DrayTek Vigor2926 Dual-WAN Router Test

The DrayTek Vigor2926 is part of the latest Dual-WAN VPN router series released by the Taiwan-based manufacturer to aid the SMBs in their endeavor to achieve the maximum network security and reliability. The Vigor2926 is also the successor to the relatively popular Vigor2925 which was a security-focused broadband router that could offer a flexible LAN management (including VLAN), Load Balancing and FailOver abilities (thanks to the multi WAN ports), as well as SPI Firewall, VPN (LAN-to-LAN and Remote Dial-in) and a centralized management portal in order to control the router along with other compatible Vigor devices (such as VigorAP).

The DrayTek Vigor2926 picks up where the Vigor2925 left off (since the latter reached EOL), so, besides offering pretty much everything that its predecessor could, it comes with a more powerful processor and it features some improvements in terms of software.

The DrayTek Vigor2926 wasn’t built to cater to the consumer market and its features are suitable for small to medium businesses, so it’s not surprise that the device lacks any WiFi capabilities (you’ll have to rely on wireless access points). At the same time, the new router series does include the Vigor2926n, the Vigor2926ac and the Vigor2926Vac, the first being single band (2.4GHz 802.11n), while the second offers dual-band capabilities (2.4GHz 802.11n and 5GHz 802.11ac) and the third is also dual-band, but it includes VoIP.

Design
Despite catering to the SMB audience, the DrayTek Vigor2926 steered clear of the industrial look (which is the most common among this type of devices) and, instead it decided to add some design elements to make the router stand out from the crowd. Sure, it still features a rectangular case, but on the top area, the plastic curves and creates a wave-like pattern filled with narrow canals that slightly expose the internal components (to help with the heat management).

The front area is glossy black, while the top surface is covered by a black matte finish (doesn’t retain fingerprints) and the bottom half of the device is light grey. To get away from the design monotony, most routers went the minimalist Apple Airport-inspired way, so it’s interesting to see that some manufacturers still manage to find new ways to create a unique design (especially considering the Vigor2926 is a non-consumer device).

Furthermore the Vigor2926 is entirely made of plastic, unlike most other dual-WAN routers which are usually made of out metal, but DrayTek used quality materials, so the device ends up looking decently premium (not that SMBs are really that picky in this department). In terms of size, the router measures 9.48 x 6.50 x 1.73 inches, so it’s smaller and more compact than more consumer-type routers (such as the Netgear Nighthawk R7800 or Linksys WRT3200ACM) and it weighs about 1.1 pounds, which, along with the four silicone feet from the bottom side, ensure that the device won’t budge no matter the number of cables connected.

But, judging by the way it has positioned its ports, the DrayTek Vigor2926 seems to favour the wall mount position, instead simply sitting on a flat surface and this can easily be done thanks to the bidirectional holes on the bottom surface. Also here, the manufacturer has added lots of ventilation cut-outs to make sure that the device won’t overheat: when put under some stress, I can confirm that the router gets slightly warm on the top and bottom side towards the rear side, but it never shown signs of overheating.
When put next to the Vigor2925, the two routers look almost identical, sharing the same size, the same design (including the wave pattern), but the change comes on the front surface, where DrayTek decided to modify the order of the ports.

The recessed Factory Default button is still on the left side (press and hold it for more than 5 seconds until the ACT LED starts blinking), next to the block of LED indicators which are divided into three rows: the first row consists of ACT (the LED will flash when data is being received / transmitted), USB 1 and USB 2 LEDs (the LEDs will turn solid yellow when a USB device is connected to the router and will flash when data is being transmitted / received); the second block of LEDs consists of WAN 1, WAN 2 (the WAN LED/s will be solid yellow when the Internet connection is ready and will flash when data is being transmitted) and VPN (the LED will remain turned off as long as the VPN service is disabled and will become solid yellow when the VPN tunnel is active; the LED will flash when data will pass through the VPN tunnel); lastly, the third block of LEDs consists of QoS (enabled when the QoS is active), WCF (it will be solid yellow as long as the Web Content Filter is active) and DMZ (the LED will be solid yellow if you activate this NAT-related function and will flash yellow when data is being transmitted).

Further to the left, DrayTek put the Ethernet ports first and the two USB ports to the far right (the Vigor2925 had them the other way around), so, from the left, there are four Gigabit Ethernet LAN ports (each with a couple of LEDs, one responsible for Activity, so it will flash when data is being transmitted or received and the other shows the type of connection, so it will remain Off if the connection is made at 10/100 Mbps and will turn On when the connection is made at 1000 Mbps), a Gigabit WAN1 port (also has two LEDs that function in the same manner as on the LAN ports), a P5 / WAN2 port (you can connect a secondary Internet cable for Load Balancing and Failover functions, but the port can also work as a regular LAN port) and the USB ports (dedicated for connecting USB devices, including 3G/4G/LTE modems or Environmental Thermometers). On the rear side, DrayTek has positioned the Power connector and an On/Off switch, but you’ll also be able to notice that the device lacks any antenna ports (the reason for this is because the Vigor2925 is not a WiFi router).

