Physical Mode / Type Display the physical mode and physical type of such WAN

interface.

Active Mode Display whether such WAN interface is Active device or

backup device.

Load Balance Display if Load Balance feature is enabled or disabled for

such WAN interface.

Info

In default, each WAN port is enabled.

Click WAN1 link to get the following page:

Vigor2133 Series User’s Guide

40

Or

Available settings are explained as follows:

Item Description

Enable Choose Yes to invoke the settings for this WAN interface.

Choose No to disable the settings for this WAN interface.

Display Name Type the description for such WAN interface.

Physical Mode Display the physical mode of such WAN interface.

Physical Type You can change the physical type for WAN2 or choose Auto

negotiation for determined by the system.

VLAN Tag insertion Enable – Enable the function of VLAN with tag.

The router will add specific VLAN number to all packets on

the WAN while sending them out.

Please type the tag value and specify the priority for the

Vigor2133 Series User’s Guide

41

packets sending by WAN interface.

Disable – Disable the function of VLAN with tag.

Tag value – Type the value as the VLAN ID number. The

range is from 0 to 4095.

Priority – Type the packet priority number for such VLAN.

The range is from 0 to 7.

After finished the above settings, click OK to save the settings.

Vigor2133 Series User’s Guide

42

I

-

1

-

1

-

2

W

A

N

3

(

U

S

B

)

To use 3G/4G network connection through 3G/4G USB Modem, please configure WAN3

interface.

Available settings are explained as follows:

Item Description

Enable Choose Yes to invoke the settings for this WAN interface.

Choose No to disable the settings for this WAN interface.

Display Name Type the description for such WAN interface.

After finished the above settings, click OK to save the settings.

Vigor2133 Series User’s Guide

43

I

-

1

-

2

I

n

t

e

r

n

e

t

A

c

e

s

This page allows you to set WAN configuration with different modes. Use the Connection Type

drop down list to choose one of the WAN modes. The corresponding page will be displayed.

Available settings are explained as follows:

Item Description

Index Display the WAN interface.

Display Name It shows the name of the WAN1/WAN2/WAN3 /WAN4 that

entered in general setup.

Physical Mode It shows the physical connection for WAN (Ethernet or fiber)

according to the real network connection.

Access Mode Use the drop down list to choose a proper access mode. The

details page of that mode will be popped up. If not, click

Details Page for accessing the page to configure the settings.

Details Page This button will open different web page (based on IPv4)

according to the access mode that you choose in WAN

interface.

IPv6 This button will open different web page (based on Physical

Mode) to setup IPv6 Internet Access Mode for WAN interface.

If IPv6 service is active on this WAN interface, the color of

“IPv6” will become green.

DHCP Client Option This button allows you to configure DHCP client options.

DHCP packets can be processed by adding option number and

data information when such function is enabled and

configured.

Enable – Check the box to enable the function of DHCP

Vigor2133 Series User’s Guide

44

Option. Each DHCP option is composed by an option number

with data. For example,

Option number:100

Data: abcd

When such function is enabled, the specified values for DHCP

option will be seen in DHCP reply packets.

Interface – Specify the WAN interface(s) that will be

overwritten by such function. WAN5 ~ WAN6 can be located

under WAN>>Multi-PVC/VLAN.

Option Number – Type a number for such function.

Note: If you choose to configure option 61 here, the

detailed settings in WAN>>Interface Access will be

overwritten.

DataType – Choose the type (ASCII or Hex) for the data to be

stored.

Data – Type the content of the data to be processed by the

function of DHCP option.

I

-

1

-

2

-

1

D

e

t

a

i

l

s

P

a

g

e

f

o

r

P

o

E

To use PPPoE as the accessing protocol of the internet, please click the PPPoE tab. The

following web page will be shown.

Available settings are explained as follows:

Vigor2133 Series User’s Guide

45

Item Description

Enable/Disable Click Enable for activating this function. If you click Disable,

this function will be closed and all the settings that you

adjusted in this page will be invalid.

ISP Access Setup Enter your allocated username, password and authentication

parameters according to the information provided by your

ISP.

Service Name (Optional) - Enter the description of the

specific network service.

Username – Type in the username provided by ISP in this

field.

The maximum length of the user name you can set is 63

characters.

Password – Type in the password provided by ISP in this field.

The maximum length of the password you can set is 62

characters.

Index (1-15) in Schedule Setup - You can type in four sets of

time schedule for your request. All the schedules can be set

previously in Application >> Schedule web page and you can

use the number that you have set in that web page.

PPPoE Pass-through The router offers PPPoE dial-up connection. Besides, you

also can establish the PPPoE connection directly from local

clients to your ISP via the Vigor router. When PPPoA protocol

is selected, the PPPoE package transmitted by PC will be

transformed into PPPoA package and sent to WAN server.

Thus, the PC can access Internet through such direction.

For Wired LAN – If you check this box, PCs on the same

network can use another set of PPPoE session (different with

the Host PC) to access into Internet.

For Wireless LAN – It is available for n model. If you check

this box, PCs on the same wireless network can use another

set of PPPoE session (different with the Host PC) to access

into Internet.

Note: To have PPPoA Pass-through, please choose PPPoA

protocol and check the box(es) here. The router will behave

like a modem which only serves the PPPoE client on the LAN.

That’s, the router will offer PPPoA dial-up connection.

WAN Connection

Detection

Such function allows you to verify whether network

connection is alive or not through PPP Detect or Ping Detect.

Mode – Choose PPP Detect or Ping Detect for the system to

execute for WAN detection. If you choose Ping Detect as the

detection mode, you have to type required settings for the

following items.

 Primary/Secondary Ping IP – If you choose Ping Detect as

detection mode, you have to type Primary or Secondary IP

address in this field for pinging.

 Ping Gateway IP – If you choose Ping Detect as detection

mode, you also can enable this setting to use current WAN

gateway IP address for pinging.

With the IP address(es) pinging, Vigor router can check if

the WAN connection is on or off.

 TTL (Time to Live) – Set TTL value of PING operation.

 Ping Interval – Type the interval for the system to

execute the PING operation.

Vigor2133 Series User’s Guide

46

 Ping Retry – Type the number of times that the system is

allowed to execute the PING operation before WAN

disconnection is judged.

MTU It means Max Transmit Unit for packet.

Path MTU Discovery – It is used to detect the maximum MTU

size of a packet not to be segmented in specific transmit

path.

Click Detect to open the following dialog.

 Path MTU to – Type the IP address as the specific

transmit path.

 MTU size start from - Determine the starting point

value of the packet.

 MTU reduce size by – It determines the decreasing size

of MTU value. For example, the number specified in

this field is “8”. The maximum MTU size is “1500”.

After clicking the “detect” button, the system will

calculate and get the suitable MTU value such as 1500,

1492, 1484 and etc., automatically.

 Detect – Click it to detect a suitable MTU value

 Accept – After clicking it, the detected value will be

displayed in the field of MTU.

TTL Change the TTL value – Enable or disable the TTL (Time to

Live) for a packet transmitted through Vigor router.

Enable - TTL value will be reduced (-1) when it passess

through Vigor router. It will cause the client, accessing

Internet through Vigor router, be blocked by certain ISP

when TTL value becomes “0”.

Disable – TTL value will not be reduced. Then, when a packet

passes through Vigor router, it will not be cancelled. That is,

the client who sends out the packet will not be blocked by

ISP.

PPP/MP Setup PPP Authentication – Select PAP only or PAP or CHAP for

PPP.

Idle Timeout – Set the timeout for breaking down the

Internet after passing through the time without any action.

IP Address Assignment

Method (IPCP)

Usually ISP dynamically assigns IP address to you each time

you connect to it and request. In some case, your ISP

provides service to always assign you the same IP address

whenever you request. In this case, you can fill in this IP

address in the Fixed IP field. Please contact your ISP before

you want to use this function.

WAN IP Alias - If you have multiple public IP addresses and

would like to utilize them on the WAN interface, please use

WAN IP Alias. You can set up to 32 public IP addresses other

than the current one you are using. Type the additional WAN

Vigor2133 Series User’s Guide

4

7

IP address and check the Enable box. Then click OK to exit

the dialog.

Fixed IP – Click Yes to use this function and type in a fixed IP

address in the box of Fixed IP Address.

Default MAC Address – You can use Default MAC Address or

specify another MAC address by typing on the boxes of MAC

Address for the router.

Specify a MAC Address – Type the MAC address for the router

manually.

After finishing all the settings here, please click OK to activate them.

I

-

1

-

2

-

2

D

e

t

a

i

l

s

P

a

g

e

f

o

r

S

t

a

t

i

c

o

r

D

y

n

a

m

i

c

I

P

For static IP mode, you usually receive a fixed public IP address or a public subnet, namely

multiple public IP addresses from your DSL or Cable ISP service providers. In most cases, a

Cable service provider will offer a fixed public IP, while a DSL service provider will offer a

public subnet. If you have a public subnet, you could assign an IP address or many IP address

to the WAN interface.

To use Static or Dynamic IP as the accessing protocol of the internet, please click the Static

or Dynamic IP tab. The following web page will be shown.

Available settings are explained as follows:

Item Description

Enable / Disable Click Enable for activating this function. If you click Disable,

this function will be closed and all the settings that you

adjusted in this page will be invalid.

Vigor2133 Series User’s Guide

48

Keep WAN Connection Normally, this function is designed for Dynamic IP

environments because some ISPs will drop connections if

there is no traffic within certain periods of time. Check

Enable PING to keep alive box to activate this function.

PING to the IP - If you enable the PING function, please

specify the IP address for the system to PING it for keeping

alive.

PING Interval - Enter the interval for the system to execute

the PING operation.

WAN Connection

Detection

Such function allows you to verify whether network

connection is alive or not through ARP Detect or Ping Detect.

Mode – Choose ARP Detect, Ping Detect or Always On for

the system to execute for WAN detection. If you choose Ping

Detect as the detection mode, you have to type required

settings for the following items.

 Primary/Secondary Ping IP – If you choose Ping Detect as

detection mode, you have to type Primary or Secondary IP

address in this field for pinging.

 Ping Gateway IP – If you choose Ping Detect as detection

mode, you also can enable this setting to use current WAN

gateway IP address for pinging.

With the IP address(es) pinging, Vigor router can check if

the WAN connection is on or off.

 TTL (Time to Live) – Set TTL value of PING operation.

 Ping Interval – Type the interval for the system to

execute the PING operation.

 Ping Retry – Type the number of times that the system is

allowed to execute the PING operation before WAN

disconnection is judged.

MTU It means Max Transmit Unit for packet.

Path MTU Discovery – It is used to detect the maximum MTU

size of a packet not to be segmented in specific transmit

path.

Click Detect to open the following dialog.

 Path MTU to – Choose the destination as the specific

transmit path and type the IP address.

 MTU size start from - Determine the starting point

value of the packet.

 MTU reduce size by – It determines the decreasing size

of MTU value. For example, the number specified in

this field is “8”. The maximum MTU size is “1500”.

After clicking the “detect” button, the system will

calculate and get the suitable MTU value such as 1500,

1492, 1484 and etc., automatically.

 Detect – Click it to detect a suitable MTU value

 Accept – After clicking it, the detected value will be

Vigor2133 Series User’s Guide

4

9

displayed in the field of MTU.

RIP Protocol

Routing Information Protocol is abbreviated as RIP（RFC1058）

specifying how routers exchange routing tables information.

Click Enable RIP for activating this function.

TTL Change the TTL value – Enable or disable the TTL (Time to

Live) for a packet transmitted through Vigor router.

Enable - TTL value will be reduced (-1) when it passess

through Vigor router. It will cause the client, accessing

Internet through Vigor router, be blocked by certain ISP

when TTL value becomes “0”.

Disable – TTL value will not be reduced. Then, when a packet

passes through Vigor router, it will not be cancelled. That is,

the client who sends out the packet will not be blocked by

ISP.

WAN IP Network Settings This group allows you to obtain an IP address automatically

and allows you type in IP address manually.

WAN IP Alias - If you have multiple public IP addresses and

would like to utilize them on the WAN interface, please use

WAN IP Alias. You can set up to 32 public IP addresses other

than the current one you are using.

Obtain an IP address automatically – Click this button to

obtain the IP address automatically if you want to use

Dynamic IP mode.

 Router Name: Type in the router name provided

by ISP.

 Domain Name: Type in the domain name that you

have assigned.

DHCP Client Identifier

 Enable: Check the box to specify username and

password as the DHCP client identifier for some

ISP.

 Username: Type a name as username. The

maximum length of the user name you can set is

63 characters.

 Password: Type a password. The maximum length

of the password you can set is 62 characters.

Specify an IP address – Click this radio button to specify

some data if you want to use Static IP mode.

 IP Address: Type the IP address.

 Subnet Mask: Type the subnet mask.

 Gateway IP Address: Type the gateway IP

address.

Default MAC Address: Click this radio button to use default

MAC address for the router.

Specify a MAC Address: Some Cable service providers

specify a specific MAC address for access authentication. In

such cases you need to click the Specify a MAC Address and

enter the MAC address in the MAC Address field.

DNS Server IP Address Type in the primary IP address for the router if you want to

use Static IP mode. If necessary, type in secondary IP address

for necessity in the future.

After finishing all the settings here, please click OK to activate them.

Vigor2133 Series User’s Guide

5

0

I

-

1

-

2

-

3

D

e

t

a

i

l

s

P

a

g

e

f

o

r

P

T

P

/

L

2

T

P

To use PPTP/L2TP as the accessing protocol of the internet, please click the PPTP/L2TP tab.

The following web page will be shown.

Available settings are explained as follows:

Item Description

PPTP/L2TP Enable PPTP- Click this radio button to enable a PPTP client

to establish a tunnel to a DSL modem on the WAN interface.

Enable L2TP - Click this radio button to enable a L2TP client

to establish a tunnel to a DSL modem on the WAN interface.

Disable – Click this radio button to close the connection

through PPTP or L2TP.

Server Address - Specify the IP address of the PPTP/L2TP

server if you enable PPTP/L2TP client mode.

Specify Gateway IP Address – Specify the gateway IP address

for DHCP server.

ISP Access Setup Username -Type in the username provided by ISP in this

field. The maximum length of the user name you can set is 63

characters.

Password -Type in the password provided by ISP in this field.

The maximum length of the password you can set is 62

characters.

Index (1-15) in Schedule Setup - You can type in four sets of

time schedule for your request. All the schedules can be set

previously in Application >> Schedule web page and you can

use the number that you have set in that web page.

MTU It means Max Transmit Unit for packet.

Path MTU Discovery – It is used to detect the maximum MTU

size of a packet not to be segmented in specific transmit

path.

Click Detect to open the following dialog.

Vigor2133 Series User’s Guide

51

 Path MTU to – Choose the destination as the specific

transmit path and type the IP address.

 MTU size start from - Determine the starting point

value of the packet.

 MTU reduce size by – It determines the decreasing size

of MTU value. For example, the number specified in

this field is “8”. The maximum MTU size is “1500”.

After clicking the “detect” button, the system will

calculate and get the suitable MTU value such as 1500,

1492, 1484 and etc., automatically.

 Detect – Click it to detect a suitable MTU value

 Accept – After clicking it, the detected value will be

displayed in the field of MTU.

PPP Setup PPP Authentication - Select PAP only or PAP or CHAP for

PPP.

Idle Timeout - Set the timeout for breaking down the

Internet after passing through the time without any action.

IP Address Assignment

Method(IPCP)

WAN IP Alias - If you have multiple public IP addresses and

would like to utilize them on the WAN interface, please use

WAN IP Alias. You can set up to 32 public IP addresses other

than the current one you are using.

Fixed IP - Usually ISP dynamically assigns IP address to you

each time you connect to it and request. In some case, your

ISP provides service to always assign you the same IP address

whenever you request. In this case, you can fill in this IP

address in the Fixed IP field. Please contact your ISP before

you want to use this function. Click Yes to use this function

and type in a fixed IP address in the box.

Fixed IP Address -Type a fixed IP address.

WAN IP Network Settings Obtain an IP address automatically – Click this button to

obtain the IP address automatically.

Specify an IP address – Click this radio button to specify

some data.

 IP Address – Type the IP address.

 Subnet Mask – Type the subnet mask.

After finishing all the settings here, please click OK to activate them.

Vigor2133 Series User’s Guide

52

I

-

1

-

2

-

4

D

e

t

a

i

l

s

P

a

g

e

f

o

r

I

P

v

6

–

O

f

l

i

n

e

When Offline is selected, the IPv6 connection will be disabled.

I

-

1

-

2

-

5

D

e

t

a

i

l

s

P

a

g

e

f

o

r

I

P

v

6

–

P

During the procedure of IPv4 PPPoE connection, we can get the IPv6 Link Local Address

between the gateway and Vigor router through IPv6CP. Later, use DHCPv6 or accept RA to

acquire the IPv6 prefix address (such as: 2001:B010:7300:200::/64) offered by the ISP. In

addition, PCs under LAN also can have the public IPv6 address for Internet access by means of

the generated prefix.

No need to type any other information for PPP mode.

Available settings are explained as follows:

Item Description

WAN Connection

Detection

Such function allows you to verify whether network

connection is alive or not through Ping Detect.

Mode – Choose Always On or Ping Detect for the system to

execute for WAN detection. Always On means no detection

will be executed. The network connection will be on always.

 Ping IP/Hostname – If you choose Ping Detect as

detection mode, you have to type IP address in this field

for pinging.

 TTL (Time to Live) –If you choose Ping Detect as

Vigor2133 Series User’s Guide

53

detection mode, you have to type TTL value.

RIPng Protocol RIPng (RIP next generation) offers the same functions and

benefits as IPv4 RIP v2.

Below shows an example for successful IPv6 connection based on PPP mode.

Info

At present, the IPv6 prefix can be acquired via the PPPoE mode connection which is

available for the areas such as Taiwan (hinet), the Netherlands, Australia and UK.

I

-

1

-

2

-

6

D

e

t

a

i

l

s

P

a

g

e

f

o

r

I

P

v

6

–

T

S

P

C

Tunnel setup protocol client (TSPC) is an application which could help you to connect to IPv6

network easily.

Please make sure your IPv4 WAN connection is OK and apply one free account from hexago

(http://gogonet.gogo6.com/page/freenet6-account ) before you try to use TSPC for network

connection. TSPC would connect to tunnel broker and requests a tunnel according to the

specifications inside the configuration file. It gets a public IPv6 IP address and an IPv6 prefix

from the tunnel broker and then monitors the state of the tunnel in background.

After getting the IPv6 prefix and starting router advertisement daemon (RADVD), the PC

behind this router can directly connect to IPv6 the Internet.

Vigor2133 Series User’s Guide

5

4

Available settings are explained as follows:

Item Description

Username Type the name obtained from the broker. It is suggested for

you to apply another username and password for

http://gogonet.gogo6.com/page/freenet6-account.

The maximum length of the name you can set is 63

characters.

Password Type the password assigned with the user name.

The maximum length of the name you can set is 19

characters.

Tunnel Broker Type the address for the tunnel broker IP, FQDN or an

optional port number.

WAN Connection

Detection

Such function allows you to verify whether network

connection is alive or not through Ping Detect.

Mode – Choose Always On or Ping Detect for the system to

execute for WAN detection. Always On means no detection

will be executed. The network connection will be on always.

 Ping IP/Hostname – If you choose Ping Detect as

detection mode, you have to type IP address in this field

for pinging.

 TTL (Time to Live) –If you choose Ping Detect as

detection mode, you have to type TTL value.

After finished the above settings, click OK to save the settings.

Vigor2133 Series User’s Guide

55

I

-

1

-

2

-

7

D

e

t

a

i

l

s

P

a

g

e

f

o

r

I

P

v

6

–

A

I

C

U

Available settings are explained as follows:

Item Description

Always On Check this box to keep the network connection always.

Username Type the name obtained from the broker. Please apply new

account at http://www.sixxs.net/. It is suggested for you to

apply another username and password.

The maximum length of the name you can set is 19

characters.

Password Type the password assigned with the user name.

The maximum length of the password you can set is 19

characters.

Tunnel Broker It means a server of AICCU. The server can provide IPv6

tunnels to sites or end users over IPv4.

Type the address for the tunnel broker IP, FQDN or an

optional port number.

Tunnel ID One user account may have several tunnels. And, each

tunnel shall have one specified tunnel ID (e.g., T115394).

Type the ID offered by Tunnel Broker.

Subnet Prefix Type the subnet prefix address obtained from service

provider.

The maximum length of the prefix you can set is 128

characters.

WAN Connection

Detection

Such function allows you to verify whether network

connection is alive or not through Ping Detect.

Mode – Choose Always On or Ping Detect for the system to

execute for WAN detection.

 Ping IP/Hostname – If you choose Ping Detect as

Vigor2133 Series User’s Guide

56

detection mode, you have to type IP address in this field

for pinging.

 TTL (Time to Live) –If you choose Ping Detect as

detection mode, you have to type TTL value.

After finished the above settings, click OK to save the settings.

I

-

1

-

2

-

8

D

e

t

a

i

l

s

P

a

g

e

f

o

r

I

P

v

6

–

D

H

C

P

v

6

C

l

i

e

n

t

DHCPv6 client mode would use DHCPv6 protocol to obtain IPv6 address from server.

Available settings are explained as follows:

Item Description

DHCPv6 Client

Configuration

IAID - Type a number as IAID.

DUID – Display the DHCP unique ID used by such WAN

interface.

Authentication Protocol – Such protocol will be used for

the client to be authenticated by DHCPv6 server before

accessing into Internet. There are three types can be

specified, Reconfigure Key, Delayed and None. In general,

the default setting is None.

 Reconfigure Key – During the connection process,

DHCPv6 server will authenticate the client

automatically.

 Delayed - During the connection process, DHCPv6 server

will authenticate and identify the client based on the

key ID, realm and secret information specified in these

fields.

Key ID – Type a value (range from 1 to 65535) which will

be used to generate HMAC-MD5 value.

Realm – The name (1 to 31 characters) typed here will

identify the key which generates HMAC-MD5 value.

Vigor2133 Series User’s Guide

5

7

Secret – Type a text (1 to 31 characters) as s a unique

identifier for each client on each DHCP server.

WAN Connection

Detection

Such function allows you to verify whether network

connection is alive or not through NS Detect or Ping Detect.

Mode – Choose Always On, Ping Detect or NS Detect for

the system to execute for WAN detection. With NS Detect

mode, the system will check if network connection is

established or not, like IPv4 ARP Detect. Always On means

no detection will be executed. The network connection will

be on always.

 Ping IP/Hostname – If you choose Ping Detect as

detection mode, you have to type IP address in this field

for pinging.

 TTL (Time to Live) –If you choose Ping Detect as

detection mode, you have to type TTL value.

Bridge Mode Enable Bridge Mode - If the function is enabled, the router

will work as a bridge modem.

Enable Firewall – It is available when Bridge Mode is

enabled. When both Bridge Mode and Firewall check boxes

are enabled, the settings configured (user profiles) under

User Management will be ignored. And all of the filter rules

defined and enabled in Firewall menu will be activated.

Bridge Subnet – Make a bridge between the selected LAN

subnet and such WAN interface.

After finished the above settings, click OK to save the settings.

Vigor2133 Series User’s Guide

58

I

-

1

-

2

-

9

D

e

t

a

i

l

s

P

a

g

e

f

o

r

I

P

v

6

–

S

t

a

t

i

c

I

P

v

6

This type allows you to setup static IPv6 address for WAN interface.

Available settings are explained as follows:

Item Description

Static IPv6 Address

configuration

IPv6 Address – Type the IPv6 Static IP Address.

Prefix Length – Type the fixed value for prefix length.

Add – Click it to add a new entry.

Update – Click it to modify an existed entry.

Delete – Click it to remove an existed entry.

Current IPv6 Address

Table

Display current interface IPv6 address.

Static IPv6 Gateway IPv6 Gateway Address - Type your IPv6 gateway address

Vigor2133 Series User’s Guide

5

9

Configuration here.

WAN Connection

Detection

Such function allows you to verify whether network

connection is alive or not through Ping Detect.

Mode – Choose Always On or Ping Detect for the system to

execute for WAN detection. Always On means no detection

will be executed. The network connection will be on always.

 Ping IP/Hostname – If you choose Ping Detect as

detection mode, you have to type IP address in this field

for pinging.

 TTL (Time to Live) –If you choose Ping Detect as

detection mode, you have to type TTL value.

Bridge Mode Enable Bridge Mode - If the function is enabled, the router

will work as a bridge modem.

Enable Firewall – It is available when Bridge Mode is

enabled. When both Bridge Mode and Firewall check boxes

are enabled, the settings configured (user profiles) under

User Management will be ignored. And all of the filter rules

defined and enabled in Firewall menu will be activated.

Bridge Subnet – Make a bridge between the selected LAN

subnet and such WAN interface.

After finished the above settings, click OK to save the settings.

I

-

1

-

2

-

1

0

D

e

t

a

i

l

s

P

a

g

e

f

o

r

I

P

v

6

–

6

i

n

4

S

t

a

t

i

c

T

u

n

e

l

This type allows you to setup 6in4 Static Tunnel for WAN interface.

Such mode allows the router to access IPv6 network through IPv4 network.

However, 6in4 offers a prefix outside of 2002::0/16. So, you can use a fixed endpoint rather

than anycast endpoint. The mode has more reliability.

Available settings are explained as follows:

Item Description

Vigor2133 Series User’s Guide

6

0

Remote Endpoint IPv4

Address

Type the static IPv4 address for the remote server.

6in4 IPv6 Address Type the static IPv6 address for IPv4 tunnel with the value

for prefix length.

LAN Routed Prefix Type the static IPv6 address for LAN routing with the value

for prefix length.

Tunnel TTL Type the number for the data lifetime in tunnel.

WAN Connection

Detection

Such function allows you to verify whether network

connection is alive or not through Ping Detect.

Mode – Choose Always On or Ping Detect for the system to

execute for WAN detection. Always On means no detection

will be executed. The network connection will be on

always.

 Ping IP/Hostname – If you choose Ping Detect as

detection mode, you have to type IP address in this field

for pinging.

 TTL (Time to Live) –If you choose Ping Detect as

detection mode, you have to type TTL value.

After finished the above settings, click OK to save the settings.

Below shows an example for successful IPv6 connection based on 6in4 Static Tunnel mode.

Vigor2133 Series User’s Guide

61

I

-

1

-

2

-

1

D

e

t

a

i

l

s

P

a

g

e

f

o

r

I

P

v

6

–

6

r

d

This type allows you to setup 6rd for WAN interface.

Available settings are explained as follows:

Item Description

6rd Mode Auto 6rd – Retrieve 6rd prefix automatically from 6rd service

provider. The IPv4 WAN must be set as "DHCP".

Static 6rd - Set 6rd options manually.

IPv4 Border Relay Type the IPv4 addresses of the 6rd Border Relay for a given

6rd domain.

IPv4 Mask Length Type a number of high-order bits that are identical across all

CE IPv4 addresses within a given 6rd domain.

It may be any value between 0 and 32.

6rd Prefix Type the 6rd IPv6 address.

6rd Prefix Length Type the IPv6 prefix length for the 6rd IPv6 prefix in number

of bits.

WAN Connection

Detection

Such function allows you to verify whether network

connection is alive or not through Ping Detect.

Mode – Choose Always On or Ping Detect for the system to

execute for WAN detection. Always On means no detection

will be executed. The network connection will be on always.

 Ping IP/Hostname – If you choose Ping Detect as

detection mode, you have to type IP address in this field

for pinging.

 TTL (Time to Live) –If you choose Ping Detect as

detection mode, you have to type TTL value.

Vigor2133 Series User’s Guide

62

After finished the above settings, click OK to save the settings.

Below shows an example for successful IPv6 connection based on 6rd mode.

Vigor2133 Series User’s Guide

63

I

-

1

-

3

M

u

l

t

i

-

V

L

A

N

Multi-VLAN allows users to create profiles for specific WAN interface and bridge connections

for user applications that require very high network throughput. Simply go to WAN and select

Multi-VLAN.

G

e

n

e

r

a

l

This page shows the basic configurations used by every channel. In which, Channels 4

through 10 can be bridged to one or more of the 3 LAN ports P2 through P4. In addition,

Channels 4 through 6 can be configured as virtual WANs (WAN4 through WAN6).

Available settings are explained as follows:

Item Description

Channel Display the number of each channel.

Channels 1 is used by the Internet Access web user interface

and can not be configured here.

Channels 4 ~ 10 are configurable.

Enable Display whether the settings in this channel are enabled

(Yes) or not (No).

WAN Type Displays the physical medium that the channel will use.

VLAN Tag Displays the VLAN tag value that will be used for the packets

traveling on this channel.

Port-based Bridge The network traffic flowing on each channel will be

identified by the system via their VLAN Tags. Channels using

the same WAN type may not configure the same VLAN tag

value.

Enable - Check this box to enable the port-based bridge

function on this channel.

P1 ~ P4 – Check the box(es) to build bridge connection on

LAN.

To configure a PVC channel, click its channel number.

Vigor2133 Series User’s Guide

6

4

WAN links for Channel 4, 5 and 6 are provided for router-borne application such as TR-069.

The settings must be applied and obtained from your ISP. For your special request, please

contact with your ISP and then click WAN link of Channel 4, 5 or 6 to configure your router.

Available settings are explained as follows:

Item Description

Multi-VLAN Channel 4/5/6

Enable – Select to enable this channel.

Disable – Select to disable this channel.

General Settings VLAN Tag – Type the value as the VLAN ID number. Valid

settings are in the range from 1 to 4095. The network traffic

flowing on each channel will be identified by the system via

their VLAN Tags. Channels using the same WAN type may not

configure the same VLAN tag value.

Priority – Choose the number to determine the packet

priority for such VLAN. The range is from 0 to 7.

Open Port-based Bridge The settings here will create a bridge between the LAN ports

Vigor2133 Series User’s Guide

65

Connection for this

Channel

selected and the WAN. The WAN interface of the bridge

connection will be built upon the WAN type selected using

the VLAN tag configured.

Physical Members – Group the physical ports by checking the

corresponding check box(es) for applying the port-based

bridge connection.

Note: LAN port P1 is reserved for NAT use and cannot be

selected for bridging.

Open WAN Interface for

this Channel

Check the box to enable relating function.

WAN Application

 Management can be specified for general management

(Web configuration/telnet/TR069). If you choose

Management, the configuration for this VLAN will be

effective for Web configuration/telnet/TR069.

 IPTV - The IPTV configuration will allow the WAN

interface to send IGMP packets to IPTV servers.

WAN Setup – Choose PPPoE/PPPoA or Static or Dynamic IP

to determine what WAN settings must be configured.

ISP Access Setup, IP

Address From ISP, WAN IP

Network Settings, DNS

Server IP Address

For other settings, refer to Details Page for PPPoE in WAN1.

After finished the above settings, click OK to save the settings and return to previous page.

Click any index (7, 8, 9 and 10) to get the following web page:

Available settings are explained as follows:

Item Description

Multi-VLAN Channel Enable – Click it to enable the configuration of this channel.

Vigor2133 Series User’s Guide

66

7/8/9/10 Disable –Click it to disable the configuration of this channel.

General Settings VLAN Tag – Type the value as the VLAN ID number. Valid

settings are in the range from 1 to 4095. The network traffic

flowing on each channel will be identified by the system via

their VLAN Tags. Channels using the same WAN type may not

configure the same VLAN tag value.

Priority – Choose the number to determine the packet

priority for such VLAN. The range is from 0 to 7.

Bridge mode Enable – Click it to enable Bridge mode for such channel.

Physical Members – Group the physical ports by checking the

corresponding check box(es) for applying the bridge

connection.

After finished the above settings, click OK to save the settings.

Vigor2133 Series User’s Guide

6

7

I

-

1

-

4

W

A

N

B

u

d

g

e

t

This function is used to determine the data traffic volume for each WAN interface

respectively to prevent from overcharges for data transmission by the ISP. Please note that

the Quota Limit and Billing cycle day of month settings will need to be configured correctly

first in order for some period calculations to be performed correctly.

I

-

1

-

4

-

1

G

e

n

e

r

a

l

S

e

t

u

p

Item Description

Index The WAN port.

Click to configure WAN Budget for a particular WAN.

Enable v - WAN Budget is enabled on this WAN.

x - WAN Budget is disabled on this WAN.

Quota The current cycle’s Internet usage is expressed as x/y where

x is the cumulative usage and y is the upper limit. For

example, 100MB/200MB means the usage thus far in this

cycle is 100MB, and the upper limit is 200MB.

When quota exceeded Actions to be taken once the quota is reached.

Shutdown – WAN will be disabled.

Mail Alert – Email will be sent to the administrator.

Time cycle Reset frequency of the usage data.

Monthly – The Monthly option in the Criterion and Action

tab was used to set up the usage quota.

User Defined: The User Defined option in the Criterion and

Action tab was used to set up the usage qota.

Duration Start and end timestamps of the current cycle.

Click WAN1/ WAN3 link to open the following web page.

Vigor2133 Series User’s Guide

68

Available settings are explained as follows:

Item Description

Enable Check the box to enable such function.

Quota Limit Type the data traffic quota allowed for such WAN interface.

There are two unit (MB and GB) offered for you to specify.

When quota exceeded Check the box(es) as the condition(s) for the system to

perform when the traffic has exceeded the budget limit.

Shutdown WAN interface – All the outgoing traffic through

such WAN interface will be terminated.

 Using Notification Object – The system will send out a

notification based on the content of the notification

object.

 Set Mail Alert – The system will send out a warning

message to the administrator when the quota is running

out. However, the connection charges will be

calculated continuously.

 Set SMS message - The system will send out SMS

message to the administrator when the quota is running

out.

Monthly Some ISP might apply for the network limitation based on the

traffic limit per month. This setting is to offer a mechanism

of resetting the traffic record every month.

Data quota resets on day … – You can determine the starting

day in one month.

Custom This setting allows the user to define the billing cycle

according to his request. The WAN budget will be reset with

an interval of billing cycle.

Monthly is default setting. If long period or a short period is

required, use Custom. The period of cycle duration is

Vigor2133 Series User’s Guide

6

9

between 1 day and 60 days. You can determine the cycle

duration by specifying the days and the hours. In addition,

you can specify which day of today is in a cycle.

Use Cycle in hours –

 Cycle duration: Specify the days and hours to reset the

traffic record. For example, 7 means the whole cycle is 7

days; 20 means the whole cycle is 20 days. When the time

is up, the router will reset the traffic record

automatically.

 Today is day – Specify the day in the cycle as the starting

point which Vigor router will reset the traffic record. For

example, “3” means the third day of the cycle duration.

Use Cycle in days -

 Cycle duration: Specify the days to reset the traffic

record. For example, 7 means the whole cycle is 7 days;

20 means the whole cycle is 20 days. When the time is up,

the router will reset the traffic record automatically.

 Today is day – Specify the day and time for data quota

rest in the cycle as the starting point which Vigor router

will reset the traffic record. For example, “3” means the

third day of the cycle duration.

After finished the above settings, click OK to save the settings.

Vigor2133 Series User’s Guide

7

0

I

-

1

-

4

-

2

S

t

a

t

u

s

The status page displays the status WAN budget, including the duration and the usage.

If the WAN budget is exhausted, a lock will be displayed on the page if Shutdown WAN

interface is selected. Which means no data transmission will be carried out. Moreover, the

system will send out a warning message to the administrator if Mail Alert is selected. Or, the

system will send out SMS message to the administrator if SMS message is selected.

Vigor2133 Series User’s Guide

71

A

p

l

i

c

a

t

i

o

n

N

o

t

e

s

A

-

1

H

o

w

t

o

c

o

n

f

i

g

u

r

e

I

P

v

6

o

n

W

A

N

i

n

t

e

r

f

a

c

e

?

This document is going to demonstrate how to implement an IPv6 address on Vigor Router's

WAN.

1. Before configuring IPv6 on WAN, please make sure the router is connected to the IPv4

Internet.

2. Go to WAN >> Internet Access, click on IPv6 of the WAN interface that you would like to

configure an IPv6 address.

3. Select a Connection Type from the drop-down list, enter the required parameters. Then

click OK and reboot the router to apply the settings.

Vigor2133 Series User’s Guide

72

4. After accomplishing the configurations, Network Administrator may check the status from

the IPv6 tab on Online Status >> Physical Connection page.

5. Furthermore, Network Administrator may test the connectivity of IPv6 from the router by

going to Diagnostics >> Ping Diagnosis and selecting "IPv6".

Below we will provide some examples of configuring IPv6 with different connection types.

Vigor2133 Series User’s Guide

73

P

(

P

o

i

n

t

-

t

o

-

P

o

i

n

t

P

r

o

t

o

c

o

l

)

This applies if the IPv4 access mode is PPPoE, and the IPv4 ISP also provides an IPv6 address.

To use IPv6 PPP, you just need to choose the Connection Type to "PPP", no other setting is

required.

T

S

P

C

(

T

u

n

e

l

S

e

t

u

p

P

r

o

t

o

c

o

l

C

l

i

e

n

t

)

In this mode, the IPv6 connectivity is provided by a tunnel broker on the IPv4 Internet through

a tunnel set up by Tunnel Setup Protocol (TSP). To use TSPC, you'll need to sign up for a

tunnel broker service and get a username and password first, then, configure the router as

follows:

1. Set Connection Type to TSPC.

2. Enter the Username and Password registered at the TSP server.

3. Enter the IP or Domain Name of the TSPC server for Tunnel Broker.

Vigor2133 Series User’s Guide

7

4

S

t

a

t

i

c

I

P

v

6

If your ISP provides a static IPv6 address for you, you may configure that IPv6 address for WAN

by doing the following steps:

1. Set Connection Type to Static IPv6.

2. Enter the IPv6 address and Prefix Length which provided by the ISP, and click Add.

3. You should see the IPv6 address in Current IPv6 Address Table. Then, specify the IP

address of IPv6 Gateway.

Vigor2133 Series User’s Guide

75

6

i

n

4

S

t

a

t

i

c

T

u

n

e

l

In this mode, the IPv6 connectivity is provided by a tunnel broker on the IPv4 Internet through

a tunnel configured manually. To use 6in4 Static Tunnel, you need sign up for a tunnel broker

service and get an IPv6 address and routed IPv6 prefixes first. Then, configure the router as

follows:

1. Set Connection Type to 6in4 Static Tunnel.

2. Enter the tunnel server's IPv4 address in Remote Endpoint IPv4 Address.

3. Enter the router's IPv6 address in 6in4 IPv6 Address.

4. Enter the routed IPv6 prefix in LAN Routed Prefix.

Vigor2133 Series User’s Guide

76

I

-

2

L

A

N

Local Area Network (LAN) is a group of subnets regulated and ruled by router. The design of

network structure is related to what type of public IP addresses coming from your ISP.

The most generic function of Vigor router is NAT. It creates a private subnet of your own. As

mentioned previously, the router will talk to other public hosts on the Internet by using public

IP address and talking to local hosts by using its private IP address. What NAT does is to

translate the packets from public IP address to private IP address to forward the right packets

to the right host and vice versa. Besides, Vigor router has a built-in DHCP server that assigns

private IP address to each local host. See the following diagram for a briefly understanding.

In some special case, you may have a public IP subnet from your ISP such as 220.135.240.0/24.

This means that you can set up a public subnet or call second subnet that each host is

equipped with a public IP address. As a part of the public subnet, the Vigor router will serve

for IP routing to help hosts in the public subnet to communicate with other public hosts or

servers outside. Therefore, the router should be set as the gateway for public hosts.

Vigor2133 Series User’s Guide

7

W

h

a

t

i

s

R

o

u

t

i

n

g

I

n

f

o

r

m

a

t

i

o

n

P

r

o

t

o

c

o

l

(

R

I

P

)

Vigor router will exchange routing information with neighboring routers using the RIP to

accomplish IP routing. This allows users to change the information of the router such as IP

address and the routers will automatically inform for each other.

W

h

a

t

i

s

S

t

a

t

i

c

R

o

u

t

e

When you have several subnets in your LAN, sometimes a more effective and quicker way for

connection is the Static routes function rather than other method. You may simply set rules

to forward data from one specified subnet to another specified subnet without the presence

of RIP.

W

h

a

t

a

r

e

V

i

r

t

u

a

l

L

A

N

s

a

n

d

R

a

t

e

C

o

n

t

r

o

l

You can group local hosts by physical ports and create up to 8 virtual LANs. To manage the

communication between different groups, please set up rules in Virtual LAN (VLAN) function

and the rate of each.

Vigor2133 Series User’s Guide

78

W

e

b

U

s

e

r

I

n

t

e

r

f

a

c

e

A LAN comprises a collection of LAN clients, which are networked devices on your premises. A

LAN client can be a computer, a printer, a Voice-over-IP (VoIP) phone, a mobile phone, a

gaming console, an Internet Protocol Television (IPTV), etc, and can have either a wired

(using Ethernet cabling) or wireless (using Wi-Fi) network connection.

LAN clients within the same LAN are normally able to communicate with one another directly,

as they are peers to one another, unless measures, such as firewalls or VLANs, have been put

in place to restrict such access. Nowadays the most common LAN firewalls are implemented

on the LAN client itself. For example, Microsoft Windows since Windows XP and Apple OS X

have built-in firewalls that can be configured to restrict traffic coming in and going out of the

computer. VLANs, on the other hand, are usually set up using network switches or routers.

To communicate with the hosts outside of the LAN, LAN clients have to go through a network

gateway, which in most cases is a router that sits between the LAN and the ISP network,

which is the WAN. The router acts as a director to ensure traffic between the LAN and the

WAN reach their intended destinations.

I

-

2

-

1

G

e

n

e

r

a

l

S

e

t

u

p

This page provides you the general settings for LAN. Click LAN to open the LAN settings page

and choose General Setup.

There are four subnets provided by the router which allow users to divide groups into

different subnets (LAN1 – LAN4). In addition, different subnets can link for each other by

configuring Inter-LAN Routing. At present, LAN1 setting is fixed with NAT mode only. LAN2 –

LAN4 can be operated under NAT or Route mode. IP Routed Subnet can be operated under

Route mode.

Vigor2133 Series User’s Guide

79

Available settings are explained as follows:

Item Description

General Setup Allow to configure settings for each subnet respectively.

Index - Display all of the LAN items.

Status- Basically, LAN1 status is enabled in default.

LAN2 –LAN4 and IP Routed Subnet can be observed by

checking the box of Status.

DHCP- LAN1 is configured with DHCP in default. If required,

please check the DHCP box for each LAN.

IP Address - Display the IP address for each LAN item. Such

information is set in default and you can not modify it.

Details Page - Click it to access into the setting page. Each

LAN will have different LAN configuration page. Each LAN

must be configured in different subnet.

IPv6 – Click it to access into the settings page of IPv6.

DHCP Server Option DHCP packets can be processed by adding option number and

data information when such function is enabled.

For detailed information, refer to later section.

Force router to use “DNS

server IP address” …..

Force Vigor router to use DNS servers configured in

LAN1/LAN2/LAN3/LAN4 instead of DNS servers given by the

Internet Access server (PPPoE, PPTP, L2TP or DHCP server).

Inter-LAN Routing Check the box to link two or more different subnets (LAN and

LAN).

Inter-LAN Routing allows different LAN subnets to be

interconnected or isolated.

Vigor2133 Series User’s Guide

80

It is only available when the VLAN functionality is enabled.

Refer to section II-2-2 VLAN on how to set up VLANs.

In the Inter-LAN Routing matrix, a selected checkbox means

that the 2 intersecting LANs can communicate with each

other.

When you finish the configuration, please click OK to save and exit this page.

Info

To configure a subnet, select its Detials Page button to bring up the LAN

Details Page.

Vigor2133 Series User’s Guide

81

I

-

2

-

1

-

1

D

e

t

a

i

l

s

P

a

g

e

f

o

r

L

A

N

1

–

E

t

h

e

r

n

e

t

T

C

P

/

I

P

a

n

d

D

H

C

P

S

e

t

u

p

There are two configuration pages for LAN1, Ethernet TCP/IP and DHCP Setup (based on IPv4)

and IPv6 Setup. Click the tab for each type and refer to the following explanations for

detailed information.

Available settings are explained as follows:

Item Description

Network Configuration For NAT Usage,

IP Address - This is the IP address of the router. (Default:

192.168.1.1).

Subnet Mask - The subnet mask, together with the IP Address

field, indicates the maximum number of clients allowed on

the subnet. (Default: 255.255.255.0/ 24).

RIP Protocol Control,

Enable – When Enabled, the router will attempt to exchange

routing information with neighbouring routers using the

Routing Information Protocol.

DHCP Server

Configuration

DHCP stands for Dynamic Host Configuration Protocol. The

router by factory default acts a DHCP server for your network

so it automatically dispatches related IP settings to any local

user configured as a DHCP client. It is highly recommended

that you leave the router enabled as a DHCP server if you do

not have a DHCP server for your network.

If you want to use another DHCP server in the network other

than the Vigor Router’s, you can let Relay Agent help you to

redirect the DHCP request to the specified location.

Disable Server – Let you manually assign IP address to every

host in the LAN.

Enable Server - Let the router assign IP address to every host

in the LAN.

 Start IP Address - The beginning LAN IP address that is

given out to LAN DHCP clients.

 IP Pool Counts - The maximum number of IP addresses

to be handed out by DHCP. The default value is 200.

Valid range is between 1 and 253. The actual number of

IP addresses available for assignment is the IP Pool

Vigor2133 Series User’s Guide

82

Counts, or 253 minus the last octet of the Start IP

Address, whichever is smaller.

 Gateway IP Address - The IP address of the gateway,

which is the host on the LAN that relays all traffic

coming into and going out of the LAN. The gateway is

normally the router, and therefore the Gateway IP

Address should be identical to the IP Address in the

Network Configuration section above.

 Lease Time - The maximum duration DHCP-issued IP

addresses can be used before they have to be renewed.

 Clear DHCP lease for inactive clients periodically - If

selected, the router sends ARP requests recycles IP

addresses previously assigned to inactive DHCP clients

to prevent exhaustion of the IP address pool.

Note: When Clear DHCP lease for inactive clients

periodically is enabled, router will do the following:

 Check activities of DHCP clients by ARP requests

every minute when the available DHCP IP

addresses are less than 30

 Clear DHCP lease when the client is not

responding ARP replies.

Enable Relay Agent – When selected, all DHCP requests are

forwarded to a DHCP server outside of the LAN subnet, and

whose address is specified in the DHCP Server IP Address

field.

 DHCP Server IP Address – It is available when Enable

Relay Agent is checked. Set the IP address of the DHCP

server you are going to use so the Relay Agent can help

to forward the DHCP request to the DHCP server.

DNS Server IP Address DNS stands for Domain Name System. Every Internet host

must have a unique IP address, also they may have a

human-friendly, easy to remember name such as

www.yahoo.com. The DNS server converts the user-friendly

name into its equivalent IP address.

Primary IP Address -You must specify a DNS server IP address

here because your ISP should provide you with usually more

than one DNS Server.

Secondary IP Address - You can specify secondary DNS server

IP address here because your ISP often provides you more

than one DNS Server.

The default DNS Server IP address can be found via Online

Status:

If both the Primary IP and Secondary IP Address fields are left

empty, the router will assign its own IP address to local users

as a DNS proxy server and maintain a DNS cache.

If the IP address of a domain name is already in the DNS

cache, the router will resolve the domain name immediately.

Otherwise, the router forwards the DNS query packet to the

external DNS server by establishing a WAN (e.g. DSL/Cable)

connection.

Vigor2133 Series User’s Guide

83

When you finish the configuration, please click OK to save and exit this page.

Private IP addresses can be assigned automatically to LAN clients using Dynamic Host

Configuration Protocol (DHCP), or manually assigned. The DHCP server can either be the

router (the most common case), or a separate server, that hands out IP addresses to DHCP

clients.

Alternatively, static IP addresses can be manually configured on LAN clients as part of their

network settings. No matter how IP addresses are configured, it is important that no two

devices get the same IP address. If both DHCP and static assignment are used on a network, it

is important to exclude the static IP addresses from the DHCP IP pool. For example, if your

LAN uses the 192.168.1.x subnet and you have 20 DHCP clients and 20 static IP clients, you

could configure 192.168.1.10 as the Start IP Address, 50 as the IP Pool Counts (enough for the

current number of DHCP clients, plus room for future expansion), and use addresses greater

than 192.168.1.100 for static assignment.

I

-

2

-

1

-

2

D

e

t

a

i

l

s

P

a

g

e

f

o

r

L

A

N

2

~

L

A

N

4

Available settings are explained as follows:

Item Description

Network Configuration Enable/Disable - Click Enable to enable such configuration;

click Disable to disable such configuration.

For NAT Usage - Click this radio button to invoke NAT

function.

For Routing Usage - Click this radio button to invoke this

function.

IP Address - This is the IP address of the router. (Default:

192.168.1.1).

Subnet Mask - The subnet mask, together with the IP Address

field, indicates the maximum number of clients allowed on

the subnet. (Default: 255.255.255.0/ 24).

DHCP Server

Configuration

DHCP stands for Dynamic Host Configuration Protocol. The

router by factory default acts a DHCP server for your network

so it automatically dispatch related IP settings to any local

user configured as a DHCP client. It is highly recommended

that you leave the router enabled as a DHCP server if you do

not have a DHCP server for your network.

Disable Server – Let you manually assign IP address to every

Vigor2133 Series User’s Guide

84

host in the LAN.

Enable Server - Let the router assign IP address to every host

in the LAN.

 Start IP Address - The beginning LAN IP address that is

given out to LAN DHCP clients.

 IP Pool Counts - The maximum number of IP addresses

to be handed out by DHCP. The default value is 100.

Valid range is between 1 and 253. The actual number of

IP addresses available for assignment is the IP Pool

Counts, or 253 minus the last octet of the Start IP

Address, whichever is smaller.

 Gateway IP Address - The IP address of the gateway,

which is the host on the LAN that relays all traffic

coming into and going out of the LAN. The gateway is

normally the router, and therefore the Gateway IP

Address should be identical to the IP Address in the

Network Configuration section above.

 Lease Time - The maximum duration DHCP-issued IP

addresses can be used before they have to be renewed.

 Clear DHCP lease for inactive clients periodically - If

selected, the router sends ARP requests recycles IP

addresses previously assigned to inactive DHCP clients

to prevent exhaustion of the IP address pool.

Note: When Clear DHCP lease for inactive clients

periodically is enabled, router will do the following:

 Check activities of DHCP clients by ARP requests

every minute when the available DHCP IP

addresses are less than 30

 Clear DHCP lease when the client is not

responding ARP replies.

Enable Relay Agent – When selected, all DHCP requests are

forwarded to a DHCP server outside of the LAN subnet, and

whose address is specified in the DHCP Server IP Address

field.

 DHCP Server IP Address – It is available when Enable

Relay Agent is checked. Set the IP address of the DHCP

server you are going to use so the Relay Agent can help

to forward the DHCP request to the DHCP server.

DNS Server IP Address DNS stands for Domain Name System. Every Internet host

must have a unique IP address, also they may have a

human-friendly, easy to remember name such as

www.yahoo.com. The DNS server converts the user-friendly

name into its equivalent IP address.

Primary IP Address -You must specify a DNS server IP address

here because your ISP should provide you with usually more

than one DNS Server.

Secondary IP Address - You can specify secondary DNS server

IP address here because your ISP often provides you more

than one DNS Server.

The default DNS Server IP address can be found via Online

Status:

Vigor2133 Series User’s Guide

85

If both the Primary IP and Secondary IP Address fields are left

empty, the router will assign its own IP address to local users

as a DNS proxy server and maintain a DNS cache.

If the IP address of a domain name is already in the DNS

cache, the router will resolve the domain name immediately.

Otherwise, the router forwards the DNS query packet to the

external DNS server by establishing a WAN (e.g. DSL/Cable)

connection.

When you finish the configuration, please click OK to save and exit this page.

I

-

2

-

1

-

3

D

e

t

a

i

l

s

P

a

g

e

f

o

r

I

P

R

o

u

t

e

d

S

u

b

n

e

t

Available settings are explained as follows:

Item Description

Network Configuration Enable/Disable - Click Enable to enable such configuration;

click Disable to disable such configuration.

For Routing Usage,

IP Address - This is the IP address of the router. (Default:

192.168.1.1).

Subnet Mask - The subnet mask, together with the IP Address

field, indicates the maximum number of clients allowed on

the subnet. (Default: 255.255.255.0/ 24).

RIP Protocol Control,

Enable – When Enabled, the router will attempt to exchange

routing information with neighbouring routers using the

Vigor2133 Series User’s Guide

86

Routing Information Protocol.

DHCP Server

Configuration

DHCP stands for Dynamic Host Configuration Protocol. The

router by factory default acts a DHCP server for your network

so it automatically dispatch related IP settings to any local

user configured as a DHCP client. It is highly recommended

that you leave the router enabled as a DHCP server if you do

not have a DHCP server for your network.

If you want to use another DHCP server in the network other

than the Vigor Router’s, you can let Relay Agent help you to

redirect the DHCP request to the specified location.

Start IP Address - The beginning LAN IP address that is given

out to LAN DHCP clients.

IP Pool Counts - The maximum number of IP addresses to be

handed out by DHCP. The default value is 100. Valid range is

between 1 and 253. The actual number of IP addresses

available for assignment is the IP Pool Counts, or 253 minus

the last octet of the Start IP Address, whichever is smaller.

Gateway IP Address - The IP address of the gateway, which is

the host on the LAN that relays all traffic coming into and

going out of the LAN. The gateway is normally the router, and

therefore the Gateway IP Address should be identical to the

IP Address in the Network Configuration section above.

Lease Time - The maximum duration DHCP-issued IP

addresses can be used before they have to be renewed.

Use LAN Port – Specify an IP for IP Route Subnet. If it is

enabled, DHCP server will assign IP address automatically for

the clients coming from P1 and/or P2. Please check the box

of P1 and P2.

Use MAC Address - Check such box to specify MAC address.

 MAC Address: Enter the MAC Address of the host one by

one and click Add to create a list of hosts which can be

assigned, deleted or edited from above pool. Set a list

of MAC Address for 2

nd

DHCP server will help router to

assign the correct IP address of the correct subnet to

the correct host. So those hosts in 2

nd

subnet won’t get

an IP address belonging to 1

st

subnet.

Add – Type the MAC address in the boxes and click this button

to add.

Delete – Click it to delete the selected MAC address.

Edit – Click it to edit the selected MAC address.

Cancel – Click it to cancel the job of adding, deleting and

editing.

When you finish the configuration, please click OK to save and exit this page.

I

-

2

-

1

-

4

D

e

t

a

i

l

s

P

a

g

e

f

o

r

L

A

N

I

P

v

6

S

e

t

u

p

There are two configuration pages for each LAN. Click the tab for each type and refer to the

following explanations for detailed information. Below shows the settings page for IPv6.

Vigor2133 Series User’s Guide

8

7

It provides 2 daemons for LAN side IPv6 address configuration. One is SLAAC(stateless) and

the other is DHCPv6 (Stateful) server.

Available settings are explained as follows:

Item Description

Enable Check the box to enable the configuration of LAN 1 IPv6

Setup.

WAN Primary Interface Use the drop down list to specify a WAN interface for IPv6.

Static IPv6 Address

configuration

IPv6 Address –Type static IPv6 address for LAN.

Prefix Length – Type the fixed value for prefix length.

Add – Click it to add a new entry.

Vigor2133 Series User’s Guide

88

Delete – Click it to remove an existed entry.

Unique Local Address

(ULA) configuration

Unique Local Addresses (ULAs) are private IPv6 addresses

assigned to LAN clients.

Off - ULA is disabled.

Manually ULA Prefix - LAN clients will be assigned ULAs

generated based on the prefix manually entered.

Auto ULA Prefix - LAN clients will be assigned ULAs using an

automatically-determined prefix.

Current IPv6 Address

Table

Display current used IPv6 addresses.

DNS Server IPv6 Address Deploy when WAN is up – The RA (router advertisement)

packets will be sent to LAN PC with DNS server information

only when network connection by any one of WAN interfaces

is up.

Enable – The RA (router advertisement) packets will be sent

to LAN PC with DNS server information no matter WAN

connection is up or not.

 Primary DNS Sever – Type the IPv6 address for Primary

DNS server.

 Secondary DNS Server –Type another IPv6 address for

DNS server if required.

Disable – DNS server will not be used.

Management Configures the Managed Address Configuration flag (M-bit) in

Route Advertisements.

 Off - No configuration information is sent using Route

Advertisements.

 SLAAC(stateless) - M-bit is unset.

 DHCPv6(stateful) - M-bit is set, which indicates to LAN

clients that they should acquire all IPv6 configuration

information from a DHCPv6 server. The DHCPv6 server

can either be the one built into the Vigor2860, or a

separate DHCPv6 server.

Other Option(O-bit) When selected, the Other Configuration flag is set, which

indicates to LAN clients that IPv6 configuration information

besides LAN IPv6 addresses is available from a DHCPv6

server.

Setting the M-bit (see Management above) has the same

effect as implicitly setting the O-bit, as DHCPv6 supplies all

IPv6 configuration information, including what is indicated as

available when the O-bit is set.

DHCPv6 Server Enable Server –Click it to enable DHCPv6 server. DHCPv6

Server could assign IPv6 address to PC according to the

Start/End IPv6 address configuration.

Vigor2133 Series User’s Guide

8

9

Disable Server –Click it to disable DHCPv6 server.

Auto IPv6 range – After check the box, Vigor router will

assign the IPv6 range automatically.

Start IPv6 Address / End IPv6 Address –Type the start and

end address for IPv6 server.

Advance setting – Click the Edit button to configure

advanced IPv6 settings for DHCPv6 server.

Advance setting The Advanced Settings page has additional settings for

Router Advertisement and enabling multiple WANs for IPv6

traffic.

Router Advertisement Configuration – Click Enable to

enable router advertisement server. The router

advertisement daemon sends Router Advertisement

messages, specified by RFC 2461, to a local Ethernet LAN

periodically and when requested by a node sending a Router

Solicitation message. These messages are required for IPv6

stateless auto-configuration.

Disable – Click it to disable router advertisement server.

Hop Limt – The value is required for the device behind the

router when IPv6 is in use.

Min/Max Interval Time (sec) – It defines the interval

(between minimum time and maximum time) for sending RA

(Router Advertisement) packets.

Vigor2133 Series User’s Guide

9

0

Default Lifetime (sec) –Within such period of time,

Vigor2133 can be treated as the default gateway.

Default Preference – It determines the priority of the host

behind the router when RA (Router Advertisement) packets

are transmitted.

MTU – It means Max Transmit Unit for packet. If Auto is

selected, the router will determine the MTU value for LAN.

RIPng Protocol –RIPng (RIP next generation) offers the same

functions and benefits as IPv4 RIP v2.

Extension WAN – In addition to the default WAN used for

IPv6 traffic specified in the WAN Primary Interface in the LAN

IPv6 Setup page, additional WANs can be selected to carry

IPv6 traffic by enabling them in the Extension WAN section.

Available WAN – Additional WANs available but not currently

selected to carry IPv6 traffic.

Selected WAN – Additional WANs selected to carry IPv6

traffic.

After making changes on the Advance setting page, click the OK button to retain the changes

and return to the LAN IPv6 Setup page. Be sure to click OK on the LAN IPv6 Setup page or else

changes made on the Advance setting page will not be saved.

I

-

2

-

1

-

5

A

d

v

a

n

c

e

d

D

H

C

P

O

p

t

i

o

n

s

DHCP Options can be configured by clicking the Advanced button on the LAN General Setup

screen.

Available settings are explained as follows:

Item Description

Vigor2133 Series User’s Guide

91

Customized List Shows all the DHCP options that have been configured in the

system.

Enable If selected, DHCP option entry is enabled.

If unselected, DHCP option entry is disabled.

Interface LAN interface(s) to which this entry is applicable.

Next Server IP

Address/SIAddr

Overrides the DHCP Next Server IP address (DHCP Option 66)

supplied by the DHCP server.

Option Number DHCP option number (e.g., 100).

DataType Type of data in the Data field:

ASCII Character - A text string. Example: /path.

Hexadecimal Digit - A hexadecimal string. Valid characters

are from 0 to 9 and from a to f. Example: 2f70617468.

Address List - One or more IPv4 addresses, delimited by

commas.

Data Data of this DHCP option.

To add a DHCP option entry from scratch, clear the data entry fields (Enable, Interface,

Option Number, DataType and Data) by clicking Reset. After filling in the values, click Add

to create the new entry.

To add a DHCP option entry modeled after an existing entry, click the model entry in

Customized List. The data entry fields will be populated with values from the model entry.

After making all necessary changes for the new entry, click Add to create it.

To modify an existing DHCP option entry, click on it in Customized List. The data entry fields

will be populated with the current values from the entry. After making all necessary changes,

click Update to save the changes.

To delete a DHCP option entry, click on it in Customized List, and then click Delete.

Vigor2133 Series User’s Guide

92

I

-

2

-

2

V

L

A

N

Virtual Local Area Networks (VLANs) allow you to subdivide your LAN to facilitate

management or to improve network security.

Select LAN>>VLAN from the menu bar of the Web UI to bring up the VLAN Configuration page.