Hardware
After I opened the case, I noticed that DrayTek has equipped the Vigor2926 with 128 MB Toshiba LF0525 TC58NVG0S3ETA00 CMOS NAND flash memory (just like its predecessor), 128 MB SDRAM DDR2 WINBOND W971GG6SB-25 G8173H400532 (also similar to the Vigor2925), but, because the manufacturer covered the main chip with an non-removable metal plate, I couldn’t see if it also uses a Lantiq CPU – fortunately, DrayTek has stated that the Vigor2926 indeed has a better CPU clocked at 720MHz for all variants.

Furthermore, the router is also equipped with a Qualcomm Atheros AR8035-A NJ806004 1806 CN Ethernet PHY Chip, a LVC08A 8980032 YXD18 Logic Gate, 2x PKP DIP2401-AG 1823 Integrated Circuits and 2x G2PM109N LF 1825E 1000 Base-T Dual Port Magnetic Modules.

Features and Performance
DrayTek has been building and perfecting its broadband router series for a long time and the Vigor2926, despite lacking any wireless capabilities, it is a powerhouse in terms of features, allowing its users to configure almost every aspect of their network. The feature that will undoubtedly attract the most attention is the Dual-WAN capability which, by default will automatically balance the load between two connected WAN links. In layman terms, if you have a business that heavily relies on a continuous Internet connection, then you can either have two routers, each connected to a separate ISP or use the Vigor2926 which allows both connection at once (the two USB ports can also be used for adding separate 3G/4G/LTE modems which can be added to the load balancing pool).

After accessing the user interface, if you go under WAN > General Setup, you will notice that the Vigor2926 will display the status of the four WAN connections and, next to the Load Balance Mode, you can change between the Auto Weight and According to Line Speed. The way the Load Balancing feature works (by default) is that it calculates the ratio of the remaining bandwidth for each WAN, so the sessions are sent according to this ratio (more sessions sent to the WAN with the most remaining bandwidth), so the difference between the two is that the Auto Weight relies on a recent bandwidth peak to calculate the ratio, while the According to Line Speed will rely on the defined Line Speed that the admin has to configure (in General Setup > WAN1-4 – this will force the traffic through the WAN with the higher set speed).

Still next to the Load Balance Mode there’s a second set of options, one is IP Based and the other is Session Based. The former will use only one WAN interface, while the latter has the role of combining (aggregating) the bandwidth of the two (or more) WAN links, resulting in a higher throughput. The manufacturer warns that some servers may reject this type of connections, such as HTTPS websites because of security concerns (multiple IPs), but by going to Routing, Load-Balance / Route Policy, you can manage the outbound traffic, therefore specify which WAN interface should be used for those specific types of websites. Beside the Load Balancing feature, you can also set a WAN interface to become active in case the primary WAN connection fails or if it goes beyond the User defined Traffic Threshold (also known as the Failover mode).

To test the switch latency from WAN1 to WAN2 (and vice versa), I put WAN1 as the main Internet connection (set as Always On) and the WAN2 in Failover mode (both with the Load Balance active) and, I continuously pinged 8.8.8.8. This way, the router took approximately 2-3 seconds to move from WAN1 to WAN2 (it was almost instantaneously) and, after I reactivated the WAN1 connection, it took about 5 seconds to go from WAN2 to WAN1.

Besides the Dual-WAN feature, the Vigor2926 also offers multiple types of VPN connections: PPTP, IPsec, L2TP with IPsec, SSL (works through firewalls, as long as HTTPS traffic is allowed) and OpenVPN. The area of interest is going to be the VPN and Remote Access section, where you’ll have to enable a Remote Dial-in User for the PPTP, SSL and L2TP with IPsec and you’ll have to make some changes in IPSec General Setup and enable a new profile in the LAN-to-LAN section for the IPsec tunnel. Lastly, you can use the DrayTeK Smart VPN Client to run the VPN type of your choice (simply add the existing profile and insert the necessary credentials).

The router also supports VLAN tagging and Bandwidth Management which can limit the number of simultaneous sessions for your devices (IPv4 and IPv6 – you’ll get a warning if you exceed the max set number), you can also limit the bandwidth by IP (includes auto-adjustment to assign an equal amount of bandwidth for every active user); furthermore, there’s QoS where you can adjust the Inbound/Outbound bandwidth for each WAN connection based on preset Classes (you’ll have to create rules that can then be applied on the General Setup table) and, lastly, there’s the APP QoS which allows you to set the suitable priorities to all the protocols (DNS, FTP, SMTP, TELNET and so on).