T

a

g

e

d

V

L

A

N

The tagged VLANs (802.1q) can mark data with a VLAN identifier. This identifier can be

carried through an onward Ethernet switch to specific ports. The specific VLAN clients can

also pick up this identifier as it is just passed to the LAN. You can set the priorities for

LAN-side QoS. You can assign each of VLANs to each of the different IP subnets that the router

may also be operating, to provide even more isolation. The said functionality is tag-based

multi-subnet.

P

o

r

t

-

B

a

s

e

d

V

L

A

N

Relative to tag-based VLAN which groups clients with an identifier, port-based VLAN uses

physical ports (P1 ~ P4) to separate the clients into different VLAN group.

Virtual LAN function provides you a very convenient way to manage hosts by grouping them

based on the physical port. The multi-subnet can let a small businesses have much better

isolation for multi-occupancy applications. Go to LAN page and select VLAN. The following

page will appear. Click Enable to invoke VLAN function.

Below is an example page in Vigor2133ac:

Vigor2133 Series User’s Guide

93

Info

Settings in this page only applied to LAN port but not WAN port.

Available settings are explained as follows:

Item Description

Enable Click it to enable VLAN configuration.

LAN P1 – P4– Check the LAN port(s) to group them under the

selected VLAN.

Wireless LAN (2.4GHz) SSID1 – SSID4 – Check the SSID boxes to group them under the

selected VLAN.

Wireless LAN (5GHz) SSID1 – SSID4 – Check the SSID boxes to group them under the

selected VLAN.

This option is only available for Vigor2133ac.

Subnet Choose one of them to make the selected VLAN mapping to

the specified subnet only. For example, LAN1 is specified for

VLAN0. It means that PCs grouped under VLAN0 can get the

IP address(es) that specified by the subnet.

VLAN Tag

Enable – Check the box to enable the function of VLAN with

tag.

The router will add specific VLAN number to all packets on

the LAN while sending them out.

Please type the tag value and specify the priority for the

packets sending by LAN.

VID – Type the value as the VLAN ID number. The range is

form 0 to 4095. VIDs must be unique.

Priority – Valid values are from 0 to 7, where 1 has the

lowest priority, followed by 0, and finally from 2 to 7 in

increasing order of priority.

Permit untagged device in

P1 to access router

Select to allow untagged hosts connected to LAN port P1 to

access the router. In case you have incorrectly configured

VLAN functionality, you will still be able to access the router

via the Web UI, and telnet and SSH shells to adjust the

configuration.

Info

Leave one VLAN untagged at least to prevent from not connecting to Vigor

router due to unexpected error.

The Vigor router supports up to 8 VLANs. Each VLAN can be set up to use one or more of the

Ethernet ports and wireless LAN Service Set Identifiers (SSIDs). Within the grid of VLANs

(horizontal rows) and LAN interfaces (vertical columns),

 all hosts within the same VLAN (horizontal row) are visible to one another

 all hosts connected to the same LAN or WLAN interface (vertical column) are visible to

one another if

- they belong to the same VLAN, or

Vigor2133 Series User’s Guide

9

4

- they belong to different VLANs, and inter-LAN routing (LAN>>General Setup) between

them is enabled (see below).

Inter-LAN Routing allows different LAN subnets to be interconnected or isolated. It is

only available when the VLAN functionality is enabled. In the Inter-LAN Routing matrix,

a selected checkbox means that the 2 intersecting LANs can communicate with each

other.

Vigor2133 series features a hugely flexible VLAN system. In its simplest form, each of the

Gigabit LAN ports can be isolated from each other, for example to feed different companies

or departments but keeping their local traffic completely separated.

C

o

n

f

i

g

u

r

i

n

g

p

o

r

t

-

b

a

s

e

d

V

L

A

N

f

o

r

w

i

r

e

l

e

s

a

n

d

n

o

n

-

w

i

r

e

l

e

s

c

l

i

e

n

t

s

1. All the wire network clients are categorized to group VLAN0 in subnet 192.168.1.0/24

(LAN1).

2. All the wireless network clients are categorized to group VLAN1 in subnet

192.168.2.0/24 (LAN2).

3. Open LAN>>VLAN. Check the boxes according to the statement in step 1 and Step 2.

4. Click OK.

Vigor2133 Series User’s Guide

95

5. Open LAN>>General Setup. If you want to let the clients in both groups communicate

with each other, simply activate Inter-LAN Routing by checking the box between LAN1

and LAN2.

Vigor router supports up to six private IP subnets on LAN. Each can be independent

(isolated) or common (able to communicate with each other). This is ideal for

departmental or multi-occupancy applications.

Info

As for the VLAN applications, refer to “Appendix I: VLAN Application on

Vigor Router” for more detailed information.

I

-

2

-

3

B

i

n

d

I

P

t

o

M

A

C

This function is used to bind the IP and MAC address in LAN to have a strengthening control in

network. With the Bind IP to MAC feature you can reserve LAN IP addresses for LAN clients.

Each reserved IP address is associated with a Media Access Control (MAC) address.

Click LAN and click Bind IP to MAC to open the setup page.

Vigor2133 Series User’s Guide

96

Available settings are explained as follows:

Item Description

Enable Click this radio button to invoke this function. However,

IP/MAC which is not listed in IP Bind List also can connect to

Internet.

Disable Click this radio button to disable this function. All the

settings on this page will be invalid.

Vigor2133 Series User’s Guide

9

7

Strict Bind Check the box to block the connection of the IP/MAC which is

not listed in IP Bind List.

LAN clients will be assigned IP addresses according to the

MAC-to-IP address associations on this page. LAN client

whose MAC address has not been bound to an IP address will

be denied network access.

Note: Before selecting Strict Bind, make sure at least one

valid MAC address has been bound to an IP address.

Otherwise no LAN clients will have network access, and it

will not be possible to connect to the router to make changes

to its configuration.

Apply Strict Bind to Subnet – Choose the subnet(s) for

applying the rules of Bind IP to MAC.

ARP Table This table is the LAN ARP table of this router. The

information for IP and MAC will be displayed in this field.

Each pair of IP and MAC address listed in ARP table can be

selected and added to IP Bind List by clicking Add below.

Select All Select all entries in the ARP Table for manipulation.

Sort Reorder the entry based on the IP address.

Refresh Refresh the ARP table listed below to obtain the newest ARP

table information.

Add / Update to IP Bind

List

IP Address – Type the IP address to be associated with a

MAC address.

Mac Address – Type the MAC address of the LAN client’s

network interface.

Comment – Type a brief description for the entry.

Add - It allows you to add the one you choose from the ARP

table or the IP/MAC address typed in Add and Edit to the

table of IP Bind List.

Update - It allows you to edit and modify the selected IP

address and MAC address that you create before.

Delete - You can remove any item listed in IP Bind List.

Simply click and select the one, and click Delete. The

selected item will be removed from the IP Bind List.

IP Bind List It displays a list for the IP bind to MAC information.

Backup IP Bind List Click Backup and enter a filename to back up IP Bind List to a

file.

Upload From File

Click Browse… to select an IP Bind List backup file. Click

Restore to restore the backup and overwrite the existing

list.

Vigor2133 Series User’s Guide

98

Info

Before you select Strict Bind, you have to bind one set of IP/MAC address for

one PC. If not, no one of the PCs can access into Internet. And the web user

interface of the router might not be accessed.

When you finish the configuration, click OK to save the settings.

Vigor2133 Series User’s Guide

9

I

-

2

-

4

L

A

N

P

o

r

t

M

i

r

o

r

The LAN Port Mirror function allows network traffic of select LAN ports to be forwarded to

another LAN port for analysis. This is useful for enforcing policies, detecting unauthorized

access, monitoring network performance, etc.

Select LAN>>LAN Port Mirror from the menu bar of the Web UI to bring up the LAN Port

Mirror configuration page.

Available settings are explained as follows:

Item Description

Port Mirror Enables or disables LAN Port Mirroring.

Mirror Port One and only one port is selected as the mirror port, to

which traffic is to be forwarded.

Mirrored Tx Port Port(s) whose outbound traffic will be forwarded to the

mirror port.

Mirrored Rx Port Port(s) whose inbound traffic will be forwarded to the mirror

port.

After finishing all the settings here, please click OK to save the configuration.

Vigor2133 Series User’s Guide

100

I

-

2

-

5

W

i

r

e

d

8

0

2

.

1

x

Wired 802.1X provides authentication for clients wishing to connect to the LAN by Ethernet.

Only one client can be authenticated on each LAN port.

Select LAN>>Wired 802.1X from the menu bar of the Web UI to bring up the Wired 802.1X

configuration page.

Available settings are explained as follows:

Item Description

Enable Check the box to enable LAN 802.1x function.

802.1X ports 802.1X authentication will be available for the selected LAN

ports.

After finishing all the settings here, please click OK to save the configuration.

Vigor2133 Series User’s Guide

101

I

-

3

H

a

r

d

w

a

r

e

A

c

e

l

e

r

a

t

i

o

n

Hardware Acceleration is also called PPA in DrayTek for it is based on Protocol Processing

Engine (PPE) of Infineon. It can only support 128 sessions for network traffic (IN & OUT) with

implementing three kinds of modes - Disable, Auto and Manual.

When the data traffic is heavy and data transmission is getting slowly and slowly, you can

configure this page to accelerate the data streaming by hardware itself. Open Hardware

Acceleration to access into the following page:

Available settings are explained as follows:

Item Description

Mode Disabled – The default setting.

Auto - When the hardware acceleration is configured with

the Auto mode, the sessions with the heaviest loading and

the lower latency traffic will be added into PPA. However,

the Auto mode does not support UDP protocol by designed.

Manual - The Manual mode implements three sub-items--

Accelerate most heavy traffic sessions, Apply the Class Rule

in Quality of Service, and Specific Hosts. Each of these

sub-items can support TCP and UDP protocol.

Protocol There are two types supported by this function, TCP and

UDP.

Vigor2133 Series User’s Guide

102

Option Accelerate heaviest traffic sessions – Such option is

available in Auto Mode, too. But the UDP protocol is only

supported in this sub-item.

Apply the Class Rule

in Quality of Service – Users can apply

the information provided by QoS in this sub-item.

Please visit our website for referring the detailed

configuration of QoS.

Specific Hosts – This sub-item provides 5 hosts for adding

NAT sessions into the PPA. For the PPA only supports 128

sessions, these hosts will share these sessions. Therefore,

the performance will be lower than only one host.

Choose this option to specify certain PCs on LAN to apply the

hardware acceleration.

 Enable – Check the box to make PC(s) specified in

the selected index entry to be applied.

 Dest Port Start – Type the starting port for the

PC(s) in LAN.

 Dest Port End – Type the ending port for the PC(s)

in LAN.

 Private IP/Choose PC – Type the IP address as the

selected host. Or click the Choose PC button to

specify one IP address from the pop-up window.

Checking the PPA status

For checking whether the rule of PPA is working or not, a user can login to Vigor2133 series by

using telnet. User can view how many sessions are transferring in each direction of PPA table

after entering “ppa –v”.

Vigor2133 Series User’s Guide

103

I

-

4

N

A

T

Usually, the router serves as an NAT (Network Address Translation) router. NAT is a

mechanism that one or more private IP addresses can be mapped into a single public one.

Public IP address is usually assigned by your ISP, for which you may get charged. Private IP

addresses are recognized only among internal hosts.

When the outgoing packets destined to some public server on the Internet reach the NAT

router, the router will change its source address into the public IP address of the router,

select the available public port, and then forward it. At the same time, the router shall list an

entry in a table to memorize this address/port-mapping relationship. When the public server

response, the incoming traffic, of course, is destined to the router’s public IP address and the

router will do the inversion based on its table. Therefore, the internal host can communicate

with external host smoothly.

The benefit of the NAT includes:

 Save cost on applying public IP address and apply efficient usage of IP address. NAT

allows the internal IP addresses of local hosts to be translated into one public IP address,

thus you can have only one IP address on behalf of the entire internal hosts.

 Enhance security of the internal network by obscuring the IP address. There are

many attacks aiming victims based on the IP address. Since the attacker cannot be

aware of any private IP addresses, the NAT function can protect the internal network.

Info

On NAT page, you will see the private IP address defined in RFC-1918.

Usually we use the 192.168.1.0/24 subnet for the router. As stated before,

the NAT facility can map one or more IP addresses and/or service ports into

different specified services. In other words, the NAT function can be

achieved by using port mapping methods.

Vigor2133 Series User’s Guide

104

W

e

b

U

s

e

r

I

n

t

e

r

f

a

c

e

I

-

4

-

1

P

o

r

t

R

e

d

i

r

e

c

t

i

o

n

Port Redirection is usually set up for server related service inside the local network (LAN),

such as web servers, FTP servers, E-mail servers etc. Most of the case, you need a public IP

address for each server and this public IP address/domain name are recognized by all users.

Since the server is actually located inside the LAN, the network well protected by NAT of the

router, and identified by its private IP address/port, the goal of Port Redirection function is

to forward all access request with public IP address from external users to the mapping

private IP address/port of the server.

The port redirection can only apply to incoming traffic.

To use this function, please go to NAT page and choose Port Redirection web page. The Port

Redirection Table provides 40 port-mapping entries for the internal hosts.

Vigor2133 Series User’s Guide

105

Each item is explained as follows:

Item Description

Index Display the number of the profile.

Service Name Display the description of the specific network service.

WAN Interface Display the WAN IP address used by the profile.

Protocol Display the transport layer protocol (TCP or UDP).

Public Port Display the port number which will be redirected to the

specified Private IP and Port of the internal host.

Source IP Display the source IP address or object.

Private IP Display the IP address of the internal host providing the

service.

Status Display if the profile is enabled (v) or not (x).

Press any number under Index to access into next page for configuring port redirection.

Available settings are explained as follows:

Vigor2133 Series User’s Guide

106

Item Description

Enable Check this box to enable such port redirection setting.

Mode Two options (Single and Range) are provided here for you to

choose. To set a range for the specific service, select Range.

In Range mode, if the public port (start port and end port)

and the starting IP of private IP had been entered, the

system will calculate and display the ending IP of private IP

automatically.

Service Name Enter the description of the specific network service.

Protocol Select the transport layer protocol (TCP or UDP).

WAN Interface Select the WAN IP used for port redirection. There are eight

WAN IP alias that can be selected and used for port

redirection.

The default setting is All which means all the incoming data

from any port will be redirected to all intefaces.

Public Port Specify which port can be redirected to the specified Private

IP and Port of the internal host. If you choose Range as the

port redirection mode, you will see two boxes on this field.

Type the required number on the first box (as the starting

port) and the second box (as the ending port).

Source IP Use the drop down list to specify an IP object. Or click IP

Object link to create a new one for applying.

Private IP Specify the private IP address of the internal host providing

the service. If you choose Range as the port redirection

mode, you will see two boxes on this field. Type a complete

IP address in the first box (as the starting point). The second

one will be assigned automatically later.

Private Port Specify the private port number of the service offered by the

internal host.

After finishing all the settings here, please click OK to save the configuration.

Note that the router has its own built-in services (servers) such as Telnet, HTTP and FTP etc.

Since the common port numbers of these services (servers) are all the same, you may need to

reset the router in order to avoid confliction.

For example, the built-in web user interface in the router is with default port 80, which may

conflict with the web server in the local network, http://192.168.1.13:80. Therefore, you

need to change the router’s http port to any one other than the default port 80 to avoid

conflict, such as 8080. This can be set in the System Maintenance >>Management Setup. You

then will access the admin screen of by suffixing the IP address with 8080, e.g.,

http://192.168.1.1:8080 instead of port 80.

Vigor2133 Series User’s Guide

10

7

Vigor2133 Series User’s Guide

108

I

-

4

-

2

D

M

Z

H

o

s

t

As mentioned above, Port Redirection can redirect incoming TCP/UDP or other traffic on

particular ports to the specific private IP address/port of host in the LAN. However, other IP

protocols, for example Protocols 50 (ESP) and 51 (AH), do not travel on a fixed port. Vigor

router provides a facility DMZ Host that maps ALL unsolicited data on any protocol to a single

host in the LAN. Regular web surfing and other such Internet activities from other clients will

continue to work without inappropriate interruption. DMZ Host allows a defined internal user

to be totally exposed to the Internet, which usually helps some special applications such as

Netmeeting or Internet Games etc.

The security properties of NAT are somewhat bypassed if you set up DMZ host. We suggest

you to add additional filter rules or a secondary firewall.

Click DMZ Host to open the following page. You can set different DMZ host for each WAN

interface. Click the WAN tab to switch into the configuration page for that WAN.

Vigor2133 Series User’s Guide

10

9

Available settings are explained as follows:

Item Description

Choose Private IP or None first.

Private IP Enter the private IP address of the DMZ host, or click Choose

IP to select one.

Choose IP Click this button and then a window will automatically pop

up, as depicted below. The window consists of a list of private

IP addresses of all hosts in your LAN network. Select one

private IP address in the list to be the DMZ host.

When you have selected one private IP from the above dialog,

the IP address will be shown on the following screen. Click OK

to save the setting.

If you previously have set up WAN Alias for PPPoE or Static or Dynamic IP mode in WAN

interface, you will find them in Aux. WAN IP for your selection.

Available settings are explained as follows:

Item Description

Vigor2133 Series User’s Guide

110

Enable Check to enable the DMZ Host function.

Private IP Enter the private IP address of the DMZ host, or click Choose

IP to select one.

Choose IP Click this button and then a window will automatically pop

up, as depicted below. The window consists of a list of

private IP addresses of all hosts in your LAN network. Select

one private IP address in the list to be the DMZ host.

When you have selected one private IP from the above

dialog, the IP address will be shown on the screen. Click OK

to save the setting.

After finishing all the settings here, please click OK to save the configuration.

Vigor2133 Series User’s Guide

111

I

-

4

-

3

O

p

e

n

P

o

r

t

s

Open Ports allows you to open a range of ports for the traffic of special applications.

Common application of Open Ports includes P2P application (e.g., BT, KaZaA, Gnutella,

WinMX, eMule and others), Internet Camera etc. Ensure that you keep the application

involved up-to-date to avoid falling victim to any security exploits.

Click Open Ports to open the following page:

Available settings are explained as follows:

Item Description

Index Indicate the relative number for the particular entry that you

want to offer service in a local host. You should click the

appropriate index number to edit or clear the corresponding

entry.

Comment Specify the name for the defined network service.

WAN Interface Display the WAN interface used by such index.

Aux. WAN IP Display the IP alias setting used by such index. If no IP alias

setting exists, such field will not appear.

Source IP Display the name of source IP object.

Local IP Address Display the private IP address of the local host offering the

service.

Status Display the state for the corresponding entry. X or V is to

represent the Inactive or Active state.

To add or edit port settings, click one index number on the page. The index entry setup page

will pop up. In each index entry, you can specify 10 port ranges for diverse services.

Vigor2133 Series User’s Guide

112

Available settings are explained as follows:

Item Description

Enable Open Ports Check to enable this entry.

Comment Make a name for the defined network application/service.

WAN Interface Specify the WAN interface that will be used for this entry.

WAN IP Choose an IP address from the WAN IP alias.

Source IP Use the drop down list to specify an IP object. Or click IP

Object link to create a new one for applying.

WAN IP Specify the WAN IP address that will be used for this entry.

This setting is available when WAN IP Alias is configured.

Private IP Enter the private IP address of the local host or click Choose

IP to select one.

Choose IP - Click this button and, subsequently, a window

having a list of private IP addresses of local hosts will

automatically pop up. Select the appropriate IP address of

the local host in the list.

Protocol Specify the transport layer protocol. It could be TCP, UDP,

or ----- (none) for selection.

Start Port Specify the starting port number of the service offered by

the local host.

End Port Specify the ending port number of the service offered by the

local host.

Vigor2133 Series User’s Guide

113

After finishing all the settings here, please click OK to save the configuration.

Vigor2133 Series User’s Guide

114

I

-

4

-

4

P

o

r

t

T

r

i

g

e

r

i

n

g

Port Triggering is a variation of open ports function.

The key difference between "open port" and "port triggering" is:

 Once the OK button is clicked and the configuration has taken effect, "open port" keeps

the ports opened forever.

 Once the OK button is clicked and the configuration has taken effect, "port triggering"

will only attempt to open the ports once the triggering conditions are met.

 The duration that these ports are opened depends on the type of protocol used. The

"default" durations are shown below and these duration values can be modified via

telnet commands.

TCP: 86400 sec.

UDP: 180 sec.

IGMP: 10 sec.

TCP WWW: 60 sec.

TCP SYN: 60 sec.

Available settings are explained as follows:

Item Description

Comment Display the text which memorizes the application of this

rule.

Triggering Protocol Display the protocol of the triggering packets.

Triggering Port Display the port of the triggering packets.

Source IP Display the name of the IP object.

Incoming Protocol Display the protocol for the incoming data of such triggering

profile.

Incoming Port Display the port for the incoming data of such triggering

profile.

Status Display if the rule is active or de-active.

Click the index number link to open the configuration page.

Vigor2133 Series User’s Guide

115

Available settings are explained as follows:

Item Description

Enable Check to enable this entry.

Service Choose the predefined service to apply for such trigger

profile.

Comment Type the text to memorize the application of this rule.

Source IP Use the drop down list to specify an IP object. Or click IP

Object link to create a new one for applying.

Triggering Protocol Select the protocol (TCP, UDP or TCP/UDP) for such

triggering profile.

Triggering Port Type the port or port range for such triggering profile.

Incoming Protocol When the triggering packets received, it is expected the

incoming packets will use the selected protocol. Select the

protocol (TCP, UDP or TCP/UDP) for the incoming data of

such triggering profile.

Incoming Port Type the port or port range for the incoming packets.

After finishing all the settings here, please click OK to save the configuration.

Vigor2133 Series User’s Guide

116

I

-

4

-

5

A

L

G

ALG means Application Layer Gateway. There are two methods provided by Vigor router,

RTSP (Real Time Streaming Protocol) ALG and SIP (Session Initiation Protocol) ALG, for

processing the packets of voice and video.

RTSP ALG makes RTSP message, RTCP message, and RTP packets of voice and video be

transmitted and received correctly via NAT by Vigor router.

However, SIP ALG makes SIP message and RTP packets of voice be transmitted and received

correctly via NAT by Vigor router.

Available settings are explained as follows:

Item Description

Enable ALG Check to enable such function.

Listen Port Type a port number for SIP or RTSP protocol.

TCP Check the box to make correspond protocol message packet

from TCP transmit and receive via NAT.

UDP Check the box to make correspond protocol message packet

from UDP transmit and receive via NAT.

Vigor2133 Series User’s Guide

11

7

I

-

5

A

p

l

i

c

a

t

i

o

n

s

D

y

n

a

m

i

c

D

N

S

The ISP often provides you with a dynamic IP address when you connect to the Internet via

your ISP. It means that the public IP address assigned to your router changes each time you

access the Internet. The Dynamic DNS feature lets you assign a domain name to a dynamic

WAN IP address. It allows the router to update its online WAN IP address mappings on the

specified Dynamic DNS server. Once the router is online, you will be able to use the registered

domain name to access the router or internal virtual servers from the Internet. It is

particularly helpful if you host a web server, FTP server, or other server behind the router.

Before you use the Dynamic DNS feature, you have to apply for free DDNS service to the DDNS

service providers. The router provides up to three accounts from three different DDNS service

providers. Basically, Vigor routers are compatible with the DDNS services supplied by most

popular DDNS service providers such as www.dyndns.org, www.no-ip.com, www.dtdns.com,

www.changeip.com, www.dynamic- nameserver.com. You should visit their websites to

register your own domain name for the router.

L

A

N

D

N

S

/

D

N

S

F

o

r

w

a

r

d

i

n

g

The LAN DNS lets the network administrators host servers with privacy and security. When the

network administrators of your office set up FTP, Mail or Web server inside LAN, you can

specify specific private IP address (es) to correspondent servers. Thus, even the remote PC is

adopting public DNS as the DNS server, the LAN DNS resolution on Vigor2133 series will

respond the specified private IP address.

S

c

h

e

d

u

l

e

The Vigor router has a built-in clock which can update itself manually or automatically by

means of Network Time Protocols (NTP). As a result, you can not only schedule the router to

dialup to the Internet at a specified time, but also restrict Internet access to certain hours so

that users can connect to the Internet only during certain hours, say, business hours. The

schedule is also applicable to other functions.

R

A

D

I

U

S

Remote Authentication Dial-In User Service (RADIUS) is a security authentication

client/server protocol that supports authentication, authorization and accounting, which is

widely used by Internet service providers. It is the most common method of authenticating

and authorizing dial-up and tunneled network users.

The built-in RADIUS client feature enables the router to assist the remote dial-in user or a

wireless station and the RADIUS server in performing mutual authentication. It enables

centralized remote access authentication for network management.

U

P

n

P

The UPnP (Universal Plug and Play) protocol is supported to bring to network connected

devices the ease of installation and configuration which is already available for directly

connected PC peripherals with the existing Windows 'Plug and Play' system. For NAT routers,

the major feature of UPnP on the router is “NAT Traversal”. This enables applications inside

the firewall to automatically open the ports that they need to pass through a router.

W

a

k

e

o

n

L

A

N

Vigor2133 Series User’s Guide

118

A PC client on LAN can be woken up by the router it connects. When a user wants to wake up

a specified PC through the router, he/she must type correct MAC address of the specified PC

on this web page of Wake on LAN (WOL) of this router.

In addition, such PC must have installed a network card supporting WOL function. By the way,

WOL function must be set as “Enable” on the BIOS setting.

Vigor2133 Series User’s Guide

11

9

W

e

b

U

s

e

r

I

n

t

e

r

f

a

c

e

I

-

5

-

1

D

y

n

a

m

i

c

D

N

S

E

n

a

b

l

e

t

h

e

F

u

n

c

t

i

o

n

a

n

d

A

d

a

D

y

n

a

m

i

c

D

N

S

A

c

o

u

n

t

1. Assume you have a registered domain name from the DDNS provider, say

hostname.dyndns.org, and an account with username: test and password: test.

2. Open Applications>>Dynamic DNS.

3. In the DDNS setup menu, check Enable Dynamic DNS Setup.

Available settings are explained as follows:

Item Description

Enable Dynamic DNS

Setup

Check this box to enable DDNS function.

Set to Factory

Default

Clear all profiles and recover to factory settings.

View Log Display DDNS log status.

Force Update Force the router updates its information to DDNS server.

Vigor2133 Series User’s Guide

120

Auto-Update

interval

Set the time for the router to perform auto update for DDNS

service.

Index Click the number below Index to access into the setting page

of DDNS setup to set account(s).

Enable Check the box to enable this account.

Domain Name Display the domain name that you set on the setting page of

DDNS setup.

4. Select Index number 1 to add an account for the router. Check Enable Dynamic DNS

Account, and choose correct Service Provider: dyndns.org, type the registered

hostname: hostname and domain name suffix: dyndns.org in the Domain Name block.

The following two blocks should be typed your account Login Name: test and Password:

test.

If User-Defined is specified as the service provider, the web page will be changed

slightly as follows:

Vigor2133 Series User’s Guide

121

Available settings are explained as follows:

Item Description

Enable Dynamic DNS

Account

Check this box to enable the current account. If you did

check the box, you will see a check mark appeared on the

Active column of the previous web page in step 2).

Service Provider Select the service provider for the DDNS account.

Provider Host Type the IP address or the domain name of the host which

provides related service.

Note that such option is available when Customized is

selected as Service Provider.

Service API Type the API information obtained from DDNS server.

Note that such option is available when Customized is

selected as Service Provider.

(e.g:

/dynamic/dns/update.asp?u=jo***&p=jo********&hostname=j*

***.changeip.org&ip=###IP### &cmd=update&offline=0)

Auth Type Two types can be used for authentication.

Basic – Username and password defined later can be shown

from the packets captured.

URL - Username and password defined later can be shown in

URL.

(e.g., http://ns1.vigorddns.com/ddns.php?username=xxxx&

password=xxxx&domain=xxxx.vigorddns.com)

Note that such option is available when Customized is

selected as Service Provider.

Connection Type There are two connection types (HTTP and HTTPs) to be

specified. Note that such option is available when

Customized is selected as Service Provider.

Server Response Type any text that you want to receive from the DDNS

server.

Note that such option is available when Customized is

selected as Service Provider.

Login Name Type in the login name that you set for applying domain.

Password Type in the password that you set for applying domain.

Wildcard and

Backup MX

The Wildcard and Backup MX (Mail Exchange) features are

not supported for all Dynamic DNS providers. You could get

more detailed information from their websites.

Mail Extender If the mail server is defined with another name, please type

the name in this area. Such mail server will be used as

backup mail exchange.

Determine WAN IP If a Vigor router is installed behind any NAT router, you can

enable such function to locate the real WAN IP.

When the WAN IP used by Vigor router is private IP, this

function can detect the public IP used by the NAT router and

use the detected IP address for DDNS update.

There are two methods offered for you to choose:

 WAN IP - If it is selected and the WAN IP of Vigor router

is private, DDNS update will take place right away.

 Internet IP – If it is selected and the WAN IP of Vigor

router is private, it will be converted to public IP

Vigor2133 Series User’s Guide

122

before DDNS update takes place.

5. Click OK button to activate the settings. You will see your setting has been saved.

D

i

s

a

b

l

e

t

h

e

F

u

n

c

t

i

o

n

a

n

d

C

l

e

a

r

a

l

D

y

n

a

m

i

c

D

N

S

A

c

o

u

n

t

s

Uncheck Enable Dynamic DNS Setup, and click Clear All button to disable the function and

clear all accounts from the router.

Vigor2133 Series User’s Guide

123

I

-

5

-

2

L

A

N

D

N

S

/

D

N

S

F

o

r

w

a

r

d

i

n

g

The LAN DNS lets the network administrators host servers with privacy and security. When the

network administrators of your office set up FTP, Mail or Web server inside LAN, you can

specify specific private IP address (es) to correspondent servers. Thus, even the remote PC is

adopting public DNS as the DNS server, the LAN DNS resolution on Vigor2133 series will

respond the specified private IP address.

Simply click Application>>LAN DNS/DNS Forwarding to open the following page.

Each item is explained as follows:

Item Description

Set to Factory Default Clear all profiles and recover to factory settings.

Enable Check the box to enable the selected profile.

Index Click the number below Index to access into the setting

page.

Vigor2133 Series User’s Guide

124

Profile Display the name of the LAN DNS profile.

Domain Name Display the domain name of the LAN DNS profile.

Forwarding Display that such profile is conditional DNS forwarding or

not.

DNS Server Display the IP addres of the DNS Server.

You can set up to 120 LAN DNS profiles.

To create a LAN DNS profile:

1. Click any index, say Index No. 1.

2. The detailed settings with index 1 are shown below.

Available settings are explained as follows:

Item Description

Enable Check this box to enable such profile.

Profile Type a name for such profile.

Note: If you type a name here for LAN DNS and click OK to

save the configuration, the name also will be applied to

conditional DNS forwarding automatically.

Domain Name Type the domain name for such profile.

IP Address List The IP address listed here will be used for mapping with the

domain name specified above. In general, one domain name

maps with one IP address. If required, you can configure two

IP addresses mapping with the same domain name.

Add – Click it to open a dialog to type the host’s IP address.

Vigor2133 Series User’s Guide

125

 Only responds to the DNS…. – Different LAN PCs can

share the same domain name. However, you have to

check this box to make the router identify & respond

the IP address for the DNS query coming from different

LAN PC.

Delete – Click it to remove an existed IP address on the list.

3. Click OK button to save the settings.

4. If you need to configure LAN DNS settings, click index 1 to edit the LAN DNS profile just

created. Or, you can click index 2 to use this profile as conditional DNS forwarding.

Available settings are explained as follows:

Item Description

Enable Check this box to enable such profile.

Profile Type a name for such profile.

Note: If you type a name here for conditional DNS forwarding

and click OK to save the configuration, the name also will be

applied to LAN DNS automatically.

Domain Name Type the domain name for such profile.

DNS Server IP Address

Type the IP address of the DNS server you want to use for DNS

forwarding.

5. Click OK button to save the settings.

6. A new LAN DNS profile has been created.

Vigor2133 Series User’s Guide

126

I

-

5

-

3

D

N

S

e

c

u

r

i

t

y

DNS security is able to ensure that the incoming data is not falsified and the source of the

data is secure and correct to prevent from DNS attack by someone.

I

-

5

-

3

-

1

G

e

n

e

r

a

l

S

e

t

u

p

All of WAN interfaces of Vigor router can be configured with DNS Security enabled

respectively.

Available settings are explained as follows:

Item Description

Enable Check the box to enable the DNS security management.

Interface There are four WAN interfaces allowed to be set with DNS

security enabled.

Primary DNS Display the IP address of primary DNS obtained from DHCP

server or specified by Static WAN.

Secondary DNS Display the IP address of secondary DNS obtained from DHCP

server or specified by Static WAN.

Bogus DNS Reply Sometime, Vigor router might encounter packets from bogus

DNS inquiry. There are two ways to reply such DNS inquiry.

Drop – Discard the packets.

Pass – Accept the packets and let them pass through Vigor

router.

I

-

5

-

3

-

2

D

o

m

a

i

n

D

i

a

g

n

o

s

e

This page is used to configure settings for manually detecting if the domain is secure not.

Vigor2133 Series User’s Guide

12

7

Available settings are explained as follows:

Item Description

Domain Type the domain name or IP address (IPv4/IPv6) that you

want to query.

Interface Specify the interface required for executing diagnose.

DNS Server Type the IP address of the DNS Server which will diagnose the

domain specified above.

Diagnose Click it to perform the diagnosis for the domain.

Result The diagnosed information will be displayed on such field.

Vigor2133 Series User’s Guide

128

I

-

5

-

4

S

c

h

e

d

u

l

e

The Vigor router has a built-in clock which can update itself manually or automatically by

means of Network Time Protocols (NTP). As a result, you can not only schedule the router to

dialup to the Internet at a specified time, but also restrict Internet access to certain hours so

that users can connect to the Internet only during certain hours, say, business hours. The

schedule is also applicable to other functions.

You have to set your time before set schedule. In System Maintenance>> Time and Date

menu, press Inquire Time button to set the Vigor router’s clock to current time of your PC.

The clock will reset once if you power down or reset the router. There is another way to set

up time. You can inquiry an NTP server (a time server) on the Internet to synchronize the

router’s clock. This method can only be applied when the WAN connection has been built up.

Available settings are explained as follows:

Item Description

Current System Time Display the time Vigor router used.

System time set Click it to acess into the time setup page (System

Maintenance>>Time and Date).

Set to Factory Default Clear all profiles and recover to factory settings.

Enable Click the box to enable such schedule profile.

Vigor2133 Series User’s Guide

12

9

Index Click the index number link to access into the setting page of

schedule.

Comment Display the name of the time schedule.

Time Display the valid time period by time bar.

Frequency Display which day(s) will be always on and which day(s) will

be always off of the schedule profile by color boxes.

- If it lights in green, it means such schedule is active.

You can set up to 15 schedules. Then you can apply them to your Internet Access or VPN and

Remote Access >> LAN to LAN settings.

To add a schedule:

1. Click any index, say Index No. 1.

2. The detailed settings of the schedule with index 1 will be shown below.

Available settings are explained as follows:

Item Description

Enable Schedule

Setup

Check to enable the schedule.

Comment Type a short description for such schedule.

Start Date

(yyyy-mm-dd)

Specify the starting date of the schedule.

Start Time (hh:mm) Specify the starting time of the schedule.

Duration Time

(hh:mm)

Specify the duration (or period) for the schedule.

End Time (hh:mm) It will be calculated automatically when Start Time and

Duration Time are configured well.

Vigor2133 Series User’s Guide

130

Action Specify which action should be applied during the period of

the schedule.

Force On -Force the connection to be always on.

Force Down -Force the connection to be always down.

How Often Specify how often the schedule will be applied.

 Once -The schedule will be applied just once

 Weekdays -Specify which days in one week should

perform the schedule.

 Monthly, on date – The router will only execute the

action applied such schedule on the date (1 to 28) of a

month.

 Cycle duration – Type a number as cycle duration.

Then, any action applied such schedule will be

executed per several days. For example, “3” is selected

as cycle duration. That means, the action applied such

schedule will be executed every three days since the

date defined on the Start Date.

3. Click OK button to save the settings.

Example

Suppose you want to control the PPPoE Internet access connection to be always on (Force On)

from 9:00 to 18:00 for whole week. Other time the Internet access connection should be

disconnected (Force Down).

Office

Hour:

(Force On)

Mon - Sun 9:00 am to 6:00 pm

1. Make sure the PPPoE connection and Time Setup is working properly.

2. Configure the PPPoE always on from 9:00 to 18:00 for whole week.

3. Configure the Force Down from 18:00 to next day 9:00 for whole week.

4. Assign these two profiles to the PPPoE Internet access profile. Now, the PPPoE Internet

connection will follow the schedule order to perform Force On or Force Down action

according to the time plan that has been pre-defined in the schedule profiles.

Vigor2133 Series User’s Guide

131

I

-

5

-

5

R

A

D

I

U

S

Remote Authentication Dial-In User Service (RADIUS) is a security authentication

client/server protocol that supports authentication, authorization and accounting, which is

widely used by Internet service providers. It is the most common method of authenticating

and authorizing dial-up and tunneled network users.

The built-in RADIUS client feature enables the router to assist the remote dial-in user or a

wireless station and the RADIUS server in performing mutual authentication. It enables

centralized remote access authentication for network management.

Vigor router can be operated as a RADIUS client. Therefore, this page is used to configure

settings for external RADIUS server. Then LAN user of Vigor router will be authenticated by

such server for network application.

Available settings are explained as follows:

Item Description

Enable Check to enable RADIUS client feature.

Server IP Address Enter the IP address of RADIUS server

Destination Port The UDP port number that the RADIUS server is using. The

default value is 1812, based on RFC 2138.

Shared Secret The RADIUS server and client share a secret that is used to

authenticate the messages sent between them. Both sides

must be configured to use the same shared secret. The

maximum length of the shared secret you can set is 36

characters.

Confirm Shared Secret Re-type the Shared Secret for confirmation.

After finished the above settings, click OK button to save the settings.

Vigor2133 Series User’s Guide

132

I

-

5

-

6

U

P

n

P

The UPnP (Universal Plug and Play) protocol is supported to bring to network connected

devices the ease of installation and configuration which is already available for directly

connected PC peripherals with the existing Windows 'Plug and Play' system. For NAT routers,

the major feature of UPnP on the router is “NAT Traversal”. This enables applications inside

the firewall to automatically open the ports that they need to pass through a router.

Info

UPnP is required for some applications such as PPS, Skype, eMule...and etc.

If you are not familiar with UPnP, it is suggested to turn off this function for

security.

Available settings are explained as follows:

Item Description

Enable UPNP Service Accordingly, you can enable either the Connection Control

Service or Connection Status Service.

Default WAN It is used to specify the WAN interface for applying such

function.

The reminder as regards concern about Firewall and UPnP:

Can't work with Firewall Software

Enabling firewall applications on your PC may cause the UPnP function not working properly.

This is because these applications will block the accessing ability of some network ports.

Security Considerations

Activating the UPnP function on your network may incur some security threats. You should

consider carefully these risks before activating the UPnP function.

 Some Microsoft operating systems have found out the UPnP weaknesses and hence you

need to ensure that you have applied the latest service packs and patches.

 Non-privileged users can control some router functions, including removing and adding

port mappings.

The UPnP function dynamically adds port mappings on behalf of some UPnP-aware

applications. When the applications terminate abnormally, these mappings may not be

removed.

Vigor2133 Series User’s Guide

133

I

-

5

-

7

I

G

M

P

IGMP is the abbreviation of Internet Group Management Protocol. It is a communication

protocol which is mainly used for managing the membership of Internet Protocol multicast

groups.

I

-

5

-

7

-

1

G

e

n

e

r

a

l

S

e

t

i

n

g

Available settings are explained as follows:

Item Description

IGMP Proxy Check this box to enable this function. The application of

multicast will be executed through WAN /PVC/VLAN port.

In addition, such function is available in NAT mode.

Interface – Specify an interface for packets passing

through.

IGMP version – At present, two versions (v2 and v3) are

supported by Vigor router. Choose the correct version

based on the IPTV service you subscribe.

General Query Interval – Vigor router will periodically

check which IP obtaining IPTV service by sending query. It

might cause inconvenience for client. Therefore, set a

suitable time (unit: second) as the query interval to limit

the frequency of query sent by Vigor router.

Add PPP header – Check this box if the interface type for

IGMP is PPPoE. It depends on the specifications regulated

by each ISP. If you have no idea to enable or disable, simply

contact your ISP providers.

IGMP Snooping Check this box to enable this function. Multicast traffic will

be forwarded to ports that have members of that group.

Disabling IGMP snooping will make multicast traffic treated

in the same manner as broadcast traffic.

IGMP Fast Leave Check this box to make the router stop forwarding

multicast traffic to a LAN port as soon as it receives a leave

message from that port. Each LAN port should have one

IGMP host connected.

Vigor2133 Series User’s Guide

134

After finishing all the settings here, please click OK to save the configuration.

I

-

5

-

7

-

1

W

o

r

k

i

n

g

G

r

o

u

p

Available settings are explained as follows:

Item Description

Refresh Click this link to renew the working multicast group status.

Group ID This field displays the ID port for the multicast group. The

available range for IGMP starts from 224.0.0.0 to

239.255.255.254.

P1 to P4 It indicates the LAN port used for the multicast group.

Vigor2133 Series User’s Guide

135

I

-

5

-

8

W

a

k

e

o

n

L

A

N

A PC client on LAN can be woken up by the router it connects. When a user wants to wake up

a specified PC through the router, he/she must type correct MAC address of the specified PC

on this web page of Wake on LAN (WOL) of this router.

In addition, such PC must have installed a network card supporting WOL function. By the way,

WOL function must be set as “Enable” on the BIOS setting.

Available settings are explained as follows:

Item Description

Wake by Two types provide for you to wake up the binded IP.

 If you choose Wake by MAC Address, you have to type

the correct MAC address of the host in MAC Address

boxes.

 If you choose Wake by IP Address, you have to choose

the correct IP address.

IP Address The IP addresses that have been configured in

Firewall>>Bind IP to MAC will be shown in this drop down

list. Choose the IP address from the drop down list that you

want to wake up.

MAC Address Type any one of the MAC address of the bound PCs.

Wake Up Click this button to wake up the selected IP. See the

following figure. The result will be shown on the box.

Vigor2133 Series User’s Guide

136

I

-

5

-

9

S

M

S

/

M

a

i

l

A

l

e

r

t

S

e

r

v

i

c

e

The function of SMS (Short Message Service)/Mail Alert is that Vigor router sends a message to

user’s mobile or e-mail box through specified service provider to assist the user knowing the

real-time abnormal situations.

Vigor router allows you to set up to 10 SMS profiles which will be sent out according to

different conditions.

I

-

5

-

9

-

1

S

M

S

A

l

e

r

t

This page allows you to specify SMS provider, who will get the SMS, what the content is and

when the SMS will be sent.

Available settings are explained as follows:

Item Description

Index Check the box to enable such profile.

SMS Provider Use the drop down list to choose SMS service provider.

You can click SMS Provider link to define the SMS server.

Recipient Number Type the phone number of the one who will receive the

SMS.

Notify Profile Use the drop down list to choose a message profile. The

recipient will get the content stated in the message profile.

You can click the Notify Profile link to define the content

of the SMS.

Schedule (1-15) Type the schedule number that the SMS will be sent out.

You can click the Schedule(1-15) link to define the

schedule.

After finishing all the settings here, please click OK to save the configuration.

Vigor2133 Series User’s Guide

13

7

I

-

5

-

9

-

2

M

a

i

l

A

l

e

r

t

This page allows you to specify Mail Server profile, who will get the notification e-mail, what

the content is and when the message will be sent.

Available settings are explained as follows:

Item Description

Index Check the box to enable such profile.

Mail Service Use the drop down list to choose mail service object. All of

the available objects are created in Object

Settings>>SMS/Mail Service Object. If there is no object

listed, click Mail Service link to define a new one with

specified service provider.

Mail Address Type the e-mail address of the one who will receive the

notification message.

Notify Profile Use the drop down list to choose a message profile. The

recipient will get the content stated in the message profile.

You can click the Notify Profile link to define the content

of the mail message.

Schedule (1-15) Type the schedule number that the notification will be sent

out.

You can click the Schedule(1-15) link to define the

schedule.

After finishing all the settings here, please click OK to save the configuration.

Vigor2133 Series User’s Guide

138

I

-

5

-

1

0

B

o

n

j

o

u

r

Bonjour is a service discovery protocol which is a built-in service in Mac OS X; for Windows or

Linux platform, there is correspondent software to enable this function for free.

Usually, users have to configure the router or personal computers to use above services.

Sometimes, the configuration (e.g., IP settings, port number) is complicated and not easy to

complete. The purpose of Bonjour is to decrease the settings configuration (e.g., IP setting).

If the host and user’s computer have the plug-in bonjour driver install, they can utilize the

service offered by the router by clicking the router name icon. In short, what the

Clients/users need to know is the name of the router only.

To enable the Bonjour service, click Application>>Bonjour to open the following page. Check

the box(es) of the server service(s) that you want to share to the LAN clients.

Below shows an example for applying the bonjour feature that Vigor router can be used as the

FTP server.

1. Here, we use Firefox and DNSSD to discover the service in such case. Therefore, just

ensure the Bonjour client program and DNSSD for Firefox have been installed on the

computer.

Vigor2133 Series User’s Guide

13

9

2. Open the web browse, Firefox. If Bonjour and DNSSD have been installed, you can open

the web page (DNSSD) and see the following results.

3. Open System Maintenance>>Management. Type a name as the Router Name and click

OK.

4. Next, open Applications>>Bonjour. Check the service that you want to use via Bonjour.

5. Open the DNSSD page again. The available items will be changed as the follows. It means

the Vigor router (based on Bonjour protocol) is ready to be used as a printer server, FTP

server, SSH Server, Telnet Server, and HTTP Server.

Vigor2133 Series User’s Guide

140

6. Now, any page or document can be printed out through Vigor router (installed with a

printer).

Vigor2133 Series User’s Guide

141

A

p

l

i

c

a

t

i

o

n

N

o

t

e

s

A

-

1

H

o

w

t

o

u

s

e

D

r

a

y

D

N

S

?

Vigor router supports various DDNS service providers, user can set up user-defined profile to

update the DDNS even the service provider is not on the list. Now, DrayTek starts to support

our own DDNS service - DrayDDNS. We will provide a domain name for each Vigor Router, this

single domain name can record IP addresses of all WAN.

A

c

t

i

v

a

t

e

D

r

a

y

D

N

S

L

i

c

e

n

s

e

1. Go to Wizards >> Service Activation Wizard, wait for the router to connect to MyVigor

server, then tick DT-DDNS and I have read and accept the above Agreement, click

Next.

2. Confirm the information, then click Activate.

Vigor2133 Series User’s Guide

142

3. MyVigor server will reply with the service activation information.

C

o

n

f

i

g

u

r

e

D

N

S

P

r

o

f

i

l

e

1. Go to Applications >> Dynamic DNS Setup,

a. Tick Enable Dynamic DNS Setup

b. Click an available profile index

c. Tick Enable Dynamic DNS Account

d. Select DrayTek Global (www.drayddns.com) as Service Provider

e. Select the WAN you would like to upload the IP to DDNS server

f. Click Get domain

g. Click OK on the pop up notification window

Vigor2133 Series User’s Guide

143

2. Wait few seconds for router to get the domain name, then, we can click the profile to

check the information of license and domain name.

M

o

d

i

f

y

D

o

m

a

i

n

N

a

m

e

Currently, only the domain name is allowed to be modified MyVigor website. We will need to

register the router to MyVigor server, and log in to MyVigor website to modify it.

1. Please visit https://myvigor.draytek.com/ or go to Applications >> Dynamic DNS Setup

>> DrayDDNS profile and click Edit domain.

2. Log in to MyVigor Website, choose the profile, then click Edit DDNS settings.

Vigor2133 Series User’s Guide

144

3. Input the desired Domain name (e.g., XXXX25) and click Update.

4. Vigor router will get the modified domain name when the it performs next DDNS

updating. We can click Sync domain to accelerate this process.

After few seconds, the router will get the new domain name and print it on the profiles

list.

Vigor2133 Series User’s Guide

145

Vigor2133 Series User’s Guide

146

A

-

2

H

o

w

t

o

C

o

n

f

i

g

u

r

e

C

u

s

t

o

m

i

z

e

d

D

N

S

?

This article describes how to configure customized DDNS on Vigor routers to update your IP to

the DDNS server. We will take “Changeip.org” and “3322.net” as example. Before setting,

please make sure that the WAN connection is up.

P

a

r

t

A

:

C

h

a

n

g

e

i

p

.

o

r

g

Note that,

Username: jo***

Password: jo********

Host name: j*****.changeip.org

WAN IP address: 1.169.185.242

Following is the screenshot of editing the HTML script on the browser to update your IP to the

DDNS server.

Vigor2133 Series User’s Guide

14

7

Now we have to configure the router so it can do the same job for us automatically.

1. Please go to Applications >> Dynamic DNS to create a profile for user-defined DDNS

client.

2. Set the Service Provider as User-Defined.

3. Set the Service API as:

/dynamic/dns/update.asp?u=jo***&p=jo********&hostname=j****.changeip.org&ip=###IP

### &cmd=update&offline=0

In which, ###IP### is a value which will be replaced with the current interface IP

address automatically when DDNS service is running. In this case the IP will be

1.169.185.242.

4. After setting, the Customized DDNS service will be up, and our IP will be updated to the

DDNS server.

P

a

r

t

B

:

3

2

.

n

e

t

Username: bi*******

Password: 88********

Host name: bi*******.3322.org

WAN IP address: 111.243.178.53

Vigor2133 Series User’s Guide

148

To update the IP to the DDNS server via editing the HTML script, we can type the following

script on the browser:

“good 111.243.178.53” means our IP has been updated to the server successfully.

Now we have to configure the router so it can do the same job for us automatically.

1. Please go to Applications >> Dynamic DNS to create a profile for User-Defined DDNS

client.

2. Set the Service Provider as User-Defined.

3. Set the Provider Host as member.3322.net.

4. Set the Service API as:

/dyndns/update?hostname=yourhost.3322.org&myip=###IP###&wildcard=OFF&mx=mail

.exchanger.ext&backmx=NO&offline=NO

5. Enter your account and password.

6. After the setting, the Customized DDNS service will be up, and our IP will be updated to

the DDNS server automatically.

Vigor2133 Series User’s Guide

14

9

P

a

r

t

C

:

E

x

t

e

n

d

N

o

t

e

The customized Service Provider is also eligible with the ClouDNS.net.

Vigor2133 Series User’s Guide

150

I

-

6

R

o

u

t

i

n

g

Route Policy (also well known as PBR, policy-based routing) is a feature where you may need

to get a strategy for routing. The packets will be directed to the specified interface if they

match one of the policies. You can setup route policies in various reasons such as load balance,

security, routing decision, and etc.

Through protocol, IP address, port number and interface configuration, Route Policy can be

used to configure any routing rules to fit actual request. In general, Route Policy can easily

reach the following purposes:

Specify Interface

Through dedicated interface (WAN/LAN/VPN), the data can be sent from the source IP to the

destination IP.

Address Mapping

Allows you specify the outgoing WAN IP address (es) for an internal private IP address or a

range of internal private IP addresses.

Priority

The router will determine which policy will be adopted for transmitting the packet according

to the priority of Static Route and Route Policy.

Failover to/Failback

Packets will be sent through another Interface or follow another Policy when the original

interface goes down (Failover to). Once the original interface resumes service (Failback),

the packets will be returned to it immediately.

Other routing

Specify routing policy to determine the direction of the data transmission.

Info

For more detailed information about using policy route, refer to Support

>>FAQ/Application Notes on www.draytek.com.

Vigor2133 Series User’s Guide

151

W

e

b

U

s

e

r

I

n

t

e

r

f

a

c

e

I

-

6

-

1

S

t

a

t

i

c

R

o

u

t

e

Static routing is an alternative to dynamic routing. It is a process that the system network

administrator can configure network routers with all the required information for packet

forwarding.

Go to Routing >> Static Route. The router offers IPv4 and IPv6 for you to configure the static

route. Both protocols bring different web pages.

S

t

a

t

i

c

R

o

u

t

e

f

o

r

I

P

v

4

Available settings are explained as follows:

Item Description

Set to Factory Default Clear all of the settings and return to factory default

settings.

Viewing Routing Table Displays the routing table for your reference.

Index The number (1 to 30) under Index allows you to open next

page to set up static route.

Enable Check the box to enable such route.

Vigor2133 Series User’s Guide

152

Destination Address Displays the destination address of the static route.

A

d

S

t

a

t

i

c

R

o

u

t

e

s

t

o

P

r

i

v

a

t

e

a

n

d

P

u

b

l

i

c

N

e

t

w

o

r

k

s

Here is an example (based on IPv4) of setting Static Route in Main Router so that user A and B

locating in different subnet can talk to each other via the router. Assuming the Internet

access has been configured and the router works properly:

 use the Main Router to surf the Internet.

 create a private subnet 192.168.10.0 using an internal Router A (192.168.1.2)

 create a public subnet 211.100.88.0 via an internal Router B (192.168.1.3).

 have set Main Router 192.168.1.1 as the default gateway for the Router A 192.168.1.2.

Before setting Static Route, user A cannot talk to user B for Router A can only forward

recognized packets to its default gateway Main Router.

1. Go to LAN page and click General Setup, select 1st Subnet as the RIP Protocol Control.

Then click the OK button.

Info

There are two reasons that we have to apply RIP Protocol Control on

1st Subnet. The first is that the LAN interface can exchange RIP

packets with the neighboring routers via the 1st subnet

(192.168.1.0/24). The second is that those hosts on the internal

private subnets (ex. 192.168.10.0/24) can access the Internet via the

router, and continuously exchange of IP routing information with

different subnets.

Vigor2133 Series User’s Guide

153

2. Click the LAN >> Static Route and click on the Index Number 1. Check the Enable box.

Please add a static route as shown below, which regulates all packets destined to

192.168.10.0 will be forwarded to 192.168.1.2. Click OK.

Available settings are explained as follows:

Item Description

Enable Click it to enable this profile.

Destination IP

Address

Type an IP address as the destination of such static route.

Subnet Mask Type the subnet mask for such static route.

Network Interface Use the drop down list to specify an interface for such

static route.

3. Return to Static Route Setup page. Click on another Index Number to add another

static route as show below, which regulates all packets destined to 211.100.88.0 will be

forwarded to 192.168.1.3. Click OK.

4. Go to Diagnostics and choose Routing Table to verify current routing table.

Vigor2133 Series User’s Guide

154

S

t

a

t

i

c

R

o

u

t

e

f

o

r

I

P

v

6

You can set up to 40 profiles for IPv6 static route. Click the IPv6 tab to open the following

page:

Available settings are explained as follows:

Item Description

Set to Factory Default Clear all of the settings and return to factory default

settings.

Viewing IPv6 Routing

Table

Displays the routing table for your reference.

Index The number (1 to 40) under Index allows you to open next

page to set up static route.

Enable Check the box to enable such static route.

Destination Address Displays the destination address of the static route.

Click any underline of index number to get the following page.

Available settings are explained as follows:

Item Description

Enable Click it to enable this profile.

Destination IPv6 Address /

Prefix Len

Type the IP address with the prefix length for this entry.

Gateway IPv6 Address Type the gateway address for this entry.

Vigor2133 Series User’s Guide

155

Network Interface Use the drop down list to specify an interface for this static

route.

When you finish the configuration, please click OK to save and exit this page.

I

-

6

-

2

R

o

u

t

e

P

o

l

i

c

y

It allows network administrator to manage the outbound traffic more specifically. The policy

set in Route Policy always has higher priority than Default Route and Auto Load Balance set

in WAN >> Internet Access, and always has lower priority than the Firewall Rules.

Administrator may also define a priority to this policy.

I

-

6

-

2

-

1

G

e

n

e

r

a

l

S

e

t

u

p

General Setup lists all the policies and shows whether the policy is enabled/disabled, what

are the criteria to match, and through which the interface should the traffic to go if the

criteria are matched, and also its priority.

Available settings are explained as follows:

Item Description

Index Click the number of index to access into the configuration

web page.

Enable Check this box to enable this policy.

Commnent Display a brief explaination for this policy.

Protocol Display the protocol used for this policy.

Interface Display the interface to send packets to once the policy is

matched.

Priority Display the priority value for such route policy profile.

Src IP Start Display the IP address for the start of the source IP.

Src IP End Display the IP address for the end of the source IP.

Vigor2133 Series User’s Guide

156

Dest IP Start Display the IP address for the start of the destination IP.

Dest IP End Display the IP address for the end of the destination IP.

Dest Port Start Display the IP address for the start of the destination port.

Dest Port End Display the IP address for the end of the destination port.

Move UP/Move Down Use Up or Down link to move the order of the policy.

Wizard Mode Allow to configure frequently used (simple and basic)

settings of route policy via three setting pages.

Advance Mode Allow to configure detailed settings of route policy.

To use Wizard Mode, simple do the following steps:

1. Click the Wizard Mode radio button.

2. Click Index 1. The setting page will appear as follows:

Available settings are explained as follows:

Item Description

Source IP Any – Any IP can be treated as the source IP.

Src IP Start - Type the source IP start for the specified WAN

interface.

Src IP End - Type the source IP end for the specified WAN

interface. If this field is blank, it means that all the source

IPs inside the LAN will be passed through the WAN

interface.

Destination IP Any – Any IP can be treated as the destination IP.

Dest IP Start- Type the destination IP start for the specified

WAN interface.

Dest IP End - Type the destination IP end for the specified

WAN interface. If this field is blank, it means that all the

destination IPs will be passed through the WAN interface.

3. Click Next to get the following page.

Vigor2133 Series User’s Guide

15

7

Available settings are explained as follows:

Item Description

Interface Use the drop down list to choose a WAN or LAN interface or

VPN profile. Packets match with the above criteria will be

transferred to the interface chosen here.

4. After specifying the interface, click Next to get the following page.

Available settings are explained as follows:

Item Description

Force NAT /Force

Routing

It determines which mechanism that the router will use to

forward the packet to WAN.

5. After choosing the mechanism, click Next to get the summary page for reference.

6. If there is no error, click Finish to complete wizard setting.

Vigor2133 Series User’s Guide

158

To use Advance Mode, do the following steps:

1. Click the Advance Mode radio button.

2. Click any Index number link (e.g., 1 in this case) to access into the following page.

Available settings are explained as follows:

Item Description

Enable Check this box to enable this policy.

Comment Type a brief explanation for such profile.

Protocol Use the drop-down menu to choose a proper protocol for

the WAN interface.

Source / Destination Any – Any IP can be treated as the source / destination IP.

IP Range – Define a range of IP address as source /

destination IP addresses.

 Start - Type an address as the starting IP for such

profile.

 End - Type an address as the ending IP for such profile.

Vigor2133 Series User’s Guide

15

9

IP Subnet – Define a subnet containing IP address and mask

address.

 Network – Type an IP address here.

 Mask – Use the drop down list to choose a suitable mask

for the network.

IP Object / IP Group – Choose an IP object / IP group.

Destination Port Any – Any port number can be treated as the destination

port.

Dest Port Range – A range of port number can be treated as

the destination port.

 Start - Type the destination port start for the

destination IP.

 End - Type the destination port end for the destination

IP. If this field is blank, it means that all the

destination ports will be passed through the WAN

interface.

Send to if criteria

matched

Interface – Use the drop down list to choose a WAN or LAN

interface or VPN profile. Packets match with the above

criteria will be transferred to the interface chosen here.

Gateway IP – Specific gateway is used only when you want

to forward the packets to the desired gateway. Usually,

Default Gateway is selected in default.

Packet Forwarding to WAN via – When you choose WAN

(e.g., WAN1) as the Interface for packet transmission, you

have to specify the way the packet forwarded to. Choose

Force NAT or Force Routing.

Failover to – Check this button to lead the data passing

through specific interface (WAN/LAN/VPN/Route Policy)

automatically when the selected interface (defined in Send

via if criteria matched) is down.

 WAN/LAN – Use the drop down list to choose an

interface as an auto failover interface.

 VPN – Use the drop down list to choose a VPN tunnel as

a failover tunnel.

 Route Policy – Use the drop down list to choose an

existed route policy profile.

Gateway IP – Specific gateway is used only when you want

to forward the packets to the desired gateway. Usually,

Default Gateway is selected in default.

Priority Packets will be transmitted based on all routes or Route

Policy. Vigor router will determine which rule will be

adopted for transmitting the packet according to the

priority of Static Route and Route Policy.

The greater the value is, the lower the priority is. Default

value for route policy is “200” which means it has higher

priority than the default route.

3. When you finish the configuration, please click OK to save and exit this page.

I

-

6

-

2

-

2

D

i

a

g

n

o

s

e

With the analysis done by such page, possible path (static route, routing table or policy route)

of the packets sent out of the router can be traced.

Vigor2133 Series User’s Guide

160

or

Available settings are explained as follows:

Item Description

Mode Analyze how a packet will be sent – Choose such mode to

make Vigor router analyze how a single packet will be sent

by a route policy.

Analyze how multiple packets… - Choose such mode to

make Vigor router analyze how multiple packets in a

specified file will be sent by a route policy.

Packet Information Specify the nature of the packets to be analyzed by Vigor

router.

Protocol - Specify a protocol for diagnosis.

Src IP – Type an IP address as the source IP.

Dst IP – Type an IP address as the destination IP.

Dst Port – Use the drop down list to specify the destination

port.

Vigor2133 Series User’s Guide

161

Analyze – Click it to perform the job of analyzing. The

analyzed result will be shown on the page. If required, click

export analysis to export the result as a file.

Input File Select – Click the download link to get a blank example

file. Then, click such button to select that blank “.csv” file

for saving the result of analysis.

Analyze – Click it to perform the job of analyzing. The

analyzed result will be shown on the page. If required, click

export analysis to export the result as a file.

Note that the analysis was based on the current

"load-balance/route policy" settings, we do not guarantee

it will be 100% the same as the real case.

Vigor2133 Series User’s Guide

162

A

p

l

i

c

a

t

i

o

n

N

o

t

e

s

A

-

1

H

o

w

t

o

s

e

t

u

p

A

d

r

e

s

M

a

p

i

n

g

w

i

t

h

R

o

u

t

e

P

o

l

i

c

y

?

Address Mapping is used to map a specified private IP or a range of private IPs of NAT subnet

into a specified WAN IP (or WAN IP alias IP). Refer to the following figure.

This document introduces how to set up address mapping with Route Policy. When a WAN

interface has multiple public IP addresses,the administrator may specify the outgoing IP for

certain internal IP address by a Route Policy.

1. Set up WAN IP Alias. Go to WAN >> Internet Access >> Details Page, and click on WAN

IP Alias button.

1. Check Enable.

2. Enter the WAN IP address.

3. Click OK to save.

After setting up the WAN IP Alias, the IP addresses will be shown in the drop-down list of

Interface in Route Policy setting.

Vigor2133 Series User’s Guide

163

2. Go to Route Policy>>General Setup. Create a Route Policy for specific IP address to

send from specific WAN IP Address.

 Enable this policy.

 Enter Source IP as the range of private IP address.

 Leave the Destination IP and Port as Any.

 Select Interface as WAN, and then select Interface address from the drop-down list.

(The List can be edited in WAN IP Alias setting.)

 Enable Failover to other WAN so the traffic will be sent via other Interface when

the path fails. But do not enable this option if you want the traffic only to use a

designated IP address.

 Click OK to save.

3. After the above configuration, packet source from the range between 192.168.1.20 and

192.168.1.30 sent to the Internet will use the public IP 172.17.1.1.

Vigor2133 Series User’s Guide

164

This page is left blank.

Vigor2133 Series User’s Guide

165

P

a

r

t

I

W

i

r

e

l

e

s

L

A

N

Wireless LAN enables high mobility so WLAN users

can simultaneously access all LAN facilities just

like on a wired LAN as well as Internet access.

Vigor2133 Series User’s Guide

166

I

-

1

W

i

r

e

l

e

s

L

A

N

(

2

.

4

G

H

z

/

5

G

H

z

)

This function is used for “n”/ “ac” models only.

Over recent years, the market for wireless communications has enjoyed tremendous growth.

Wireless technology now reaches or is capable of reaching virtually every location on the

surface of the earth. Hundreds of millions of people exchange information every day via

wireless communication products. The Vigor2133 wireless series router (with “n”, or “ac” in

model name) is designed for maximum flexibility and efficiency of a small office/home. Any

authorized staff can bring a built-in WLAN client PDA or notebook into a meeting room for

conference without laying a clot of LAN cable or drilling holes everywhere. Wireless LAN

enables high mobility so WLAN users can simultaneously access all LAN facilities just like on a

wired LAN as well as Internet access.

The Vigor wireless routers are equipped with a wireless LAN interface compliant with the

standard IEEE 802.11n draft 2 protocol. To boost its performance further, the Vigor Router is

also loaded with advanced wireless technology to lift up data rate up to 300 Mbps*. Hence,

you can finally smoothly enjoy stream music and video.

Vigor2133 wireless router is a highly integrated wireless local area network (WLAN) for 5 GHz

802.11ac or 2.4/5 GHz 802.11n WLAN applications. It supports channel operations of 20/40

MHz at 2.4 GHz and 20/40/80 MHz at 5 GHz. Vigor2133 “ac” series router can support data

rates up to 1.3 Gbps in 802.11ac 80 MHz channels. Vigor2133 “n” series router supports

802.11n up to 300 Mbps for 40 MHz channel operations.

Info

The actual data throughput will vary according to the network conditions

and environmental factors, including volume of network traffic, network

overhead and building materials.

In an Infrastructure Mode of wireless network, Vigor wireless router plays a role as an Access

Point (AP) connecting to lots of wireless clients or Stations (STA). All the STAs will share the

same Internet connection via Vigor wireless router. The General Settings will set up the

information of this wireless network, including its SSID as identification, located channel etc.

M

u

l

t

i

p

l

e

S

I

D

s

Vigor2133 Series User’s Guide

16

7

Vigor router supports four SSID settings for wireless connections. Each SSID can be defined

with different name and download/upload rate for selecting by stations connected to the

router wirelessly.

R

e

a

l

-

t

i

m

e

H

a

r

d

w

a

r

e

E

n

c

r

y

p

t

i

o

n

Vigor Router is equipped with a hardware AES encryption engine so it can apply the highest

protection to your data without influencing user experience.

C

o

m

p

l

e

t

e

S

e

c

u

r

i

t

y

S

t

a

n

d

a

r

d

S

e

l

e

c

t

i

o

n

To ensure the security and privacy of your wireless communication, we provide several

prevailing standards on market.

WEP (Wired Equivalent Privacy) is a legacy method to encrypt each frame transmitted via

radio using either a 64-bit or 128-bit key. Usually access point will preset a set of four keys

and it will communicate with each station using only one out of the four keys.

WPA (Wi-Fi Protected Access), the most dominating security mechanism in industry, is

separated into two categories: WPA-personal or called WPA Pre-Share Key (WPA/PSK), and

WPA-Enterprise or called WPA/802.1x.

In WPA-Personal, a pre-defined key is used for encryption during data transmission. WPA

applies Temporal Key Integrity Protocol (TKIP) for data encryption while WPA2 applies AES.

The WPA-Enterprise combines not only encryption but also authentication.

Since WEP has been proved vulnerable, you may consider using WPA for the most secure

connection. You should select the appropriate security mechanism according to your needs.

No matter which security suite you select, they all will enhance the over-the-air data

protection and /or privacy on your wireless network. The Vigor wireless router is very flexible

and can support multiple secure connections with both WEP and WPA at the same time.

Info

The password (PSK) of default security mode is provided and stated on the

label pasted on the bottom of the router. For the wireless client who wants

to access into Internet through such router, please input the default PSK

value for connection.

S

e

p

a

r

a

t

e

t

h

e

W

i

r

e

l

e

s

a

n

d

t

h

e

W

i

r

e

d

L

A

N

-

W

L

A

N

I

s

o

l

a

t

i

o

n

It enables you to isolate your wireless LAN from wired LAN for either quarantine or limit

access reasons. To isolate means neither of the parties can access each other. To elaborate

an example for business use, you may set up a wireless LAN for visitors only so they can

connect to Internet without hassle of the confidential information leakage. For a more

flexible deployment, you may add filters of MAC addresses to isolate users’ access from wired

LAN.

M

a

n

a

g

e

W

i

r

e

l

e

s

S

t

a

t

i

o

n

s

-

S

t

a

t

i

o

n

L

i

s

t

Vigor2133 Series User’s Guide

168

It will display all the stations in your wireless network and the status of their connection.

W

P

S

WPS (Wi-Fi Protected Setup) provides easy procedure to make network connection between

wireless station and wireless access point (vigor router) with the encryption of WPA and

WPA2.

Info

WPS is available for the wireless station with WPS supported.

It is the simplest way to build connection between wireless network clients and vigor router.

Users do not need to select any encryption mode and type any long encryption passphrase to

setup a wireless client every time. He/she only needs to press a button on wireless client, and

WPS will connect for client and router automatically.

There are two methods to do network connection through WPS between AP and Stations:

pressing the Start PBC button or using PIN Code.

Vigor2133 Series User’s Guide

16

9

 On the side of Vigor2133 series which served as an AP, press WPS button once on the

front panel of the router or click Start PBC on web configuration interface. On the side

of a station with network card installed, press Start PBC button of network card.

 If you want to use PIN code, you have to know the PIN code specified in wireless client.

Then provide the PIN code of the wireless client you wish to connect to the vigor router.

For WPS is supported in WPA-PSK or WPA2-PSK mode, if you do not choose such mode in

Wireless LAN>>Security, you will see the following message box.

Please click OK and go back Wireless LAN>>Security to choose WPA-PSK or WPA2-PSK mode

and access WPS again.

Vigor2133 Series User’s Guide

170

W

e

b

U

s

e

r

I

n

t

e

r

f

a

c

e

I

-

1

-

1

W

i

r

e

l

e

s

W

i

z

a

r

d

The wireless wizard allows you to configure settings specified for a host AP (for home use or

internal use for a company) and specified for a guest AP (for any wireless clients accessing

into Internet).

Follow the steps listed below:

1. Open Wizards>>Wireless Wizard.

2. The screen of wireless wizard will be shown as follows. This page will be used for internal

users in a company or your home. Besides, the settings will change based on different

model of Vigor2133 series. In this case, Vigor2133ac is used as an example.

Vigor2133 Series User’s Guide

171

Available settings are explained as follows:

Item Description

Name Type the SSID name of this router for wireless connection.

The default name is defined with DrayTek. Change the name

if required.

Mode At present, the router can connect to 11a Only, 11n Only,

Mixed (11a+11n), and Mixed (11a+11n+11ac) stations

simultaneously. Simply choose Mixed (11a+11n+11ac) mode.

Channel Means the channel of frequency of the wireless LAN. The

default channel is 6. You may switch channel if the selected

channel is under serious interference. If you have no idea of

choosing the frequency, please select Auto to let system

determine for you.

Security Key The wireless mode offered by this wizard is WPA2/PSK.

The WPA encrypts each frame transmitted from the radio

using the key, which either PSK (Pre-Shared Key) entered

manually in this field below or automatically negotiated via

802.1x authentication.

Either 8~63 ASCII characters, such as 012345678(or 64

Hexadecimal digits leading by 0x, such as

“0x321253abcde…”).

Next Click it to get into the next setting page.

Cancel Exit the wireless wizard without saving any changes.

Vigor2133 Series User’s Guide

172

3. After typing the required information, click Next. The settings in the page limit the

wireless station (guest) accessing into Internet but not being allowed to share the LAN

network and VPN connection.

Available settings are explained as follows:

Item Description

Enable/Disable Click it to enable or disable settings in this page.

SSID Type the SSID name of this router. (SSID1)

Security Key The wireless mode offered by this wizard is WPA2/PSK.

The WPA encrypts each frame transmitted from the radio

using the key, which either PSK (Pre-Shared Key) entered

manually in this field below or automatically negotiated via

802.1x authentication.

Either 8~63 ASCII characters, such as 012345678(or 64

Hexadecimal digits leading by 0x, such as

"0x321253abcde...").

Bandwidth Limit It controls the data transmission rate through wireless

connection.

Total Upload – Check Enable and type the transmitting rate

for data upload. Default value is 30,000 kbps.

Total Download – Type the transmitting rate for data

download. Default value is 30,000 kbps.

Use the same SSID

and Security Key as

above

Check the box to use the same settings configured above.

Next Click it to get into the next setting page.

Cancel Exit the wireless wizard without saving any changes.

4. After typing the required information, click Next.

Vigor2133 Series User’s Guide

173

5. The following page will display the configuration summary for wireless setting.

6. Click Finish to complete the wireless settings configuration.

Vigor2133 Series User’s Guide

174

I

-

1

-

2

G

e

n

e

r

a

l

S

e

t

u

p

By clicking the Wireless LAN>>General Setup, a new web page will appear so that you could

configure the SSID and the wireless channel. Please refer to the following figure for more

information.

Available settings are explained as follows:

Item Description

Enable Wireless LAN Check the box to enable wireless function.

Mode For 2.4GHz: At present, the router can connect to 11b Only,

11g Only, 11n Only(2.4 GHz), Mixed (11b+11g), Mixed

(11g+11n), and Mixed (11b+11g+11n) stations

simultaneously. Simply choose Mixed (11b+11g+11n) mode.

For 5GHz: At present, the router can connect to 11a Only,

11n Only (5 GHz), Mixed (11a+11n) and Mixed

(11a+11n+11ac) stations simultaneously. Simply choose

Mixed (11a+11n+11ac) mode.

Note: 802.11b/g operates on 2.4G band, 802.11a operates

on 5G band, 802.11n operates on either 2.4G or 5G band, and

802.11ac operates on 5G band only.

Vigor2133 Series User’s Guide

175

Channel Means the channel of frequency of the wireless LAN. The

default channel is 6. You may switch channel if the selected

channel is under serious interference. If you have no idea of

choosing the frequency, please select Auto to let system

determine for you.

2.4GHz in “n” model:

5 GHz in “ac” model:

Hide SSID Check it to prevent from wireless sniffing and make it harder

for unauthorized clients or STAs to join your wireless LAN.

Depending on the wireless utility, the user may only see the

information except SSID or just cannot see any thing about

Vigor wireless router while site surveying. The system allows

you to set four sets of SSID for different usage. In default,

the first set of SSID will be enabled. You can hide it for your

necessity.

SSID Means the identification of the wireless LAN. SSID can be any

text numbers or various special characters.

Isolate Member –Check this box to make the wireless clients

(stations) with the same SSID not accessing for each other.

VPN – Check this box to make the wireless clients (stations)

with different VPN not accessing for each other.

Schedule Set the wireless LAN to work at certain time interval only.

You may choose up to 4 schedules out of the 15 schedules

pre-defined in Applications >> Schedule setup. The default

setting of this field is blank and the function will always

work.

After finishing all the settings here, please click OK to save the configuration.

Vigor2133 Series User’s Guide

176

I

-

1

-

3

S

e

c

u

r

i

t

y

This page allows you to set security with different modes for SSID 1, 2, 3 and 4 respectively.

After configuring the correct settings, please click OK to save and invoke it.

The password (PSK) of default security mode is provided and stated on the label pasted on the

bottom of the router. For the wireless client who wants to access into Internet through such

router, please input the default PSK value for connection.

By clicking the Wireless LAN>>Security Settings, a new web page will appear so that you

could configure the settings of WPA and WEP.

Available settings are explained as follows:

Item Description

Mode

There are several modes provided for you to choose.

Vigor2133 Series User’s Guide

17

7

Info

You should also set RADIUS Server

simultaneously if 802.1x mode is selected.

Disable - Turn off the encryption mechanism.

WEP - Accepts only WEP clients and the encryption key

should be entered in WEP Key.

WEP/802.1x Only - Accepts only WEP clients and the

encryption key is obtained dynamically from RADIUS server

with 802.1X protocol.

WPA/802.1x Only - Accepts only WPA clients and the

encryption key is obtained dynamically from RADIUS server

with 802.1X protocol.

WPA2/802.1x Only - Accepts only WPA2 clients and the

encryption key is obtained dynamically from RADIUS server

with 802.1X protocol.

Mixed (WPA+WPA2/802.1x only) - Accepts WPA and WPA2

clients simultaneously and the encryption key is obtained

dynamically from RADIUS server with 802.1X protocol.

WPA/PSK - Accepts only WPA clients and the encryption key

should be entered in PSK.

WPA2/PSK - Accepts only WPA2 clients and the encryption

key should be entered in PSK.

Mixed (WPA+ WPA2)/PSK - Accepts WPA and WPA2 clients

simultaneously and the encryption key should be entered in

PSK.

WPA

The WPA encrypts each frame transmitted from the radio

using the key, which either PSK (Pre-Shared Key) entered

manually in this field below or automatically negotiated via

802.1x authentication. Either 8~63 ASCII characters, such as

012345678(or 64 Hexadecimal digits leading by 0x, such as

"0x321253abcde...").

Pre-Shared Key (PSK) - Either 8~63 ASCII characters, such as

012345678..(or 64 Hexadecimal digits leading by 0x, such as

"0x321253abcde...").

Password Strength – The system will display the password

strength (represented with the word of weak, medium or

strong) of the PSK specified above.

WEP

64-Bit - For 64 bits WEP key, either 5 ASCII characters, such

as 12345 (or 10 hexadecimal digitals leading by 0x, such as

0x4142434445.)

128-Bit - For 128 bits WEP key, either 13 ASCII characters,

Vigor2133 Series User’s Guide

178

such as ABCDEFGHIJKLM (or 26 hexadecimal digits leading by

0x, such as 0x4142434445464748494A4B4C4D).

All wireless devices must support the same WEP encryption

bit size and have the same key. Four keys can be entered

here, but only one key can be selected at a time. The keys

can be entered in ASCII or Hexadecimal. Check the key you

wish to use.

After finishing all the settings here, please click OK to save the configuration.

I

-

1

-

4

A

c

e

s

C

o

n

t

r

o

l

In the Access Control, the router may restrict wireless access to certain wireless clients only

by locking their MAC address into a black or white list. The user may block wireless clients by

inserting their MAC addresses into a black list, or only let them be able to connect by inserting

their MAC addresses into a white list.

In the Access Control web page, users may configure the white/black list modes used by each

SSID and the MAC addresses applied to their lists.

Available settings are explained as follows:

Item Description

Enable Mac Address Filter

Select to enable the MAC Address filter for wireless LAN

identified with SSID 1 to 4 respectively. All the clients

(expressed by MAC addresses) listed in the box can be

grouped under different wireless LAN. For example, they can

be grouped under SSID 1 and SSID 2 at the same time if you

Vigor2133 Series User’s Guide

17

9

check SSID 1 and SSID 2.

MAC Address Filter Display all MAC addresses that are edited before.

Client’s MAC Address Manually enter the MAC address of wireless client.

Apply SSID After entering the client’s MAC address, check the box of the

SSIDs desired to insert this MAC address into their access

control list.

Attribute s: Isolate the station from LAN - select to isolate the

wireless connection of the wireless client of the MAC address

from LAN.

Add Add a new MAC address into the list.

Delete Delete the selected MAC address in the list.

Edit Edit the selected MAC address in the list.

Cancel Give up the access control set up.

OK Click it to save the access control list.

Clear All Clean all entries in the MAC address list.

Backup Access Control Settings on this web page can be saved as a file which can be

restored in the future by this device or other device.

Upload From File Restore wireless access control settings and applied onto this

device.

After finishing all the settings here, please click OK to save the configuration.

I

-

1

-

5

W

P

S

Below shows Wireless LAN>>WPS web page:

Available settings are explained as follows:

Item Description

Enable WPS Check this box to enable WPS setting.

WPS Status Display related system information for WPS. If the wireless

security (encryption) function of the router is properly

Vigor2133 Series User’s Guide

180

configured, you can see ‘Configured’ message here.

SSID Display the SSID1 of the router. WPS is supported by SSID1

only.

Authentication Mode Display current authentication mode of the router. Only

WPA2/PSK and WPA/PSK support WPS.

Configure via Push Button

Click Start PBC to invoke Push-Button style WPS setup

procedure. The router will wait for WPS requests from

wireless clients about two minutes. The WPS LED on the

router will blink fast when WPS is in progress. It will return to

normal condition after two minutes. (You need to setup WPS

within two minutes)

Configure via Client

PinCode

Please input the PIN code specified in wireless client you

wish to connect, and click Start PIN button. The WPS LED on

the router will blink fast when WPS is in progress. It will

return to normal condition after two minutes. (You need to

setup WPS within two minutes)

Vigor2133 Series User’s Guide

181

I

-

1

-

6

W

D

S

WDS means Wireless Distribution System. It is a protocol for connecting two access points (AP)

wirelessly. Usually, it can be used for the following application:

 Provide bridge traffic between two LANs through the air.

 Extend the coverage range of a WLAN.

Refer to the following table:

WDS Mode Wireless

Signal

Comparisons

Bridge

Limited

 Wireless stations (clients) within the effective range of

wireless signal can access into Internet through the router

/AP.

 Wireless stations (clients) out of the effective range of

wireless signal cannot access into Internet through the

router /AP with Bridge mode configured.

 The packets received from a WDS link will only be forwarded

to local wired or wireless hosts.

Repeater

Extended

 Wireless stations (clients) within the effective range of

wireless signal can access into Internet through the router

/AP.

 Wireless stations (clients) out of the effective range of

wireless signal can access into Internet through the router

/AP with Repeater mode configured.

 The packets received from one Vigor router can be repeated

to another AP (remotely) through WDS links.

 Only Repeater mode can do WDS-to-WDS packet forwarding.

The WDS - Repeater mode is implemented in Vigor router. The application for the

WDS-Repeater mode is depicted as below:

Click WDS from Wireless LAN menu. The following page will be shown.

Vigor2133 Series User’s Guide

182

Available settings are explained as follows:

Item Description

Mode Choose the mode for WDS setting. Disable mode will not

invoke any WDS setting. Repeater mode is for the second

one.

Security There are three types for security, Disable, WEP and

Pre-shared key. The setting you choose here will make the

following WEP or Pre-shared key field valid or not. Choose

one of the types for the router.

Pre-shared Key When Pre-Shared Key is selected as Security above,

configure the following settings if required.

Type – There are some types for you to choose. WPA and

WPA2 are used for WDS devices (e.g.2925n wireless router,

you can set the encryption mode as WPA or WPA2 to establish

your WDS system between AP and the router.

Key – Set the encryption key in this field. Type 8 ~ 63 ASCII

characters or 64 hexadecimal digits leading by “0x”.

Bridge

If you choose Bridge as the connecting mode, please type in

the peer MAC address in these fields. Four peer MAC

addresses are allowed to be entered in this page at one time.

Yet please disable the unused link to get better

performance. If you want to invoke the peer MAC address,

remember to check Enable box in the front of the MAC

Vigor2133 Series User’s Guide

183

address after typing.

Repeater If you choose Repeater as the connecting mode, please type

in the peer MAC address (of VigorAP/Vigor router required to

make connection with such Vigor router and used to extend

the wireless signal) in these fields.

Four peer MAC addresses are allowed to be entered in this

page at one time. Similarly, if you want to invoke the peer

MAC address, remember to check Enable box in the front of

the MAC address after typing.

Access Point Function Click Enable to make this router serve as an access point.

When Repeater is set as WDS Mode, click Enable to use such

function.

Click Disable if Bridge is set as WDS Mode.

Status It allows user to send “hello” message to peers. Yet, it is

valid only when the peer also supports this function.

After finishing all the settings here, please click OK to save the configuration.

Vigor2133 Series User’s Guide

184

I

-

1

-

7

A

d

v

a

n

c

e

d

S

e

t

i

n

g

This page allows users to set advanced settings such as operation mode, channel bandwidth,

guard interval, and aggregation MSDU for wireless data transmission.

Available settings are explained as follows:

Item Description

Operation Mode Mixed Mode – the router can transmit data with the ways

supported in both 802.11a/b/g and 802.11n standards.

However, the entire wireless transmission will be slowed

down if 802.11g or 802.11b wireless client is connected.

Green Field – to get the highest throughput, please choose

such mode. Such mode can make the data transmission

happen between 11n systems only. In addition, it does not

have protection mechanism to avoid the conflict with

neighboring devices of 802.11a/b/g.

Channel Bandwidth Vigor router will use 20MHz/40MHz/80MHz for data

transmission and receiving between the AP and the stations.

20/40- Vigor Router will scan for nearby wireless AP, and

then use 20MHz if the number of AP is more than 10, or use

40MHz if it's not.

Guard Interval It is to assure the safety of propagation delays and

reflections for the sensitive digital data. If you choose auto

as guard interval, the AP router will choose short guard

interval (increasing the wireless performance) or long guard

interval for data transmit based on the station capability.

Aggregation MSDU

Aggregation MSDU can combine frames with different sizes

.

It is used for improving MAC layer’s performance for some

brand’s clients. The default setting is Enable.

Long Preamble This option is to define the length of the sync field in an

802.11 packet. Most modern wireless network uses short

preamble with 56 bit sync field instead of long preamble with

128 bit sync field. However, some original 11b wireless

network devices only support long preamble. Click Enable to

Vigor2133 Series User’s Guide

185

use Long Preamble if needed to communicate with this kind

of devices.

Packet-OVERDRIVE TX

Burst

This feature can enhance the performance in data

transmission about 40%* more (by checking Tx Burst). It is

active only when both sides of Access Point and Station (in

wireless client) invoke this function at the same time. That

is, the wireless client must support this feature and invoke

the function, too.

Note: Vigor N61 wireless adapter supports this function.

Therefore, you can use and install it into your PC for

matching with Packet-OVERDRIVE (refer to the following

picture of Vigor N61 wireless utility window, choose Enable

for TxBURST on the tab of Option).

TX Power Set the power percentage for transmission signal of access

point. The greater the value is, the higher intensity of the

signal will be.

WMM Capable WMM is an abbreviation of Wi-Fi Multimedia. It defines the

priority levels for four access categories derived from 802.1d

(prioritization tabs). The categories are designed with

specific types of traffic, voice, video, best effort and low

priority data. There are four accessing categories - AC_BE ,

AC_BK, AC_VI and AC_VO for WMM.

To apply WMM parameters for wireless data transmission,

please click the Enable radio button.

APSD Capable APSD (automatic power-save delivery) is an enhancement

over the power-save mechanisms supported by Wi-Fi

networks. It allows devices to take more time in sleeping

state and consume less power to improve the performance

by minimizing transmission latency.

The default setting is Disable.

Rate Adaptation Algorithm

Wireless transmission rate is adapted dynamically. Usually,

performance of “new” algorithm is better than “old”.

Fragment Length

(256 – 2346)

Set the Fragment threshold. Do not modify

default value if

you don’t know what it is, default value is

2346.

RTS Threshold (1 – 2347) Minimize the collision (unit is bytes) between hidden stations

to improve wireless performance.

Set the RTS threshold. Do not modify default

value if you

don’t know what it is, default value is 2347.

Vigor2133 Series User’s Guide

186

Country Code Vigor router broadcasts country codes by following the

802.11d standard. However, some wireless stations will

detect / scan the country code to prevent conflict occurred.

If conflict is detected, wireless station will be warned and is

unable to make network connection. Therefore, changing

the country code to ensure successful network connection

will be necessary for some clients.

After finishing all the settings here, please click OK to save the configuration.

Vigor2133 Series User’s Guide

18

7

I

-

1

-

8

S

t

a

t

i

o

n

C

o

n

t

r

o

l

Station Control is used to specify the duration for the wireless client to connect and

reconnect Vigor router. If such function is not enabled, the wireless client can connect Vigor

router until the router shuts down.

Such feature is especially useful for free Wi-Fi service. For example, a coffee shop offers free

Wi-Fi service for its guests for one hour every day. Then, the connection time can be set as “1

hour” and reconnection time can be set as “1 day”. Thus, the guest can finish his job within

one hour and will not occupy the wireless network for a long time.

Available settings are explained as follows:

Item Description

SSID Display the SSID that the wireless station will use it to

connect with Vigor router.

Enable Check the box to enable the station control function.

Connection Time /

Reconnection Time

Use the drop down list to choose the duration for the

wireless client connecting /reconnecting to Vigor router. Or,

type the duration manually when you choose User defined.

Display All Station Control

List

All the wireless stations connecting to Vigor router by using

such SSID will be listed on Station Control List.

Web Portal Setup Click it to access in to LAN>>Web Portal Setup page for

modifying the settings if required.

After finishing all the settings here, please click OK to save the configuration.

I

-

1

-

9

A

P

D

i

s

c

o

v

e

r

y

Vigor router can scan all regulatory channels and find working APs in the neighborhood. Based

on the scanning result, users will know which channel is clean for usage. Also, it can be used

to facilitate finding an AP for a WDS link. Notice that during the scanning process (about 5

seconds), no client is allowed to connect to Vigor.

This page is used to scan the existence of the APs on the wireless LAN. Yet, only the AP which

is in the same channel of this router can be found. Please click Scan to discover all the

connected APs.

Vigor2133 Series User’s Guide

188

Available settings are explained as follows:

Item Description

Scan It is used to discover all the connected AP. The results will be

shown on the box above this button.

Statistics It displays the statistics for the channels used by APs.

Add to If you want the found AP applying the WDS settings, please

type in the AP’s MAC address on the bottom of the page and

click Repeater. Next, click Add to. Later, the MAC address of

the AP will be added to Bridge or Repeater field of WDS

settings page.

Vigor2133 Series User’s Guide

18

9

I

-

1

-

1

0

B

a

n

d

w

i

d

t

h

M

a

n

a

g

e

m

e

n

t

The downstream or upstream from FTP, HTTP or some P2P applications will occupy large of

bandwidth and affect the applications for other programs. Please use Bandwidth Management

to make the bandwidth usage more efficient.

Available settings are explained as follows:

Item Description

SSID Display the specific SSID name.

Enable Check this box to enable the bandwidth management for

clients.

Bandwidth Limit Type Auto Adjustment - Bandwidth limit is determined by the

system automatically.

Per Station Limit – Bandwidth limit is determined according

to the limitation of the wireless client.

Total Upload Limit It is available when Auto Adjustment is selected.

Type a value to define the maximum data traffic (uploading)

for all of the wireless clients connecting to Vigor router.

Total Download Limit It is available when Auto Adjustment is selected.

Type a value to define the maximum data clientstations

connecting to Vigor router.

Upload Limit It is available when Per Station Limit is selected.

Type a value to define the maximum data traffic (uploading)

for each wireless client connecting to Vigor router.

Download Limit It is available when Per Station Limit is selected

Type a value to define the maximum data traffic

(downloading) for each wireless client connecting to Vigor

router.

After finishing this web page configuration, please click OK to save the settings.

Vigor2133 Series User’s Guide

190

I

-

1

-

1

A

i

r

t

i

m

e

F

a

i

r

n

e

s

Airtime fairness is essential in wireless networks that must support critical enterprise

applications.

Most of the applications are either symmetric or require more downlink than uplink capacity;

telephony and email send the same amount of data in each direction, while video streaming

and web surfing involve more traffic sent from access points to clients than the other way

around. This is essential for ensuring predictable performance and quality-of-service, as well

as allowing 802.11n and legacy clients to coexist on the same network. Without airtime

fairness, offices using mixed mode networks risk having legacy clients slow down the entire

network or letting the fastest client(s) crowd out other users.

With airtime fairness, every client at a given quality-of-service level has equal access to the

network's airtime.

The wireless channel can be accessed by only one wireless station at the same time.

The principle behind the IEEE802.11 channel access mechanisms is that each station has

equal probability to access the channel. When wireless stations have similar data rate, this

principle leads to a fair result. In this case, stations get similar channel access time which is

called airtime.

However, when stations have various data rate (e.g., 11g, 11n), the result is not fair. The

slow stations (11g) work in their slow data rate and occupy too much airtime, whereas the

fast stations (11n) become much slower.

Take the following figure as an example, both Station A(11g) and Station B(11n) transmit data

packets through Vigor router. Although they have equal probability to access the wireless

channel, Station B(11n) gets only a little airtime and waits too much because Station A(11g)

spends longer time to send one packet. In other words, Station B(fast rate) is obstructed by

Station A(slow rate).

To improve this problem, Airtime Fairness is added for Vigor router. Airtime Fairness function

tries to assign similar airtime to each station (A/B) by controlling TX traffic. In the following

figure, Station B(11n) has higher probability to send data packets than Station A(11g). By this

way, Station B(fast rate) gets fair airtime and it's speed is not limited by Station A(slow rate).

Vigor2133 Series User’s Guide

191

It is similar to automatic Bandwidth Limit. The dynamic bandwidth limit of each station

depends on instant active station number and airtime assignment. Please note that Airtime

Fairness of 2.4GHz and 5GHz are independent. But stations of different SSIDs function

together, because they all use the same wireless channel. IN SPECIFIC ENVIRONMENTS, this

function can reduce the bad influence of slow wireless devices and improve the overall

wireless performance.

Suitable environment:

(1) Many wireless stations.

(2) All stations mainly use download traffic.

(3) The performance bottleneck is wireless connection.

Available settings are explained as follows:

Item Description

Enable Airtime Fairness Try to assign similar airtime to each wireless station by

controlling TX traffic.

Airtime Fairness – Click the link to display the following

screen of airtime fairness note.

Triggering Client Number –Airtime Fairness function is

applied only when active station number achieves this

number.

After finishing this web page configuration, please click OK to save the settings.

Info

Airtime Fairness function and Bandwidth Limit function should be mutually

exclusive. So their webs have extra actions to ensure these two functions

are not enabled simultaneously.

Vigor2133 Series User’s Guide

192

I

-

1

-

1

2

B

a

n

d

S

t

e

r

i

n

g

Band Steering detects if the wireless clients are capable of 5GHz operation, and steers them

to that frequency. It helps to leave 2.4GHz band available for legacy clients, and improves

users experience by reducing channel utilization.

If dual-band is detected, the AP will let the wireless client connect to less congested wireless

LAN, such as 5GHz to prevent from network congestion.

Info

To make Band Steering work successfully, SSID and security on 2.4GHz also

MUST be broadcasted on 5GHz.

Vigor2133 Series User’s Guide

193

Open Wireless LAN (2.4GHz)>>Band Steering to get the following web page:

Available settings are explained as follows:

Item Description

Enable Band Steering If it is enabled, Vigor router will detect if the wireless client

is capable of dual-band or not within the time limit.

Check Time…. – If the wireless station does not have the

capability of 5GHz network connection, the system shall wait

and check for several seconds (15 seconds, in default) to

make the 2.4GHz network connection. Specify the time limit

for Vigor router to detect the wireless client.

After finishing this web page configuration, please click OK to save the settings.

Below shows how Band Steering works.

Vigor2133 Series User’s Guide

194

How to Use Band Steering?

1. Open Wireless LAN(2.4GHz)>>Band Steering.

2. Check the box of Enable Band Steering and use the default value (15) for check time

setting.

3. Click OK to save the settings.

4. Open Wireless LAN (2.4GHz)>>General Setup and Wireless LAN (5GHz)>> General

Setup. Configure SSID as DrayTek2862_BandSteering for both pages. Click OK to save the

settings.

Same

settings for

2.4GHz and

5GHz

Vigor2133 Series User’s Guide

195

5. Open Wireless LAN (2.4GHz)>>Security and Wireless LAN (5GHz)>>Security. Configure

Security as 12345678 for both pages. Click OK to save the settings.

6. Now, Vigor router will let the wireless clients connect to less congested wireless LAN,

such as 5GHz to prevent from network congestion.

Same value

for 2.4GHz

and 5GHz

Vigor2133 Series User’s Guide

196

I

-

1

-

1

3

R

o

a

m

i

n

g

The network signal for a single wireless access point might be limited by its coverage range.

Therefore, if you want to expand the wireless network in a large exhibition with a quick

method, you can install multiple access points with enabling the Roaming feature for each AP

to reach the purpose of expanding wireless signals seamlessly.

These access points connecting for each other shall be verified by pre-authentication. This

page allows you to enable the roaming feature and the pre-authentication.

Available settings are explained as follows:

Item Description

Disable RSSI Requirement When the link rate of wireless station is too low or the signal

received by the wireless station is too worse, Vigor router

will automatically detect (based on the link rate and RSSI

requirement) and cut off the network connection for that

wireless station to assist it to connect another Wireless AP to

get better signal.

This option is to disable the roaming mechanism.

Strictly Minimum RSSI Vigor router uses RSSI (received signal strength indicator) to

decide to terminate the network connection of wireless

station. When the signal strength is below the value (dBm)

set here, Vigor router will terminate the network connection

for that wireless station.

Minimum RSSI Minimum RSSI - When the signal strength of the wireless

station is below the value (dBm) set here and adjacent AP

(must be DrayTek AP and support such feature too) with

higher signal strength value (defined in the field of With

Adjacent AP RSSI over) is detected by Vigor router, Vigor

router will terminate the network connection for that

wireless station. Later, the wireless station can connect to

the adjacent AP (with better RSSI).

 With Adjacent AP RSSI over – Specify a value as a

threshold.

After finishing this web page configuration, please click OK to save the settings.

Vigor2133 Series User’s Guide

19

7

I

-

1

-

1

4

S

t

a

t

i

o

n

L

i

s

t

Station List provides the knowledge of connecting wireless clients now along with its status

code. There is a code summary below for explanation. For convenient Access Control, you

can select a WLAN station and click Add to Access Control below.

Available settings are explained as follows:

Item Description

Refresh Click this button to refresh the status of station list.

Add Click this button to add current typed MAC address into

Access Control.

Vigor2133 Series User’s Guide

198

This page is left blank.

Vigor2133 Series User’s Guide

19

9

P

a

r

t

I

V

P

N

A Virtual Private Network (VPN) is the extension of a

private network that encompasses links across shared

or public networks like the Internet. In short, by VPN

technology, you can send data between two

computers across a shared or public network in a

manner that emulates the properties of a

point-to-point private link.

It is a form of VPN that can be used with a standard

Web browser.

A digital certificate works as an electronic ID, which

is issued by a certification authority (CA). It contains

information such as your name, a serial number,

expiration dates etc., and the digital signature of the

certificate-issuing authority so that a recipient can

verify that the certificate is real. Here Vigor router

support digital certificates conforming to standard

X.509.

Vigor2133 Series User’s Guide

200

I

V

-

1

V

P

N

a

n

d

R

e

m

o

t

e

A

c

e

s

A Virtual Private Network (VPN) is the extension of a private network that encompasses links

across shared or public networks like the Internet. In short, by VPN technology, you can send

data between two computers across a shared or public network in a manner that emulates the

properties of a point-to-point private link.

The VPN built is suitable for:

 Communication between home office and customer

 Secure connection between Teleworker, staff on business trip and main office

 Exchange data between remote office and main office

 POS between chain store and headquarters

S

i

t

e

-

t

o

-

S

i

t

e

(

L

A

N

-

t

o

-

L

A

N

)

 A connection between two router's LAN networks.

 Allows employees in branch offices and head office to share the same network resources.

R

e

m

o

t

e

A

c

e

s

(

R

e

m

o

t

e

D

i

a

l

-

i

n

)

 A connection between the remote host and router's LAN network. The host will use an IP

address in the local subnet.

 Allows employees to access the company's internal resources when they are traveling.

Vigor2133 Series User’s Guide

201

W

e

b

U

s

e

r

I

n

t

e

r

f

a

c

e

I

V

-

1

-

1

V

P

N

C

l

i

e

n

t

W

i

z

a

r

d

Such wizard is used to configure VPN settings for VPN client. Such wizard will guide to set the

LAN-to-LAN profile for VPN dial out connection (from server to client) step by step.

1. Open Wizards>>VPN Client Wizard. The following page will appear.

Available settings are explained as follows:

Item Description

LAN-to-LAN Client

Mode Selection

Choose the client mode.

Route Mode/NAT Mode – If the remote network only allows

you to dial in with single IP, please choose NAT mode,

otherwise please choose Route Mode.

Please choose a

LAN-to-LAN Profile

There are 32 VPN profiles for users to set.

Vigor2133 Series User’s Guide

202

2. When you finish the mode and profile selection, please click Next to open the following

page.

In this page, you have to select suitable VPN type for the VPN client profile. There are six

types provided here. Different type will lead to different configuration page. After

making the choices for the client profile, please click Next. You will see different

configurations based on the selection(s) you made.

Info

The following descriptions for VPN Type are based on the Route Mode

specified in LAN-to-LAN Client Mode Selection.

When you choose PPTP (None Encryption) or PPTP (Encryption), you will see the

following graphic:

Vigor2133 Series User’s Guide

203

When you choose IPsec, you will see the following graphic:

When you choose SSL, you will see the following graphic:

Vigor2133 Series User’s Guide

204

When you choose L2TP over IPsec (Nice to Have) or L2TP over IPsec (Must), you will see

the following graphic:

Available settings are explained as follows:

Item Description

Profile Name Type a name for such profile. The length of the file is limited

to 10 characters.

Always On Check to enable router always keep VPN connection.

Server IP/Host Name Type the IP address of the server or type the host name for

Vigor2133 Series User’s Guide

205

for VPN such VPN profile.

IKE Authentication

Method

IKE Authentication Method usually applies to those are

remote dial-in user or node (LAN to LAN) which uses dynamic

IP address and IPsec-related VPN connections such as L2TP

over IPsec and IPsec tunnel.

Pre-Shared Key- Specify a key for IKE authentication.

Confirm Pre-Shared Key-Confirm the pre-shared key.

Digital Signature

(X.509)

Click Digital Signature to invoke this function.

Peer ID – Choose the peer ID selection from the drop down

list.

Local ID – Choose Alternative Subject Name First or Subject

Name First.

Local Certificate – Use the drop down list to choose one of

the certificates for using. You have to configure one

certificate at least previously in Certificate Management >>

Local Certificate. Otherwise, the setting you choose here

will not be effective.

IPsec Security Method

Medium - Authentication Header (AH) means data will be

authenticated, but not be encrypted. By default, this option

is active.

High - Encapsulating Security Payload (ESP) means payload

(data) will be encrypted and authenticated. You may select

encryption algorithm from Data Encryption Standard (DES),

Triple DES (3DES), and AES.

User Name This field is used to authenticate for connection when you

select PPTP or L2TP with or without IPsec policy above.

The length of the user name is limited to 11 characters.

Password This field is used to authenticate for connection when you

select PPTP or L2TP with or without IPsec policy above.

The length of the password is limited to 11 characters.

Remote Network IP Please type one LAN IP address (according to the real

location of the remote host) for building VPN connection.

Remote Network

Mask

Please type the network mask (according to the real location

of the remote host) for building VPN connection.

3. After finishing the configuration, please click Next. The confirmation page will be

shown as follows. If there is no problem, you can click one of the radio buttons listed on

the page and click Finish to execute the next action.

Vigor2133 Series User’s Guide

206

Available settings are explained as follows:

Item Description

Go to the VPN

Connection

Management

Click this radio button to access VPN and Remote

Access>>Connection Management for viewing VPN

Connection status.

Do another VPN

Server Wizard Setup

Click this radio button to set another profile of VPN Server

through VPN Server Wizard.

View more detailed

configuration

Click this radio button to access VPN and Remote

Access>>LAN to LAN for viewing detailed configuration.

Vigor2133 Series User’s Guide

20

7

I

V

-

1

-

2

V

P

N

S

e

r

v

e

r

W

i

z

a

r

d

Such wizard is used to configure VPN settings for VPN server. Such wizard will guide to set the

LAN-to-LAN profile for VPN dial in connection (from client to server) step by step.

1. Open Wizards>>VPN Server Wizard. The following page will appear.

Available settings are explained as follows:

Item Description

VPN Server Mode

Selection

Choose the direction for the VPN server.

Site to Site VPN – To set a LAN-to-LAN profile automatically,

please choose Site to Site VPN.

Remote Dial-in User –You can manage remote access by

maintaining a table of remote user profile, so that users can

be authenticated to dial-in via VPN connection.

Please choose a

LAN-to-LAN Profile

This item is available when you choose Site to Site VPN

(LAN-to-LAN) as VPN server mode. There are 32 VPN profiles

for users to set.

Please choose a

Dial-in User Accounts

This item is available when you choose Remote Dial-in User

(Teleworker) as VPN server mode. There are 32 VPN tunnels

for users to set.

Allowed Dial-in Type This item is available after you choose any one of dial-in user

account profiles. Next, you have to select suitable dial-in

type for the VPN server profile. There are several types

provided here (similar to VPN Client Wizard).

Vigor2133 Series User’s Guide

208

Different Dial-in Type will lead to different configuration

page. In addition, adjustable items for each dial-in type will

be changed according to the VPN Server Mode (Site to Site

VPN and Remote Dial-in User) selected.

2. After making the choices for the server profile, please click Next. You will see different

configurations based on the selection you made. Here we take the examples of choosing

Site-to-Site VPN as the VPN Server Mode.

When you check PPTP/SSL, you will see the following graphic:

When you check PPTP & IPsec & L2TP (three types) or PPTP & IPsec (two types) or L2TP

with Policy (Nice to Have/Must), you will see the following graphic:

Vigor2133 Series User’s Guide

20

9

When you check IPsec, you will see the following graphic:

Available settings are explained as follows:

Item Description

Profile Name Type a name for such profile. The length of the file is limited

to 10 characters.

User Name This field is used to authenticate for connection when you

select PPTP or L2TP with or without IPsec policy above.

The length of the name is limited to 11 characters.

Vigor2133 Series User’s Guide

210

Password This field is used to authenticate for connection when you

select PPTP or L2TP with or without IPsec policy above.

The length of the name is limited to 11 characters.

Pre-Shared Key For IPsec/L2TP IPsec authentication, you have to type a

pre-shared key.

The length of the name is limited to 64 characters.

Confirm Pre-Shared

Key

Type the pre-shared key again for confirmation.

Digital Signature

(X.509)

Check the box of Digital Signature to invoke this function.

Peer ID – Choose the peer ID selection from the drop down

list.

Local ID – Choose Alternative Subject Name First or Subject

Name First.

Peer IP/VPN Client IP Type the WAN IP address or VPN client IP address for the

remote client.

Peer ID Type the ID name for the remote client.

The length of the name is limited to 47 characters.

3. After finishing the configuration, please click Next. The confirmation page will be

shown as follows. If there is no problem, you can click one of the radio buttons listed on

the page and click Finish to execute the next action.

Available settings are explained as follows:

Item Description

Go to the VPN

Connection

Management

Click this radio button to access VPN and Remote

Access>>Connection Management for viewing VPN

Connection status.

Do another VPN

Server Wizard Setup

Click this radio button to set another profile of VPN Server

through VPN Server Wizard.

Vigor2133 Series User’s Guide

211

View more detailed

configuration

Click this radio button to access VPN and Remote

Access>>LAN to LAN for viewing detailed configuration.

I

V

-

1

-

3

R

e

m

o

t

e

A

c

e

s

C

o

n

t

r

o

l

Enable the necessary VPN service as you need. If you intend to run a VPN server inside your

LAN, you should disable the VPN service of Vigor Router to allow VPN tunnel pass through, as

well as the appropriate NAT settings, such as DMZ or open port.

Open VPN and Remote Access>>Remote Access Control.

After finishing all the settings here, please click OK to save the configuration.

Vigor2133 Series User’s Guide

212

I

V

-

1

-

4

P

G

e

n

e

r

a

l

S

e

t

u

p

This submenu only applies to PPP-related VPN connections, such as PPTP, L2TP, L2TP over

IPsec.

Available settings are explained as follows:

Item Description

Dial-In PPP Authentication

PAP Only - elect this option to force the router to

authenticate dial-in users with the PAP protocol.

PAP/CHAP/MS-CHAP/MS-CHAPv2 - Selecting this option

means the router will attempt to authenticate dial-in users

with the CHAP protocol first. If the dial-in user does not

support this protocol, it will fall back to use the PAP protocol

for authentication.

Dial-In PPP Encryption

(MPPE)

Optional MPPE - This option represents that the MPPE

encryption method will be optionally employed in the router

for the remote dial-in user. If the remote dial-in user does

not support the MPPE encryption algorithm, the router will

transmit “no MPPE encrypted packets”. Otherwise, the MPPE

encryption scheme will be used to encrypt the data.

 Require MPPE (40/128bits) - Selecting this option will

force the router to encrypt packets by using the MPPE

encryption algorithm. In addition, the remote dial-in

user will use 40-bit to perform encryption prior to using

128-bit for encryption. In other words, if 128-bit MPPE

encryption method is not available, then 40-bit

encryption scheme will be applied to encrypt the data.

 Maximum MPPE - This option indicates that the router

will use the MPPE encryption scheme with maximum

bits (128-bit) to encrypt the data.

Mutual Authentication

(PAP)

The Mutual Authentication function is mainly used to

communicate with other routers or clients who need

bi-directional authentication in order to provide stronger

security, for example, Cisco routers. So you should enable

Vigor2133 Series User’s Guide

213

this function when your peer router requires mutual

authentication. You should further specify the User Name

and Password of the mutual authentication peer.

The length of the name/password is limited to 23/19

characters.

IP Address Assignment for

Dial-In Users

Enter a start IP address for the dial-in PPP connection. You

should choose an IP address from the local private network.

For example, if the local private network is

192.168.1.0/255.255.255.0, you could choose 192.168.1.200

as the Start IP Address.

You can configure up to four start IP addresses for LAN1 ~

LAN4.

PPP Authentication

Methods

Select the method(s) to be used for authentication in PPP

connection.

While using Radius

Authentication

If PPP connection will be authenticated via RADIUS server, it

is necessary to specify the LAN profile for the dial-in user to

get IP from.

Vigor2133 Series User’s Guide

214

I

V

-

1

-

5

I

P

s

e

c

G

e

n

e

r

a

l

S

e

t

u

p

In IPsec General Setup, there are two major parts of configuration.

There are two phases of IPsec.

 Phase 1: negotiation of IKE parameters including encryption, hash, Diffie-Hellman

parameter values, and lifetime to protect the following IKE exchange, authentication of

both peers using either a Pre-Shared Key or Digital Signature (x.509). The peer that

starts the negotiation proposes all its policies to the remote peer and then remote peer

tries to find a highest-priority match with its policies. Eventually to set up a secure

tunnel for IKE Phase 2.

 Phase 2: negotiation IPsec security methods including Authentication Header (AH) or

Encapsulating Security Payload (ESP) for the following IKE exchange and mutual

examination of the secure tunnel establishment.

There are two encapsulation methods used in IPsec, Transport and Tunnel. The Transport

mode will add the AH/ESP payload and use original IP header to encapsulate the data payload

only. It can just apply to local packet, e.g., L2TP over IPsec. The Tunnel mode will not only

add the AH/ESP payload but also use a new IP header (Tunneled IP header) to encapsulate the

whole original IP packet.

Authentication Header (AH) provides data authentication and integrity for IP packets passed

between VPN peers. This is achieved by a keyed one-way hash function to the packet to

create a message digest. This digest will be put in the AH and transmitted along with packets.

On the receiving side, the peer will perform the same one-way hash on the packet and

compare the value with the one in the AH it receives.

Encapsulating Security Payload (ESP) is a security protocol that provides data confidentiality

and protection with optional authentication and replay detection service.

Available settings are explained as follows:

Item Description

IKE Authentication

Method

This usually applies to those are remote dial-in user or node

(LAN-to-LAN) which uses dynamic IP address and

IPsec-related VPN connections such as L2TP over IPsec and

IPsec tunnel.

Certificate for Dial-in –Choose one of the local certificates

Vigor2133 Series User’s Guide

215

from the drop down list.

Pre-Shared Key- Specify a key for IKE authentication.

Confirm Pre-Shared Key- Retype the characters to confirm

the pre-shared key.

Note: Any packets from the remote dial-in user which does

not match the rule defined in VPN and Remote

Access>>Remote Dial-In User will be applied with the

method specified here.

IPsec Security Method Medium - Authentication Header (AH) means data will be

authenticated, but not be encrypted. By default, this option

is active.

High (ESP) - Encapsulating Security Payload (ESP) means

payload (data) will be encrypted and authenticated. You

may select encryption algorithm from Data Encryption

Standard (DES), Triple DES (3DES), and AES.

After finishing all the settings here, please click OK to save the configuration.

I

V

-

1

-

6

I

P

s

e

c

P

e

r

I

d

e

n

t

i

t

y

To use digital certificate for peer authentication in either LAN-to-LAN connection or Remote

User Dial-In connection, here you may edit a table of peer certificate for selection. As shown

below, the router provides 32 entries of digital certificates for peer dial-in users.

Available settings are explained as follows:

Item Description

Set to Factory Default Click it to clear all indexes.

Index Click the number below Index to access into the setting page

of IPsec Peer Identity.

Vigor2133 Series User’s Guide

216

Name Display the profile name of that index.

Click each index to edit one peer digital certificate. There are three security levels of digital

signature authentication: Fill each necessary field to authenticate the remote peer. The

following explanation will guide you to fill all the necessary fields.

Available settings are explained as follows:

Item Description

Profile Name Type the name of the profile. The maximum length of the

name you can set is 32 characters.

Enable this account Check it to enable such account profile.

Accept Any Peer ID Click to accept any peer regardless of its identity.

Accept Subject

Alternative Name

Click to check one specific field of digital signature to accept

the peer with matching value. The field can be IP Address,

Domain, or E-mail. The box under the Type will appear

according to the type you select and ask you to fill in

corresponding setting.

Accept Subject Name Click to check the specific fields of digital signature to

accept the peer with matching value. The field includes

Country (C), State (ST), Location (L), Organization (O),

Organization Unit (OU), Common Name (CN), and Email

(E).

After finishing all the settings here, please click OK to save the configuration.

Vigor2133 Series User’s Guide

21

7

I

V

-

1

-

7

R

e

m

o

t

e

D

i

a

l

-

i

n

U

s

e

r

You can manage remote access by maintaining a table of remote user profile, so that users

can be authenticated to dial-in via VPN connection. You may set parameters including

specified connection peer ID, connection type (VPN connection - including PPTP, IPsec Tunnel,

and L2TP by itself or over IPsec) and corresponding security methods, etc.

The router provides multiple access accounts for dial-in users. Besides, you can extend the

user accounts to the RADIUS server through the built-in RADIUS client function. The following

figure shows the summary table.

Available settings are explained as follows:

Item Description

Set to Factory Default Click to clear all indexes.

Index Click the number below Index to access into the setting page

of Remote Dial-in User.

User Display the username for the specific dial-in user of the

LAN-to-LAN profile. The symbol ??? represents that the

profile is empty.

Active Check the box to activate such profile.

Status Display the access state of the specific dial-in user. The

symbol V and X represent the specific dial-in user to be

active and inactive, respectively.

Vigor2133 Series User’s Guide

218

Click each index to edit one remote user profile. Each Dial-In Type requires you to fill the

different corresponding fields on the right. If the fields gray out, it means you may leave it

untouched. The following explanation will guide you to fill all the necessary fields.

Available settings are explained as follows:

Item Description

User account and

Authentication

Enable this account - Check the box to enable this function.

Idle Timeout- If the dial-in user is idle over the limitation of

the timer, the router will drop this connection. By default,

the Idle Timeout is set to 300 seconds.

Allowed Dial-In Type PPTP - Allow the remote dial-in user to make a PPTP VPN

connection through the Internet. You should set the User

Name and Password of remote dial-in user below.

IPsec Tunnel - Allow the remote dial-in user to make an

IPsec VPN connection through Internet.

L2TP with IPsec Policy - Allow the remote dial-in user to

make a L2TP VPN connection through the Internet. You can

select to use L2TP alone or with IPsec. Select from below:

 None - Do not apply the IPsec policy. Accordingly, the

VPN connection employed the L2TP without IPsec

policy can be viewed as one pure L2TP connection.

 Nice to Have - Apply the IPsec policy first, if it is

applicable during negotiation. Otherwise, the dial-in

VPN connection becomes one pure L2TP connection.

 Must -Specify the IPsec policy to be definitely applied

Vigor2133 Series User’s Guide

21

9

on the L2TP connection.

SSL Tunnel – Allow the remote dial-in user to make an SSL

VPN connection through Internet.

Specify Remote Node -You can specify the IP address of the

remote dial-in user, ISDN number or peer ID (used in IKE

aggressive mode).

Uncheck the checkbox means the connection type you select

above will apply the authentication methods and security

methods in the general settings.

Netbios Naming Packet -

 Pass – Click it to have an inquiry for data transmission

between the hosts located on both sides of VPN Tunnel

while connecting.

 Block – When there is conflict occurred between the

hosts on both sides of VPN Tunnel in connecting, such

function can block data transmission of Netbios Naming

Packet inside the tunnel.

Multicast via VPN - Some programs might send multicast

packets via VPN connection.

 Pass – Click this button to let multicast packets pass

through the router.

 Block – This is default setting. Click this button to let

multicast packets be blocked by the router.

User Name - This field is applicable when you select PPTP or

L2TP with or without IPsec policy above. The length of the

name is limited to 23 characters.

Password - This field is applicable when you select PPTP or

L2TP with or without IPsec policy above. The length of the

password is limited to 19 characters.

Enable Mobile One-Time Passwords (mOTP) - Check this

box to make the authentication with mOTP function.

PIN Code – Type the code for authentication (e.g, 1234).

Secret – Use the 32 digit-secret number generated by mOTP

in the mobile phone (e.g., e759bb6f0e94c7ab4fe6).

Subnet Chose one of the subnet selections for such VPN profile.

Assign Static IP Address – Please type a static IP address for

the subnet you specified.

IKE Authentication

Method

This group of fields is applicable for IPsec Tunnels and L2TP

with IPsec Policy when you specify the IP address of the

remote node. The only exception is Digital Signature (X.509)

can be set when you select IPsec tunnel either with or

without specifying the IP address of the remote node.

Pre-Shared Key - Check the box of Pre-Shared Key to invoke

this function and type in the required characters (1-63) as

the pre-shared key.

Digital Signature (X.509) – Check the box of Digital Signature

to invoke this function and Select one predefined Profiles set

in the VPN and Remote Access >>IPsec Peer Identity.

IPsec Security Method This group of fields is a must for IPsec Tunnels and L2TP with

IPsec Policy when you specify the remote node. Check the

Medium, DES, 3DES or AES box as the security method.

Medium-Authentication Header (AH) means data will be

authenticated, but not be encrypted. By default, this option

is invoked. You can uncheck it to disable it.

Vigor2133 Series User’s Guide

220

High-Encapsulating Security Payload (ESP) means payload

(data) will be encrypted and authenticated. You may select

encryption algorithm from Data Encryption Standard (DES),

Triple DES (3DES), and AES.

Local ID (Optional)- Specify a local ID to be used for Dial-in

setting in the LAN-to-LAN Profile setup. This item is optional

and can be used only in IKE aggressive mode.

After finishing all the settings here, please click OK to save the configuration.

I

V

-

1

-

8

L

A

N

t

o

L

A

N

Here you can manage LAN-to-LAN connections by maintaining a table of connection profiles.

You may set parameters including specified connection direction (dial-in or dial-out),

connection peer ID, connection type (VPN connection - including PPTP, IPsec Tunnel, and

L2TP by itself or over IPsec) and corresponding security methods, etc.

Available settings are explained as follows:

Item Description

Set to Factory Default Click to clear all indexes.

Name Indicate the name of the LAN-to-LAN profile. The symbol ???

represents that the profile is empty.

Active V – means the profile has been enabled.

X – means the profile has not been enabled.

Status Online – means such LAN to LAN profile is in use.

Offline – means such LAN to LAN profile isn’t in use even if

the profile has been enabled.

To edit each profile:

Vigor2133 Series User’s Guide

221

1. Click each index to edit each profile and you will get the following page. Each

LAN-to-LAN profile includes 4 subgroups. If the fields gray out, it means you may leave it

untouched. The following explanations will guide you to fill all the necessary fields.

Available settings are explained as follows:

Item Description

Common Settings Profile Name – Specify a name for the profile of the

LAN-to-LAN connection.

Enable this profile - Check here to activate this profile.

Netbios Naming Packet

 Pass – click it to have an inquiry for data transmission

between the hosts located on both sides of VPN Tunnel

while connecting.

 Block – When there is conflict occurred between the

hosts on both sides of VPN Tunnel in connecting, such

function can block data transmission of Netbios Naming

Packet inside the tunnel.

Multicast via VPN - Some programs might send multicast

packets via VPN connection.

 Pass – Click this button to let multicast packets pass

through the router.

 Block – This is default setting. Click this button to let

multicast packets be blocked by the router.

Vigor2133 Series User’s Guide

222

Call Direction - Specify the allowed call direction of this

LAN-to-LAN profile.

 Both:-initiator/responder

 Dial-Out- initiator only

 Dial-In- responder only.

Always On-Check to enable router always keep VPN

connection.

Idle Timeout: The default value is 300 seconds. If the

connection has been idled over the value, the router will

drop the connection.

Enable PING to keep IPsec tunnel alive - This function is to

help the router to determine the status of IPsec VPN

connection, especially useful in the case of abnormal VPN

IPsec tunnel disruption. For details, please refer to the note

below. Check to enable the transmission of PING packets to a

specified IP address.

This function is used to handle abnormal IPsec VPN

connection disruption. It will help to provide the state of a

VPN connection for router’s judgment of redial. Normally, if

any one of VPN peers wants to disconnect the connection, it

should follow a serial of packet exchange procedure to

inform each other. However, if the remote peer disconnects

without notice, Vigor router will by no where to know this

situation. To resolve this dilemma, by continuously sending

PING packets to the remote host, the Vigor router can know

the true existence of this VPN connection and react

accordingly. This is independent of DPD (dead peer

detection).

PING to the IP - Enter the IP address of the remote host that

located at the other-end of the VPN tunnel.

Dial-Out Settings Type of Server I am calling - PPTP - Build a PPTP VPN

connection to the server through the Internet. You should set

the identity like User Name and Password below for the

authentication of remote server.

IPsec Tunnel - Build an IPsec VPN connection to the server

through Internet.

L2TP with IPsec Policy - Build a L2TP VPN connection

through the Internet. You can select to use L2TP alone or

with IPsec. Select from below:

 None: Do not apply the IPsec policy. Accordingly, the

VPN connection employed the L2TP without IPsec

policy can be viewed as one pure L2TP connection.

 Nice to Have: Apply the IPsec policy first, if it is

applicable during negotiation. Otherwise, the dial-out

VPN connection becomes one pure L2TP connection.

 Must: Specify the IPsec policy to be definitely applied

on the L2TP connection.

SSL Tunnel - Build an SSL VPN connection to the server

through Internet.

User Name - This field is applicable when you select, PPTP or

L2TP with or without IPsec policy above. The length of the

name is limited to 49 characters.

Password - This field is applicable when you select PPTP or

L2TP with or without IPsec policy above. The length of the

password is limited to 15 characters.

PPP Authentication - This field is applicable when you

Vigor2133 Series User’s Guide

223

select, PPTP or L2TP with or without IPSec policy above.

PAP/CHAP/MS-CHAP/MS-CHAPv2 is the most common

selection due to compatibility.

VJ compression - This field is applicable when you select

PPTP or L2TP with or without IPsec policy above. VJ

Compression is used for TCP/IP protocol header compression.

Normally set to On to improve bandwidth utilization.

IKE Authentication Method - This group of fields is

applicable for IPsec Tunnels and L2TP with IPsec Policy.

 Pre-Shared Key - Input 1-63 characters as pre-shared

key.

 Digital Signature (X.509) - Select one predefined

Profiles set in the VPN and Remote Access >>IPsec

Peer Identity.

Peer ID - Select one of the predefined Profiles set in

VPN and Remote Access >>IPsec Peer Identity.

Local ID – Specify a local ID (Alternative Subject Name

First or Subject Name First) to be used for Dial-in

setting in the LAN-to-LAN Profile setup. This item is

optional and can be used only in IKE aggressive mode.

 Local Certificate – Select one of the profiles set in

Certificate Management>>Local Certificate.

IPsec Security Method - This group of fields is a must for

IPsec Tunnels and L2TP with IPsec Policy.

 Medium AH (Authentication Header) means data will

be authenticated, but not be encrypted. By default,

this option is active.

 High (ESP-Encapsulating Security Payload)- means

payload (data) will be encrypted and authenticated.

Select from below:

 DES without Authentication -Use DES encryption

algorithm and not apply any authentication

scheme.

 DES with Authentication-Use DES encryption

algorithm and apply MD5 or SHA-1 authentication

algorithm.

 3DES without Authentication-Use triple DES

encryption algorithm and not apply any

authentication scheme.

 3DES with Authentication-Use triple DES

encryption algorithm and apply MD5 or SHA-1

authentication algorithm.

 AES without Authentication-Use AES encryption

algorithm and not apply any authentication

scheme.

 AES with Authentication-Use AES encryption

algorithm and apply MD5 or SHA-1 authentication

algor

i

thm.

Advanced - Specify mode, proposal and key life of each IKE

phase, Gateway, etc.

The window of advance setup is shown as below:

Vigor2133 Series User’s Guide

224

IKE phase 1 mode -Select from Main mode and Aggressive

mode. The ultimate outcome is to exchange security

proposals to create a protected secure channel. Main mode

is more secure than Aggressive mode since more exchanges

are done in a secure channel to set up the IPsec session.

However, the Aggressive mode is faster. The default value in

Vigor router is Main mode.

 IKE phase 1 proposal-To propose the local available

authentication schemes and encryption algorithms to

the VPN peers, and get its feedback to find a match.

Two combinations are available for Aggressive mode

and nine for Main mode. We suggest you select the

combination that covers the most schemes.

 IKE phase 2 proposal-To propose the local available

algorithms to the VPN peers, and get its feedback to

find a match. Three combinations are available for both

modes. We suggest you select the combination that

covers the most algorithms.

 IKE phase 1 key lifetime-For security reason, the

lifetime of key should be defined. The default value is

28800 seconds. You may specify a value in between 900

and 86400 seconds.

 IKE phase 2 key lifetime-For security reason, the

lifetime of key should be defined. The default value is

3600 seconds. You may specify a value in between 600

and 86400 seconds.

 Perfect Forward Secret (PFS)-The IKE Phase 1 key will

be reused to avoid the computation complexity in

phase 2. The default value is inactive this function.

Local ID-In Aggressive mode, Local ID is on behalf of

the IP address while identity authenticating with

remote VPN server. The length of the ID is limited to 47

characters.

Index(1-15) - Set the wireless LAN to work at certain time

interval only. You may choose up to 4 schedules out of the 15

schedules pre-defined in Applications >> Schedule setup.

The default setting of this field is blank and the function will

always work.

Vigor2133 Series User’s Guide

225

Available settings are explained as follows:

Item Description

Dial-In Settings Allowed Dial-In Type - Determine the dial-in connection

with different types.

 PPTP - Allow the remote dial-in user to make a PPTP

VPN connection through the Internet. You should set

the User Name and Password of remote dial-in user

below.

 IPsec Tunnel- Allow the remote dial-in user to trigger

an IPsec VPN connection through Internet.

 L2TP with IPsec Policy - Allow the remote dial-in user

to make a L2TP VPN connection through the Internet.

You can select to use L2TP alone or with IPsec. Select

from below:

 None - Do not apply the IPsec policy. Accordingly,

the VPN connection employed the L2TP without

IPsec policy can be viewed as one pure L2TP

connection.

 Nice to Have - Apply the IPsec policy first, if it is

applicable during negotiation. Otherwise, the

dial-in VPN connection becomes one pure L2TP

connection.

 Must - Specify the IPsec policy to be definitely

applied on the L2TP connection.

 SSL Tunnel- Allow the remote dial-in user to trigger an

SSL VPN connection through Internet.

Specify Remote VPN Gateway - You can specify the IP

address of the remote dial-in user or peer ID (should be the

Vigor2133 Series User’s Guide

226

same with the ID setting in dial-in type) by checking the box.

Also, you should further specify the corresponding security

methods on the right side.

If you uncheck the checkbox, the connection type you select

above will apply the authentication methods and security

methods in the general settings.

Username - This field is applicable when you select PPTP or

L2TP with or without IPsec policy above. The length of the

name is limited to 11 characters.

Password - This field is applicable when you select PPTP or

L2TP with or without IPsec policy above. The length of the

password is limited to 11 characters.

VJ Compression - VJ Compression is used for TCP/IP

protocol header compression. This field is applicable when

you select PPTP or L2TP with or without IPsec policy above.

IKE Authentication Method - This group of fields is

applicable for IPsec Tunnels and L2TP with IPsec Policy when

you specify the IP address of the remote node. The only

exception is Digital Signature (X.509) can be set when you

select IPsec tunnel either with or without specify the IP

address of the remote node.

 Pre-Shared Key - Check the box of Pre-Shared Key to

invoke this function and type in the required characters

(1-63) as the pre-shared key.

 Digital Signature (X.509) –Check the box of Digital

Signature to invoke this function and select one

predefined Profiles set in the VPN and Remote Access

>>IPsec Peer Identity.

 Local ID – Specify which one will be inspected

first.

 Alternative Subject Name First – The alternative

subject name (configured in Certificate

Management>>Local Certificate) will be

inspected first.

 Subject Name First – The subject name

(configured in Certificate Management>>Local

Certificate) will be inspected first.

IPsec Security Method - This group of fields is a must for

IPsec Tunnels and L2TP with IPsec Policy when you specify

the remote node.

 Medium- Authentication Header (AH) means data will

be authenticated, but not be encrypted. By default,

this option is active.

 High- Encapsulating Security Payload (ESP) means

payload (data) will be encrypted and authenticated.

You may select encryption algorithm from Data

Encryption Standard (DES), Triple DES (3DES), and AES.

TCP/IP Network

Settings

My WAN IP –This field is only applicable when you select

PPTP or L2TP with or without IPsec policy above. The default

value is 0.0.0.0, which means the Vigor router will get a PPP

IP address from the remote router during the IPCP

negotiation phase. If the PPP IP address is fixed by remote

side, specify the fixed IP address here. Do not change the

default value if you do not select PPTP or L2TP.

Remote Gateway IP - This field is only applicable when you

select PPTP or L2TP with or without IPsec policy above. The

Vigor2133 Series User’s Guide

22

7

default value is 0.0.0.0, which means the Vigor router will

get a remote Gateway PPP IP address from the remote router

during the IPCP negotiation phase. If the PPP IP address is

fixed by remote side, specify the fixed IP address here. Do

not change the default value if you do not select PPTP or

L2TP.

Remote Network IP/ Remote Network Mask - Add a static

route to direct all traffic destined to this Remote Network IP

Address/Remote Network Mask through the VPN connection.

For IPsec, this is the destination clients IDs of phase 2 quick

mode.

Local Network IP / Local Network Mask - Display the local

network IP and mask for TCP / IP configuration. You can

modify the settings if required.

More - Add a static route to direct all traffic destined to

more Remote Network IP Addresses/ Remote Network Masks

through the VPN connection. This is usually used when you

find there are several subnets behind the remote VPN router.

RIP Direction - The option specifies the direction of RIP

(Routing Information Protocol) packets. You can

enable/disable one of direction here. Herein, we provide

four options: TX/RX Both, TX Only, RX Only, and Disable.

From first subnet to remote network, you have to do - If

the remote network only allows you to dial in with single IP,

please choose NAT, otherwise choose Route.

Change default route to this VPN tunnel - Check this box to

change the default route with this VPN tunnel.

IPSec VPN with the

Same subnet

For both ends (e.g., different sections in a company) are

within the same subnet, there is a function which allows you

to build Virtual IP mapping between two ends. Thus, when

VPN connection established, the router will change the IP

address according to the settings configured here and block

sessions which are not coming from the IP address defined in

the Virtual IP Mapping list.

After checking the box of IPSec VPN with the Same subnet,

the options under TCP/IP Network Settings will be changed

as shown below:

Vigor2133 Series User’s Guide

228

Remote Network IP/ Remote Network Mask - Add a static

route to direct all traffic destined to this Remote Network IP

Address/Remote Network Mask through the VPN connection.

For IPSec, this is the destination clients IDs of phase 2 quick

mode.

Translated Local Network – This function is enabled in

default. Use the drop down list to specify a LAN port as the

transferred direction. Then specify an IP address. Click

Advanced to configure detailed settings if required.

Advanced – Add a static route to direct all traffic destined to

more Remote Network IP Addresses/ Remote Network Mask

through the VPN connection. This is usually used when you

find there are several subnets behind the remote VPN router.

Translated Type – There are two types for you to choose.

 Whole Subnet

 Specific IP Address

Virtual IP Mapping – A pop up dialog will appear for you to

specify the local IP address and the mapping virtual IP

address.

Vigor2133 Series User’s Guide

22

9

2. After finishing all the settings here, please click OK to save the configuration.

Vigor2133 Series User’s Guide

230

I

V

-

1

-

9

C

o

n

e

c

t

i

o

n

M

a

n

a

g

e

m

e

n

t

You can find the summary table of all VPN connections. You may disconnect any VPN

connection by clicking Drop button. You may also aggressively Dial-out by using Dial-out Tool

and clicking Dial button.

Available settings are explained as follows:

Item Description

Dial-out Tool General Mode - This filed displays the profile configured in

LAN-to-LAN (with Index number and VPN Server IP address).

The VPN connection built by General Mode does not support

VPN backup function.

Dial - Click this button to execute dial out function.

Vigor2133 Series User’s Guide

231

A

p

l

i

c

a

t

i

o

n

N

o

t

e

s

A

-

1

H

o

w

t

o

B

u

i

l

d

a

L

A

N

-

t

o

-

L

A

N

V

P

N

B

e

t

w

e

n

R

e

m

o

t

e

O

f

i

c

e

a

n

d

H

e

a

d

q

u

a

r

t

e

r

v

i

a

I

P

s

e

c

T

u

n

e

l

(

M

a

i

n

M

o

d

e

)

C

o

n

f

i

g

u

r

a

t

i

o

n

o

n

V

i

g

o

r

R

o

u

t

e

r

f

o

r

H

e

a

d

O

f

i

c

e

1. Log into the web user interface of Vigor router.

2. Open VPN and Remote Access>>LAN to LAN to create a LAN-to-LAN profile. The

following settings are for a permanent VPN connection.

3. Click any index number to open the configuration page. Type a name which is easy for

identification for such profile (in this case, type VPN Server), and check the box of

Enable This Profile. For Vigor router will be set as a server, the call direction shall be

set as Dial-in and set 0 as Idle Timeout.

Vigor2133 Series User’s Guide

232

4. Now navigate to the next section, Dial-In Settings to check PPTP, IPsec Tunnel and L2TP

boxes. Check the box of Specify Remote… and type the Peer VPN Server IP (e.g.,

218.242.130.19 in this case). Press the IKE Pre-Shared Key button to set the PSK; and

select Medium (AH) or High (ESP) as the security method.

5. Continue to navigate to the TCP/IP Network Settings for setting the LAN IP for remote

side.

Vigor2133 Series User’s Guide

233

6. Click OK to save the settings.

7. Open VPN and Remote Access>>Connection Management to check the dial-in

connection status (from branch office).

C

o

n

f

i

g

u

r

a

t

i

o

n

o

n

V

i

g

o

r

R

o

u

t

e

r

f

o

r

B

r

a

n

c

h

O

f

i

c

e

1. Log into the web user interface of Vigor router.

2. Open VPN and Remote Access>>LAN to LAN to create a LAN-to-LAN profile. The

following settings are for a permanent VPN connection.

3. Click any index number to open the configuration page. Type a name which is easy for

identification for such profile (in this case, type VPN Client), and check the box of

Enable This Profile. For such Vigor router will be set as a client, the call direction shall

be set as Dial-out. Check the box of Always on for a permanent VPN connection.

Vigor2133 Series User’s Guide

234

4. Now navigate to the next section, Dial-Out Settings to select the IPsec Tunnel service

and type the remote server IP/host name (e.g., 218.242.133.91, in this case). Press the

IKE Pre-Shared Key button to set the PSK; and select Medium (AH) or High (ESP) as the

security method.

5. Continue to navigate to the TCP/IP Network Settings for setting the LAN IP for the

remote side.

6. Click OK to save the settings.

Vigor2133 Series User’s Guide

235

7. Open VPN and Remote Access>>Connection Management to check the dial-in

connection status (from head office).

Vigor2133 Series User’s Guide

236

I

V

-

2

S

L

V

P

N

An SSL VPN (Secure Sockets Layer virtual private network) is a form of VPN that can be used

with a standard Web browser.

There are two benefits that SSL VPN provides:

 It is not necessary for users to preinstall VPN client software for executing SSL VPN

connection.

 There are less restrictions for the data encrypted through SSL VPN in comparing with

traditional VPN.

Vigor2133 Series User’s Guide

23

7

W

e

b

U

s

e

r

I

n

t

e

r

f

a

c

e

I

V

-

2

-

1

G

e

n

e

r

a

l

S

e

t

u

p

This page determines the general configuration for SSL VPN Server and SSL Tunnel.

Available settings are explained as follows:

Item Description

Bind to WAN Choose and check WAN interface(s) for SSL VPN tunnel

establishment.

Port Such port is set for SSL VPN server. It will not affect the HTTPS

Port configuration set in System Maintenance>>Management.

In general, the default setting is 443.

Server Certificate When the client does not set any certificate, default

certificate will be used for HTTPS and SSL VPN server. Choose

any one of the user-defined certificates from the drop down

list if users set several certificates previously. Otherwise,

choose Self-signed to use the router’s built-in default

certificate. The default certificate can be used in SSL VPN

server and HTTPS Web Proxy.

After finishing all the settings here, please click OK to save the configuration.

Vigor2133 Series User’s Guide

238

I

V

-

2

-

2

U

s

e

r

A

c

o

u

n

t

With SSL VPN, Vigor2133 series let teleworkers have convenient and simple remote access to

central site VPN. The teleworkers do not need to install any VPN software manually. From

regular web browser, you can establish VPN connection back to your main office even in a

guest network or web cafe. The SSL technology is the same as the encryption that you use for

secure web sites such as your online bank. The SSL VPN can be operated in either full tunnel

mode or proxy mode. Now, Vigor2133 series allows up to 16 simultaneous incoming users.

For SSL VPN, identity authentication and power management are implemented through

deploying user accounts. Therefore, the user account for SSL VPN must be set together with

remote dial-in user web page. Such menu item will guide to access into VPN and Remote

Access>>Remote Dial-in user.

Vigor2133 Series User’s Guide

23

9

Click each index to edit one remote user profile.

Available settings are explained as follows:

Item Description

User account and

Authentication

Enable this account - Check the box to enable this function.

Idle Timeout- If the dial-in user is idle over the limitation of

the timer, the router will drop this connection. By default, the

Idle Timeout is set to 300 seconds.

User Name - This field is applicable when you select PPTP or

L2TP with or without IPsec policy above. The length of the

name/password is limited to 23 characters.

Password - This field is applicable when you select PPTP or

L2TP with or without IPsec policy above. The length of the

name/password is limited to 19 characters.

Enable Mobile One-Time Passwords (mOTP) - Check this box

to make the authentication with mOTP function.

PIN Code – Type the code for authentication (e.g, 1234).

Secret – Use the 32 digit-secret number generated by mOTP in

the mobile phone (e.g., e759bb6f0e94c7ab4fe6).

Allowed Dial-In Type PPTP - Allow the remote dial-in user to make a PPTP VPN

connection through the Internet. You should set the User

Name and Password of remote dial-in user below.

IPSec Tunnel - Allow the remote dial-in user to make an IPSec

VPN connection through Internet.

L2TP with IPSec Policy - Allow the remote dial-in user to

make a L2TP VPN connection through the Internet. You can

select to use L2TP alone or with IPSec. Select from below:

Vigor2133 Series User’s Guide

240

Item Description

 None - Do not apply the IPSec policy. Accordingly, the

VPN connection employed the L2TP without IPSec policy

can be viewed as one pure L2TP connection.

 Nice to Have - Apply the IPSec policy first, if it is

applicable during negotiation. Otherwise, the dial-in VPN

connection becomes one pure L2TP connection.

 Must -Specify the IPSec policy to be definitely applied on

the L2TP connection.

SSL Tunnel - It allows the remote dial-in user to make an SSL

VPN Tunnel connection through Internet, suitable for the

application through network accessing (e.g., PPTP / L2TP /

IPSec).

If you check this box, the function of SSL Tunnel for this

account will be activated immediately.

Specify Remote Node - Check the checkbox to specify the IP

address of the remote dial-in user, ISDN number or peer ID

(used in IKE aggressive mode). If you uncheck the checkbox,

the connection type you select above will apply the

authentication methods and security methods in the general

settings.

Netbios Naming Packet

 Pass – Click it to have an inquiry for data transmission

between the hosts located on both sides of VPN Tunnel

while connecting.

 Block – When there is conflict occurred between the

hosts on both sides of VPN Tunnel in connecting, such

function can block data transmission of Netbios Naming

Packet inside the tunnel.

Multicast via VPN - Some programs might send multicast

packets via VPN connection.

 Pass – Click this button to let multicast packets pass

through the router.

 Block – This is default setting. Click this button to let

multicast packets be blocked by the router.

Subnet Chose one of the subnet selections for such VPN profile.

Assign Static IP Address – Please type a static IP address for

the subnet you specified.

IKE Authentication

Method

This group of fields is applicable for IPSec Tunnels and L2TP

with IPSec Policy when you specify the IP address of the

remote node. The only exception is Digital Signature (X.509)

can be set when you select IPSec tunnel either with or without

specify the IP address of the remote node.

Pre-Shared Key - Check the box of Pre-Shared Key to invoke

this function and type in the required characters (1-63) as the

pre-shared key.

Digital Signature (X.509) – Check the box of Digital Signature

to invoke this function and Select one predefined Profiles set

in the VPN and Remote Access >>IPSec Peer Identity.

IPSec Security Method This group of fields is a must for IPSec Tunnels and L2TP with

IPSec Policy when you specify the remote node. Check the

Medium, DES, 3DES or AES box as the security method.

Medium-Authentication Header (AH) means data will be

authenticated, but not be encrypted. By default, this option is

Vigor2133 Series User’s Guide

241

Item Description

invoked. You can uncheck it to disable it.

High-Encapsulating Security Payload (ESP) means payload

(data) will be encrypted and authenticated. You may select

encryption algorithm from Data Encryption Standard (DES),

Triple DES (3DES), and AES.

Local ID - Specify a local ID to be used for Dial-in setting in the

LAN-to-LAN Profile setup. This item is optional and can be

used only in IKE aggressive mode.

After finishing all the settings here, please click OK to save the configuration.

Vigor2133 Series User’s Guide

242

I

V

-

2

-

3

O

n

l

i

n

e

U

s

e

r

S

t

a

t

u

s

If you have finished the configuration of SSL Web Proxy (server), users can find out

corresponding settings when they access into DrayTek SSL VPN portal interface.

Next, users can open SSL VPN>> Online Status to view logging status of SSL VPN.

Available settings are explained as follows:

Item Description

Active User Display current user who visits SSL VPN server.

Host IP Display the IP address for the host.

Time out Display the time remaining for logging out.

Action You can click Drop to drop certain login user from the router's

SSL Portal UI.

Vigor2133 Series User’s Guide

243

I

V

-

3

C

e

r

t

i

f

i

c

a

t

e

M

a

n

a

g

e

m

e

n

t

A digital certificate works as an electronic ID, which is issued by a certification authority (CA).

It contains information such as your name, a serial number, expiration dates etc., and the

digital signature of the certificate-issuing authority so that a recipient can verify that the

certificate is real. Here Vigor router support digital certificates conforming to standard

X.509.

Any entity wants to utilize digital certificates should first request a certificate issued by a CA

server. It should also retrieve certificates of other trusted CA servers so it can authenticate

the peer with certificates issued by those trusted CA servers.

Here you can manage generate and manage the local digital certificates, and set trusted CA

certificates. Remember to adjust the time of Vigor router before using the certificate so that

you can get the correct valid period of certificate.

Below shows the menu items for Certificate Management.

Vigor2133 Series User’s Guide

244

W

e

b

U

s

e

r

I

n

t

e

r

f

a

c

e

I

V

-

3

-

1

L

o

c

a

l

C

e

r

t

i

f

i

c

a

t

e

Available settings are explained as follows:

Item Description

Generate Click this button to open Generate Certificate Request

window.

Type in all the information that the window requests. Then

click Generate again.

Import Click this button to import a saved file as the certification

information.

Refresh Click this button to refresh the information listed below.

View Click this button to view the detailed settings for certificate

request.

Delete Click this button to delete selected name with certification

information.

G

E

N

E

R

A

T

E

Click this button to open Generate Certificate Signing Request window. Type in all the

information that the window request such as certifcate name (used for identifying different

certificate), subject alternative name type and relational settings for subject name. Then

click GENERATE again.

Vigor2133 Series User’s Guide

245

Info

Please be noted that “Common Name” must be configured with router’s

WAN IP or domain name.

After clicking GENERATE, the generated information will be displayed on the window below:

I

M

P

O

R

T

Vigor router allows you to generate a certificate request and submit it the CA server, then

import it as “Local Certificate”. If you have already gotten a certificate from a third party,

you may import it directly. The supported types are PKCS12 Certificate and Certificate with a

private key.

Click this button to import a saved file as the certification information. There are three types

of local certificate supported by Vigor router.

Vigor2133 Series User’s Guide

246

Available settings are explained as follows:

Item Description

Upload Local Certificate It allows users to import the certificate which is generated by

Vigor router and signed by CA server.

If you have done well in certificate generation, the Status of

the certificate will be shown as “OK”.

Upload PKCS12

Certificate

It allows users to import the certificate whose extensions are

usually .pfx or .p12. And these certificates usually

need passwords.

Note that PKCS12 is a standard for storing private keys and

certificates securely. It is used in (among other things)

Netscape and Microsoft Internet Explorer with their import

and export options.

Upload Certificate and

Private Key

It is useful when users have separated certificates and private

keys. And the password is needed if the private key is

encrypted.

Vigor2133 Series User’s Guide

24

7

R

E

F

R

E

S

H

Click this button to refresh the information listed below.

V

i

e

w

Click this button to view the detailed settings for certificate request.

Info

You have to copy the certificate request information from above window.

Next, access your CA server and enter the page of certificate request, copy

the information into it and submit a request. A new certificate will be

issued to you by the CA server. You can save it.

D

e

l

e

t

e

Click this button to remove the selected certificate.

Vigor2133 Series User’s Guide

248

I

V

-

3

-

2

T

r

u

s

t

e

d

C

A

C

e

r

t

i

f

i

c

a

t

e

Trusted CA certificate lists three sets of trusted CA certificate. In addition, you can build a

RootCA certificate if required.

When the local client and remote client are required to make certificate authentication (e.g.,

IPsec X.509) for data passing through SSL tunnel and avoiding the attack of MITM, a trusted

root certificate authority (Root CA) will be used to authenticate the digital certificates

offered by both ends.

However, the procedure of applying digital certificate from a trusted root certificate

authority is complicated and time-consuming. Therefore, Vigor router offers a mechanism

which allows you to generate root CA to save time and provide convenience for general user.

Later, such root CA generated by DrayTek server can perform the issuing of local certificate.

Info

Root CA can be deleted but not edited. If you want to modify the settings

for a Root CA, please delete the one and create another one by clicking

Create Root CA.

C

r

e

a

t

i

n

g

a

R

o

t

C

A

Click Create to open the following page. Type in all the information that the window request

such as certifcate name (used for identifying different certificate), subject alternative name

type and relational settings for subject name. Then click Generate again.

Vigor2133 Series User’s Guide

24

9

I

m

p

o

r

t

i

n

g

a

T

r

u

s

t

e

d

C

A

To import a pre-saved trusted CA certificate, please click IMPORT to open the following

window. Use Browse… to find out the saved text file. Then click Import. The one you

imported will be listed on the Trusted CA Certificate window.

For viewing each trusted CA certificate, click View to open the certificate detail information

window. If you want to delete a CA certificate, choose the one and click Delete to remove all

the certificate information.

Vigor2133 Series User’s Guide

250

I

V

-

3

-

3

C

e

r

t

i

f

i

c

a

t

e

B

a

c

k

u

p

Local certificate and Trusted CA certificate for this router can be saved within one file.

Please click Backup on the following screen to save them. If you want to set encryption

password for these certificates, please type characters in both fields of Encrypt password

and Confirm password.

Also, you can use Restore to retrieve these two settings to the router whenever you want.

.

Vigor2133 Series User’s Guide

251

P

a

r

t

V

S

e

c

u

r

i

t

y

While the broadband users demand more bandwidth

for multimedia, interactive applications, or distance

learning, security has been always the most

concerned. The firewall of the Vigor router helps to

protect your local network against attack from

unauthorized outsiders. It also restricts users in the

local network from accessing the Internet.

CSM is an abbreviation of Central Security Management

which is used to control IM/P2P usage, filter the web

content and URL content to reach a goal of security

management.

Vigor2133 Series User’s Guide

252

V

-

1

F

i

r

e

w

a

l

While the broadband users demand more bandwidth for multimedia, interactive applications,

or distance learning, security has been always the most concerned. The firewall of the Vigor

router helps to protect your local network against attack from unauthorized outsiders. It also

restricts users in the local network from accessing the Internet. Furthermore, it can filter out

specific packets that trigger the router to build an unwanted outgoing connection.

F

i

r

e

w

a

l

F

a

c

i

l

i

t

i

e

s

The users on the LAN are provided with secured protection by the following firewall facilities:

 User-configurable IP filter (Call Filter/ Data Filter).

 Stateful Packet Inspection (SPI): tracks packets and denies unsolicited incoming data

 Selectable Denial of Service (DoS) /Distributed DoS (DDoS) attacks protection

I

P

F

i

l

t

e

r

s

Depending on whether there is an existing Internet connection, or in other words “the WAN

link status is up or down”, the IP filter architecture categorizes traffic into two: Call Filter

and Data Filter.

 Call Filter - When there is no existing Internet connection, Call Filter is applied to all

traffic, all of which should be outgoing. It will check packets according to the filter rules.

If legal, the packet will pass. Then the router shall “initiate a call” to build the Internet

connection and send the packet to Internet.

 Data Filter - When there is an existing Internet connection, Data Filter is applied to

incoming and outgoing traffic. It will check packets according to the filter rules. If legal,

the packet will pass the router.

The following illustrations are flow charts explaining how router will treat incoming traffic

and outgoing traffic respectively.

Vigor2133 Series User’s Guide

253

S

t

a

t

e

f

u

l

P

a

c

k

e

t

I

n

s

p

e

c

t

i

o

n

(

S

P

I

)

Stateful inspection is a firewall architecture that works at the network layer. Unlike legacy

static packet filtering, which examines a packet based on the information in its header,

stateful inspection builds up a state machine to track each connection traversing all

interfaces of the firewall and makes sure they are valid. The stateful firewall of Vigor router

not only examines the header information also monitors the state of the connection.

D

e

n

i

a

l

o

f

S

e

r

v

i

c

e

(

D

o

S

)

D

e

f

e

n

s

e

The DoS Defense functionality helps you to detect and mitigate the DoS attack. The attacks

are usually categorized into two types, the flooding-type attacks and the vulnerability attacks.

The flooding-type attacks will attempt to exhaust all your system's resource while the

vulnerability attacks will try to paralyze the system by offending the vulnerabilities of the

protocol or operation system.

The DoS Defense function enables the Vigor router to inspect every incoming packet based on

the attack signature database. Any malicious packet that might duplicate itself to paralyze

the host in the secure LAN will be strictly blocked and a Syslog message will be sent as warning,

if you set up Syslog server.

Also the Vigor router monitors the traffic. Any abnormal traffic flow violating the pre-defined

parameter, such as the number of thresholds, is identified as an attack and the Vigor router

will activate its defense mechanism to mitigate in a real-time manner.

The below shows the attack types that DoS/DDoS defense function can detect:

1. SYN flood attack

2. UDP flood attack

3. ICMP flood attack

4. Port Scan attack

5. IP options

6. Land attack

7. Smurf attack

8. Trace route

9. SYN fragment

10. Fraggle attack

11. TCP flag scan

12. Tear drop attack

13. Ping of Death attack

14. ICMP fragment

15. Unassigned Numbers

Vigor2133 Series User’s Guide

254

W

e

b

U

s

e

r

I

n

t

e

r

f

a

c

e

Below shows the menu items for Firewall.

V

-

1

-

1

G

e

n

e

r

a

l

S

e

t

u

p

General Setup allows you to adjust settings of IP Filter and common options. Here you can

enable or disable the Call Filter or Data Filter. Under some circumstance, your filter set can

be linked to work in a serial manner. So here you assign the Start Filter Set only. Also you can

configure the Log Flag settings, Apply IP filter to VPN incoming packets, and Accept

incoming fragmented UDP packets.

Click Firewall and click General Setup to open the general setup page.

G

e

n

e

r

a

l

S

e

t

u

p

P

a

g

e

Such page allows you to enable / disable Call Filter and Data Filter, determine general rule

for filtering the incoming and outgoing data.

Available settings are explained as follows:

Item Description

Call Filter Check Enable to activate the Call Filter function. Assign a

start filter set for the Call Filter.

Vigor2133 Series User’s Guide

255

Data Filter Check Enable to activate the Data Filter function. Assign a

start filter set for the Data Filter.

Always pass inbound

fragmented large

packets…

Some on-line games (for example: Half Life) will use lots of

fragmented UDP packets to transfer game data. Instinctively

as a secure firewall, Vigor router will reject these

fragmented packets to prevent attack unless you enable

“Always pass inbound fragmented large packets…”. By

checking this box, you can play these kinds of on-line games.

If security concern is in higher priority, you cannot enable

“Always pass inbound fragmented large packets…”.

Enable Strict Security

Firewall

For the sake of security, the router will execute strict

security checking for data transmission.

Such feature is enabled in default. All the packets, while

transmitting through Vigor router, will be filtered by

firewall. If the firewall system (e.g., content filter server)

does not make any response (pass or block) for these

packets, then the router’s firewall will block the packets

directly.

Block routing connections

initiated from WAN

Usually, IPv6 network sessions/traffic from WAN to LAN will

be accepted by IPv6 firewall in default.

IPv6 - To prevent remote client accessing into the PCs on

LAN, check the box to make the packets (routed from WAN to

LAN) via IPv6 being blocked by such router. It is effective

only for the packets routed but not for packets translated by

NAT.

IPv4 - To prevent remote client accessing into the PCs on

LAN, check the box to make the incoming packets via IPv4

being blocked by such router. It is effective only for the

packets routed but not for packets translated by NAT.

Backup Firewall Click Backup to save the firewall configuration.

Restore Firewall Click Select to choose a firewall configuration file. Then

click Restore to apply the file.

Vigor2133 Series User’s Guide

256

D

e

f

a

u

l

t

R

u

l

e

P

a

g

e

Such page allows you to choose filtering profiles including QoS, Load-Balance policy, WCF,

APP Enforcement, URL Content Filter, for data transmission via Vigor router.

Available settings are explained as follows:

Item Description

Filter Select Pass or Block for the packets that do not match with

the filter rules.

Sessions Control The number typed here is the total sessions of the packets

that do not match the filter rule configured in this page. The

default setting is 60000.

Quality of Service Choose one of the QoS rules to be applied as firewall rule.

For detailed information of setting QoS, please refer to the

related section later.

Vigor2133 Series User’s Guide

25

7

APP Enforcement Select an APP Enforcement profile for global IM/P2P

application blocking. If there is no profile for you to select,

please choose [Create New] from the drop down list in this

page to create a new profile. All the hosts in LAN must follow

the standard configured in the APP Enforcement profile

selected here. For detailed information, refer to the section

of APP Enforcement profile setup. For troubleshooting

needs, you can specify to record information for IM/P2P by

checking the Log box. It will be sent to Syslog server. Please

refer to section Syslog/Mail Alert for more detailed

information.

URL Content Filter Select one of the URL Content Filter profile settings

(created in CSM>> URL Content Filter) for applying with this

router. Please set at least one profile for choosing in CSM>>

URL Content Filter web page first. Or choose [Create New]

from the drop down list in this page to create a new profile.

For troubleshooting needs, you can specify to record

information for URL Content Filter by checking the Log box.

It will be sent to Syslog server. Please refer to section

Syslog/Mail Alert for more detailed information.

Web Content Filter Select one of the Web Content Filter profile settings

(created in CSM>> Web Content Filter) for applying with

this router. Please set at least one profile for anti-virus in

CSM>> Web Content Filter web page first. Or choose

[Create New] from the drop down list in this page to create

a new profile. For troubleshooting needs, you can specify to

record information for Web Content Filter by checking the

Log box. It will be sent to Syslog server. Please refer to

section Syslog/Mail Alert for more detailed information.

DNS Filter Select one of the DNS Filter profile settings (created in

CSM>>DNS Filter) for applying with this router. Please set at

least one profile in CSM>> Web Content Filter web page

first. Or click the DNS Filter link in this page to create a new

profile.

Advance Setting Click Edit to open the following window. However, it is

strongly recommended to use the default settings here.

Codepage - This function is used to compare the characters

among different languages. Choose correct codepage can

help the system obtain correct ASCII after decoding data

from URL and enhance the correctness of URL Content Filter.

The default value for this setting is ANSI 1252 Latin I. If you

do not choose any codepage, no decoding job of URL will be

processed. Please use the drop-down list to choose a

codepage.

If you do not have any idea of choosing suitable codepage,

please open Syslog. From Codepage Information of Setup

dialog, you will see the recommended codepage listed on the

Vigor2133 Series User’s Guide

258

dialog box.

Window size – It determines the size of TCP protocol

(0~65535). The more the value is, the better the

performance will be. However, if the network is not stable,

small value will be proper.

Session timeout – Setting timeout for sessions can make the

best utilization of network resources.

Backup Firewall Click Backup to save the firewall configuration.

Restore Firewall Click Select to choose a firewall configuration file. Then

click Restore to apply the file.

After finishing all the settings here, please click OK to save the configuration.

Vigor2133 Series User’s Guide

25

9

V

-

1

-

2

F

i

l

t

e

r

S

e

t

u

p

Click Firewall and click Filter Setup to open the setup page.

To edit or add a filter, click on the set number to edit the individual set. The following page

will be shown. Each filter set contains up to 7 rules. Click on the rule number button to edit

each rule. Check Active to enable the rule.

Available settings are explained as follows:

Item Description

Filter Rule Click a button numbered (1 ~ 7) to edit the filter rule. Click

the button will open Edit Filter Rule web page. For the

detailed information, refer to the following page.

Active Enable or disable the filter rule.

Comment Enter filter set comments/description. Maximum length is

23–character long.

Direction Display the direction of packet.

Src IP / Dst IP Display the IP address of source /destination.

Service Type Display the type and port number of the packet.

Vigor2133 Series User’s Guide

260

Action Display the packets to be passed /blocked.

CSM Display the content security managed

Move Up/Down Use Up or Down link to move the order of the filter rules.

Next Filter Set Set the link to the next filter set to be executed after the

current filter run. Do not make a loop with many filter sets.

Wizard Mode Allow to configure frequently used settings for filter rule via

several setting pages.

Advance Mode Allow to configure detailed settings of filter rule.

To use Wizard Mode, simple do the following steps:

1. Click the Wizard Mode radio button.

2. Click Index 1. The setting page will appear as follows:

Available settings are explained as follows:

Item Description

Comments Enter filter set comments/description. Maximum length is

14- character long.

Direction Set the direction of packet flow. It is for Data Filter only.

For the Call Filter, this setting is not available since Call

Filter is only applied to outgoing traffic.

Note: RT means routing domain for 2nd subnet or other

LAN.

Vigor2133 Series User’s Guide

261

Source/Destination IP

Click Edit to access into the following dialog to choose the

source/destination IP or IP ranges.

To set the IP address manually, please choose Any

Address/Single Address/Range Address/Subnet Address as

the Address Type and type them in this dialog.

Protocol Specify the protocol(s) which this filter rule will apply to.

Source Port /

Destination Port

(=) – when the first and last value are the same, it indicates

one port; when the first and last values are different, it

indicates a range for the port and available for this service

type.

(!=) – when the first and last value are the same, it

indicates all the ports except the port defined here; when

the first and last values are different, it indicates that all

the ports except the range defined here are available for

this service type.

(>) – the port number greater than this value is available.

(<) – the port number less than this value is available for

this profile.

3. Click Next to get the following page.

Vigor2133 Series User’s Guide

262

Available settings are explained as follows:

Item Description

Pass Immediately Packets matching the rule will be passed immediately.

APP Enforcement - Select an APP Enforcement profile for

global IM/P2P application blocking. If there is no profile for

you to select, please choose [Create New] from the drop

down list in this page to create a new profile. All the hosts

in LAN must follow the standard configured in the APP

Enforcement profile selected here. For detailed

information, refer to the section of APP Enforcement

profile setup. For troubleshooting needs, you can specify to

record information for IM/P2P by checking the Log box. It

will be sent to Syslog server. Please refer to section

Syslog/Mail Alert for more detailed information.

URL Content Filter - Select one of the URL Content Filter

profile settings (created in CSM>> URL Content Filter) for

applying with this router. Please set at least one profile for

choosing in CSM>> URL Content Filter web page first. Or

choose [Create New] from the drop down list in this page

to create a new profile. For troubleshooting needs, you can

specify to record information for URL Content Filter by

checking the Log box. It will be sent to Syslog server. Please

refer to section Syslog/Mail Alert for more detailed

information.

Web Content Filter - Select one of the Web Content Filter

profile settings (created in CSM>> Web Content Filter) for

applying with this router. Please set at least one profile for

anti-virus in CSM>> Web Content Filter web page first. Or

choose [Create New] from the drop down list in this page

to create a new profile. For troubleshooting needs, you can

specify to record information for Web Content Filter by

checking the Log box. It will be sent to Syslog server. Please

refer to section Syslog/Mail Alert for more detailed

information.

DNS Filter - Select one of the DNS Filter profile settings

(created in CSM>>DNS Filter) for applying with this router.

Please set at least one profile in CSM>> Web Content

Filter web page first. Or click the DNS Filter link from the

drop down list in this page to create a new profile.

Block Immediately Packets matching the rule will be dropped immediately.

Vigor2133 Series User’s Guide

263

4. After choosing the mechanism, click Next to get the summary page for reference.

5. If there is no error, click Finish to complete wizard setting.

Vigor2133 Series User’s Guide

264

To use Advance Mode, do the following steps:

1. Click the Advance Mode radio button.

2. Click Index 1 to access into the following page.

Available settings are explained as follows:

Item Description

Check to enable the

Filter Rule

Check this box to enable the filter rule.

Comments Enter filter set comments/description. Maximum length is

14- character long.

Index(1-15) Set PCs on LAN to work at certain time interval only. You

may choose up to 4 schedules out of the 15 schedules

pre-defined in Applications >> Schedule setup. The

default setting of this field is blank and the function will

always work.

Clear sessions when

schedule ON

Check this box to clear the sessions when the above

schedule profiles are applied.

Direction Set the direction of packet flow. It is for Data Filter only.

For the Call Filter, this setting is not available since Call

Filter is only applied to outgoing traffic.

Vigor2133 Series User’s Guide

265

Note: RT means routing domain for 2nd subnet or other

LAN.

Source/Destination IP

Click Edit to access into the following dialog to choose the

source/destination IP or IP ranges.

To set the IP address manually, please choose Any

Address/Single Address/Range Address/Subnet Address as

the Address Type and type them in this dialog. In addition,

if you want to use the IP range from defined groups or

objects, please choose Group and Objects as the Address

Type.

From the IP Group drop down list, choose the one that you

want to apply. Or use the IP Object drop down list to

choose the object that you want.

Service Type Click Edit to access into the following dialog to choose a

suitable service type.

Vigor2133 Series User’s Guide

266

To set the service type manually, please choose User

defined as the Service Type and type them in this dialog. In

addition, if you want to use the service type from defined

groups or objects, please choose Group and Objects as the

Service Type.

Protocol - Specify the protocol(s) which this filter rule will

apply to.

Source/Destination Port –

(=) – when the first and last value are the same, it indicates

one port; when the first and last values are different, it

indicates a range for the port and available for this service

type.

(!=) – when the first and last value are the same, it

indicates all the ports except the port defined here; when

the first and last values are different, it indicates that all

the ports except the range defined here are available for

this service type.

(>) – the port number greater than this value is available.

(<) – the port number less than this value is available for

this profile.

Service Group/Object - Use the drop down list to choose

the one that you want.

Fragments Specify the action for fragmented packets. And it is used

for Data Filter only.

Don’t care -No action will be taken towards fragmented

packets.

Unfragmented -Apply the rule to unfragmented packets.

Fragmented - Apply the rule to fragmented packets.

Too Short - Apply the rule only to packets that are too short

to contain a complete header.

Filter Specifies the action to be taken when packets match the

rule.

Block Immediately - Packets matching the rule will be

dropped immediately.

Pass Immediately - Packets matching the rule will be

passed immediately.

Block If No Further Match - A packet matching the rule,

and that does not match further rules, will be dropped.

Vigor2133 Series User’s Guide

267

Pass If No Further Match - A packet matching the rule, and

that does not match further rules, will be passed through.

Branch to other Filter

Set

If the packet matches the filter rule, the next filter rule

will branch to the specified filter set. Select next filter rule

to branch from the drop-down menu. Be aware that the

router will apply the specified filter rule for ever and will

not return to previous filter rule any more.

Sessions Control The number typed here is the total sessions of the packets

that do not match the filter rule configured in this page.

The default setting is 60000.

MAC Bind IP

Strict –Make the MAC address and IP address settings

configured in IP Object for Source IP and Destination IP

are bound for applying such filter rule.

No-Strict - no limitation.

Quality of Service Choose one of the QoS rules to be applied as firewall rule.

For detailed information of setting QoS, please refer to the

related section later.

APP Enforcement Select an APP Enforcement profile for global IM/P2P

application blocking. If there is no profile for you to select,

please choose [Create New] from the drop down list in this

page to create a new profile. All the hosts in LAN must

follow the standard configured in the APP Enforcement

profile selected here. For detailed information, refer to

the section of APP Enforcement profile setup. For

troubleshooting needs, you can specify to record

information for IM/P2P by checking the Log box. It will be

sent to Syslog server. Please refer to section Syslog/Mail

Alert for more detailed information.

URL Content Filter Select one of the URL Content Filter profile settings

(created in CSM>> URL Content Filter) for applying with

this router. Please set at least one profile for choosing in

CSM>> URL Content Filter web page first. Or choose

[Create New] from the drop down list in this page to create

a new profile. For troubleshooting needs, you can specify to

record information for URL Content Filter by checking the

Log box. It will be sent to Syslog server. Please refer to

section Syslog/Mail Alert for more detailed information.

Web Content Filter Select one of the Web Content Filter profile settings

(created in CSM>> Web Content Filter) for applying with

this router. Please set at least one profile for anti-virus in

CSM>> Web Content Filter web page first. Or choose

[Create New] from the drop down list in this page to create

a new profile. For troubleshooting needs, you can specify to

record information for Web Content Filter by checking the

Log box. It will be sent to Syslog server. Please refer to

section Syslog/Mail Alert for more detailed information.

DNS Filter Select one of the DNS Filter profile settings (created in

CSM>>DNS Filter) for applying with this router. Please set at

least one profile in CSM>> Web Content Filter web page

Vigor2133 Series User’s Guide

268

first. Or click the DNS Filter link from the drop down list in

this page to create a new profile.

Advance Setting Click Edit to open the following window. However, it is

strongly recommended to use the default settings here.

Codepage - This function is used to compare the characters

among different languages. Choose correct codepage can

help the system obtaining correct ASCII after decoding data

from URL and enhance the correctness of URL Content

Filter. The default value for this setting is ANSI 1252 Latin I.

If you do not choose any codepage, no decoding job of URL

will be processed. Please use the drop-down list to choose

a codepage.

If you do not have any idea of choosing suitable codepage,

please open Syslog. From Codepage Information of Setup

dialog, you will see the recommended codepage listed on

the dialog box.

Window size – It determines the size of TCP protocol

(0~65535). The more the value is, the better the

performance will be. However, if the network is not stable,

small value will be proper.

Session timeout–Setting timeout for sessions can make the

best utilization of network resources. However, Queue

timeout is configured for TCP protocol only; session

timeout is configured for the data flow which matched with

the firewall rule.

DrayTek Banner – Please uncheck this box and the

following screen will not be shown for the unreachable web

page. The default setting is Enabled.

Vigor2133 Series User’s Guide

26

9

Strict Security Checking - All the packets, while

transmitting through Vigor router, will be filtered by

firewall settings configured by Vigor router. When the

resource is inadequate, the packets will be blocked if Strict

Security Checking is enabled. If Strict Security Checking is

not enabled, then the packets will pass through the router.

3. When you finish the configuration, please click OK to save and exit this page.

Vigor2133 Series User’s Guide

270

V

-

1

-

3

D

o

S

D

e

f

e

n

s

e

As a sub-functionality of IP Filter/Firewall, there are 15 types of detect/ defense function in

the DoS Defense setup. The DoS Defense functionality is disabled for default.

Click Firewall and click DoS Defense to open the setup page.

Available settings are explained as follows:

Item Description

Enable Dos Defense Check the box to activate the DoS Defense Functionality.

Select All Click this button to select all the items listed below.

Enable SYN flood defense Check the box to activate the SYN flood defense function.

Once detecting the Threshold of the TCP SYN packets from

the Internet has exceeded the defined value, the Vigor

router will start to randomly discard the subsequent TCP

SYN packets for a period defined in Timeout. The goal for

this is prevent the TCP SYN packets’ attempt to exhaust the

limited-resource of Vigor router.

By default, the threshold and timeout values are set to

2000 packets per second and 10 seconds, respectively. That

means, when 2000 packets per second received, they will

be regarded as “attack event” and the session will be

paused for 10 seconds.

Enable UDP flood defense

Check the box to activate the UDP flood defense function.

Once detecting the Threshold of the UDP packets from the

Internet has exceeded the defined value, the Vigor router

will start to randomly discard the subsequent UDP packets

for a period defined in Timeout.

The default setting for threshold and timeout are 2000

Vigor2133 Series User’s Guide

271

packets per second and 10 seconds, respectively. That

means, when 2000 packets per second received, they will

be regarded as “attack event” and the session will be

paused for 10 seconds.

Enable ICMP flood defense

Check the box to activate the ICMP flood defense function.

Similar to the UDP flood defense function, once if the

Threshold of ICMP packets from Internet has exceeded the

defined value, the router will discard the ICMP echo

requests coming from the Internet.

The default setting for threshold and timeout are 250

packets per second and 10 seconds, respectively. That

means, when 250 packets per second received, they will be

regarded as “attack event” and the session will be paused

for 10 seconds.

Enable Port Scan

detection

Port Scan attacks the Vigor router by sending lots of packets

to many ports in an attempt to find ignorant services would

respond. Check the box to activate the Port Scan

detection. Whenever detecting this malicious exploration

behavior by monitoring the port-scanning Threshold rate,

the Vigor router will send out a warning.

By default, the Vigor router sets the threshold as 2000

packets per second. That means, when 2000 packets per

second received, they will be regarded as “attack event”.

Block IP options Check the box to activate the Block IP options function.

The Vigor router will ignore any IP packets with IP option

field in the datagram header. The reason for limitation is IP

option appears to be a vulnerability of the security for the

LAN because it will carry significant information, such as

security, TCC (closed user group) parameters, a series of

Internet addresses, routing messages...etc. An

eavesdropper outside might learn the details of your

private networks.

Block Land Check the box to enforce the Vigor router to defense the

Land attacks. The Land attack combines the SYN attack

technology with IP spoofing. A Land attack occurs when an

attacker sends spoofed SYN packets with the identical

source and destination addresses, as well as the port

number to victims.

Block Smurf Check the box to activate the Block Smurf function. The

Vigor router will ignore any broadcasting ICMP echo

request.

Block trace route Check the box to enforce the Vigor router not to forward

any trace route packets.

Block SYN fragment Check the box to activate the Block SYN fragment function.

The Vigor router will drop any packets having SYN flag and

more fragment bit set.

Block Fraggle Attack Check the box to activate the Block fraggle Attack function.

Any broadcast UDP packets received from the Internet is

blocked.

Activating the DoS/DDoS defense functionality might block

some legal packets. For example, when you activate the

fraggle attack defense, all broadcast UDP packets coming

from the Internet are blocked. Therefore, the RIP packets

from the Internet might be dropped.

Vigor2133 Series User’s Guide

272

Block TCP flag scan Check the box to activate the Block TCP flag scan function.

Any TCP packet with anomaly flag setting is dropped. Those

scanning activities include no flag scan, FIN without ACK

scan, SYN FINscan, Xmas scan and full Xmas scan.

Block Tear Drop Check the box to activate the Block Tear Drop function.

Many machines may crash when receiving ICMP datagrams

(packets) that exceed the maximum length. To avoid this

type of attack, the Vigor router is designed to be capable of

discarding any fragmented ICMP packets with a length

greater than 1024 octets.

Block Ping of Death Check the box to activate the Block Ping of Death function.

This attack involves the perpetrator sending overlapping

packets to the target hosts so that those target hosts will

hang once they re-construct the packets. The Vigor routers

will block any packets realizing this attacking activity.

Block ICMP Fragment Check the box to activate the Block ICMP fragment

function. Any ICMP packets with more fragment bit set are

dropped.

Block Unassigned Numbers

Check the box to activate the Block Unknown Protocol

function. Individual IP packet has a protocol field in the

datagram header to indicate the protocol type running over

the upper layer. However, the protocol types greater than

100 are reserved and undefined at this time. Therefore, the

router should have ability to detect and reject this kind of

packets.

Warning Messages We provide Syslog function for user to retrieve message

from Vigor router. The user, as a Syslog Server, shall receive

the report sending from Vigor router which is a Syslog

Client.

All the warning messages related to DoS Defense will be

sent to user and user can review it through Syslog daemon.

Look for the keyword DoS in the message, followed by a

name to indicate what kind of attacks is detected.

Vigor2133 Series User’s Guide

273

Vigor2133 Series User’s Guide

274

V

-

1

-

4

D

i

a

g

n

o

s

e

The purpose of this function is to test when the router receiving incoming packet, which

firewall rule will be applied to that packet. The test result, including firewall rule profile, IP

address translation in packet transmission, state of the firewall fuctions and etc., also will be

shown on this page.

Info

The result obtained by using Diagnose is offered for RD debug. It will be

different according to actual state such as netework connection, LAN/WAN

settings and so on.

Available settings are explained as follows:

Item Description

Mode To have a firewall rule test, specify the service type (ICMP,

UDP, TCP) of the packet and type of the IP address

(IPv4/IPv6).

Direction Set the way (from WAN or from LAN) that Vigor router

receives the first packet for test. Different way means the

firewall will process the connection initiated from LAN or

from WAN.

Test View This is a dynamic display page.

According to the direction specified, test view will display

the figure to guide you typing IP address, port number, and

MAC address.

Later, after clicking the Analyze button, the information for

the firewall rule profile and address translation will be

shown on this page.

Src IP Type the IPv4/IPv6 address of the packet’s source.

Src Port Type the port number of the packet’s source.

Src MAC Type the MAC address of the packet’s source.

Vigor2133 Series User’s Guide

275

Dst IP Type the IPv4/IPv6 address of the packet’s destination.

Dst Port Type the port number of the packet’s destination.

Packet & Payload In firewall diagnose, two packets belong to one connection.

In general, two packets are enough for Vigor router to

perform this test.

Enable – Check the box to send out the test packet.

Direction – The first packet of the firewall test will follow

the direction specified above. However, the direction for

the second packet might be different. Simply choose the

direction (from Computer A to B or from the B to A) for the

second packet.

Protocol – It displays the mode selected above and the

sate. If required, click the mode link to configure advanced

setting. The common service type (Customize, Ping, Trace

Route / Customize, DNS, Trace Route / Customize,

Http(GET) related to that mode (ICMP / UDP / TCP) will be

shown on the following dialog box.

 Type – Choose Customize, Ping, Trace Route /

Customize, DNS, Trace Route / Customize, Http

(GET).

 Payload – It is available when Customzie is selected.

Simply type 16 HEX characters which represent

certain packet (e.g., DNS packet) if you want to set

the data transfered with protocol (ICMP/UDP/TCP)

which is different to Type setting.

Analyze Execute the test and analyze the result.

Vigor2133 Series User’s Guide

276

The following figure shows the test result after clicking Analyze. Processing state for the

fuctions (MAC Filter, QoS, User management, etc.,) related to the firewall will be displayed

by green or red LED.

Vigor2133 Series User’s Guide

27

7

A

p

l

i

c

a

t

i

o

n

N

o

t

e

s

A

-

1

H

o

w

t

o

C

o

n

f

i

g

u

r

e

C

e

r

t

a

i

n

C

o

m

p

u

t

e

r

s

A

c

e

s

i

n

g

t

o

I

n

t

e

r

n

e

t

We can specify certain computers (e.g., 192.168.1.10 ~ 192.168.1.20) accessing to Internet

through Vigor router. Others (e.g., 192.168.1.31 and 192.168.1.32) outside the range can get

the source from LAN only.

The way we can use is to set two rules under Firewall. For Rule 1 of Set 2 under

Firewall>>Filter Setup is used as the default setting, we have to create a new rule starting

from Filter Rule 2 of Set 2.

1. Access into the web user interface of Vigor router.

2. Open Firewall>>Filter Setup. Click the Set 2 link, choose Advance Mode and choose the

Filter Rule 2 button.

Vigor2133 Series User’s Guide

278

3. Check the box of Check to enable the Filter Rule. Type the comments (e.g., block_all).

Choose Block If No Further Match for the Filter setting. Then, click OK.

Info

In default, the router will check the packets starting with Set 2, Filter

Rule 2 to Filter Rule 7. If Block If No Further Match for is selected for

Filter, the firewall of the router would check the packets with the rules

starting from Rule 3 to Rule 7. The packets not matching with the rules

will be processed according to Rule 2.

4. Next, set another rule. Just open Firewall>>Filter Setup. Click the Set 2 link and

choose the Filter Rule 3 button.

5. Check the box of Check to enable the Filter Rule. Type the comments (e.g., open_ip).

Click the Edit button for Source IP.

Vigor2133 Series User’s Guide

27

9

6. A dialog box will be popped up. Choose Range Address as Address Type by using the

drop down list. Type 192.168.1.10 in the field of Start IP, and type 192.168.1.20 in the

field of End IP. Then, click OK to save the settings. The computers within the range can

access into the Internet.

7. Now, check the content of Source IP is correct or not. The action for Filter shall be set

with Pass Immediately. Then, click OK to save the settings.

Vigor2133 Series User’s Guide

280

8. Both filter rules have been created. Click OK.

Now, all the settings are configured well. Only the computers with the IP addresses within

192.168.1.10 ~ 192.168.1.20 can access to Internet.

Vigor2133 Series User’s Guide

281

V

-

2

C

e

n

t

r

a

l

S

e

c

u

r

i

t

y

M

a

n

a

g

e

m

e

n

t

(

C

S

M

)

CSM is an abbreviation of Central Security Management which is used to control IM/P2P

usage, filter the web content and URL content to reach a goal of security management.

A

P

E

n

f

o

r

c

e

m

e

n

t

F

i

l

t

e

r

As the popularity of all kinds of instant messenger application arises, communication cannot

become much easier. Nevertheless, while some industry may leverage this as a great tool to

connect with their customers, some industry may take reserved attitude in order to reduce

employee misusage during office hour or prevent unknown security leak. It is similar situation

for corporation towards peer-to-peer applications since file-sharing can be convenient but

insecure at the same time. To address these needs, we provide CSM functionality.

U

R

L

C

o

n

t

e

n

t

F

i

l

t

e

r

To provide an appropriate cyberspace to users, Vigor router equips with URL Content Filter

not only to limit illegal traffic from/to the inappropriate web sites but also prohibit other web

feature where malicious code may conceal.

Once a user type in or click on an URL with objectionable keywords, URL keyword blocking

facility will decline the HTTP request to that web page thus can limit user’s access to the

website. You may imagine URL Content Filter as a well-trained convenience-store clerk who

won’t sell adult magazines to teenagers. At office, URL Content Filter can also provide a

job-related only environment hence to increase the employee work efficiency. How can URL

Content Filter work better than traditional firewall in the field of filtering? Because it checks

the URL strings or some of HTTP data hiding in the payload of TCP packets while legacy

firewall inspects packets based on the fields of TCP/IP headers only.

On the other hand, Vigor router can prevent user from accidentally downloading malicious

codes from web pages. It’s very common that malicious codes conceal in the executable

objects, such as ActiveX, Java Applet, compressed files, and other executable files. Once

downloading these types of files from websites, you may risk bringing threat to your system.

For example, an ActiveX control object is usually used for providing interactive web feature. If

malicious code hides inside, it may occupy user’s system.

W

e

b

C

o

n

t

e

n

t

F

i

l

t

e

r

We all know that the content on the Internet just like other types of media may be

inappropriate sometimes. As a responsible parent or employer, you should protect those in

your trust against the hazards. With Web filtering service of the Vigor router, you can protect

your business from common primary threats, such as productivity, legal liability, network and

security threats. For parents, you can protect your children from viewing adult websites or

chat rooms.

Once you have activated your Web Filtering service in Vigor router and chosen the categories

of website you wish to restrict, each URL address requested (e.g.www.bbc.co.uk) will be

checked against our server database. This database is updated as frequent as daily by a global

team of Internet researchers. The server will look up the URL and return a category to your

router. Your Vigor router will then decide whether to allow access to this site according to the

categories you have selected. Please note that this action will not introduce any delay in your

Web surfing because each of multiple load balanced database servers can handle millions of

requests for categorization.

Info

The priority of URL Content Filter is higher than Web Content Filter.

Vigor2133 Series User’s Guide

282

W

e

b

U

s

e

r

I

n

t

e

r

f

a

c

e

V

-

2

-

1

A

P

E

n

f

o

r

c

e

m

e

n

t

P

r

o

f

i

l

e

You can define policy profiles for IM (Instant Messenger)/P2P (Peer to Peer)/Protocol/Misc

application. This page allows you to set 32 profiles for different requirements. The APP

Enforcement Profile will be applied in Default Rule of Firewall>>General Setup for filtering.

Available settings are explained as follows:

Item Description

Set to Factory Default Clear all profiles.

Profile Display the number of the profile which allows you to click to

set different policy.

Name Display the name of the APP Enforcement Profile.

Click the number under Index column for settings in detail.

There are four tabs IM, P2P, Protocol and Others displayed on this page. Each tab will bring

out different items with supported versions that you can choose to disallow people using.

Vigor2133 Series User’s Guide

283

Below shows the items which are categorized under IM.

Available settings are explained as follows:

Item Description

Profile Name Type a name for the CSM profile. The maximum length of the

name you can set is 15 characters.

Select All Click it to choose all of the items in this page.

Clear All Uncheck all the selected boxes.

Enable Check the box to select the APP to be blocked by Vigor

router.

Adv A button under Enable check box allows you to open a pop up

window to specify activity for that APP.

The profiles configured here can be applied in the Firewall>>General Setup and

Firewall>>Filter Setup pages as the standard for the host(s) to follow.

Vigor2133 Series User’s Guide

284

Below shows the items which are categorized under Protocol.

The items categorized under P2P -----

Vigor2133 Series User’s Guide

285

The items categorized under OTHERS-----

Vigor2133 Series User’s Guide

286