The two USB ports are mainly dedicated for adding additional 3G/4G/LTE modems or temperature sensors (as the user interface suggests), but, since these can also be used for connecting storage devices, I decided to measure the read / write speeds using an external SSD (Samsung T5 256GB). The Vigor2926 will work only with FAT16 or FAT36 formats, so I had to change from NTFS to FAT32 in order for the router to ‘see’ the new drive. That being said, using the FlashFXP software and by moving a 3GB multimedia folder, the router delivered an average of 10.26 MBps while reading the folder and an average of 10.13 MBps while writing it.

Lastly, I decided to connect two computer to the router, one set as the server and the other as the client and I measured the average throughput: from the client to the server, I measured an average of 949 Mbps and, from the server to the client, I got around 921 Mbps.

Installation and Software
After you’ve connected the power cable to the back of the router, insert the Internet cable from the modem to a WAN port and connect an Ethernet cable to a LAN port and a computer. Afterwards, open a web browser, go to the default router IP address (192.168.1.1) and, when prompted, enter admin / admin for the user name and password. This will immediately display the main page of the DryaTel user interface. Of course, you’re not done because the first thing you need to do is change the default password: from the left menu, select System Maintenance and Administrator Password and here, you can quickly add a new password and, if you want there are other parameters that can be added or changed (use Mobile one-Time Passwords or 2-Step Authentication and administer the Local Users – yes, you can enable User Mode for a simple configuration).

On the next step, you need to configure the Internet connection. To do so, go to WAN, Internet Access and select the WAN port to which you connected the cable (in my case, I used WAN1) by clicking Details Page and selecting the type of connection that you have. In my case, it was PPPoE, so I had to enter the ISP username and password and set the MTU (you can use Path MTU Discovery to automatically find the actual path MTU). Next, the router will restart and I gained access to the Internet.

The user interface is surprisingly user friendly, with all the settings well laid out in their own respective category and, on the main page (the Dashboard), DrayTek has added a graphical representation of the router, showing the connected ports and the active LEDs (it is interactive, so you can quickly access the settings for a particular port), while underneath it, there’s System Information, IPv4 LAN and WAN Information (from these two tables, you can click on any port to change its settings), the Interface info (includes all the connected clients), the Security info (VPN, Vigor and DoS) and the System Resource (current CPU and memory usage). On the right side, there’s a Quick Access menu which allows you to access the most common settings.

Underneath the Dashboard, you can access the Wizards to easily configure the Internet connection (Quick Start Wizard), undergo the Service Activation Wizard (to activate the Web Content Filter (WCF) Service (the BPkM which is free or Cyren, which offers only a 30-day free trial), the APP Enforcement Service and/or the DDNS Service), run the VPN Client Wizard or the VPN Server Wizard (both will require to setup a profile on the VPN and Remote Access section). Further down, there’s the Online Status which is divided into the Physical Connection and the Virtual WAN and then there’s a series of options for an in-depth configuration. First, there’s the WAN settings, where, as we saw in the “Features and Performance” area, can be used to configure the multi-WAN feature, the Internet access, enable Multi-VLAN and enable the WAN Budget (useful if your ISP has put some limitations for the amount of data you can use every month).

Next, there’s the LAN settings where you can configure every LAN port connection, enable DMZ and configure the Inter-LAN Routing from the General Setup; you can also configure the VLAN, Bind IP to MAC, enable LAN Port Mirror and enable Wired 802.1X (you can enforce RADIUS authentication before a device can communicate with the router after being connected to the LAN port). Underneath LAN, there’s the Hotspot Web Portal, where you can setup Profiles (which include the Portal Method, Captive Portal URL, choosing the type of Background the users will see, as well as the message and it also includes configuring outbound connections from hosts, HTTPS Redirection, Captive Portal Detection, landing page and more), see the User Information and configure the Quota Management (Bandwidth and/or Session limit).

Further down, there’s the Routing section (where you can set the Static Route, the Load-Balance / Route Policy table and enable BGP – useful for exchanging routing info with other routers), the NAT section, where you can configure which ports will be open, as well as how and when (Port redirection, DMZ Host, Open Ports, Port Triggering and ALG) and Hardware Acceleration (transmits data packets faster using the router’s hardware, but won’t work along with QoS, Bandwidth Limit or the Data Flow Monitor enabled).

Still on the left menu, there’s the Firewall which allows you to do a General Setup (enable Call and Data Filter, as well as modify the Default Rule), create new filters in the Filter Setup, enable DoS Defence (includes SYN, UDP, ICMP defences and Ports Scan detection, and it allows you to block IP options, LAN, Smurf, Ping of Death, trace route and more) and Spoofing Defence (ARP and IP Spoofing) and run tests to Diagnose any possible Firewall problems. The User Management section allows you to filter the Internet access based on user profiles (if multiple users can log into the network – the case with shared computers), the Object Setting allows you to define Objects (IPv4/IPv6 Object or Group, Keyword, Service Type and more) that can be later applied in the Content Security Management (CSM), which is the next main section and it allows you to create APP Enforcement Profiles, configure APPE Signature Upgrade, URL Content Filter Profile, Web Content Filter Profile and create DNS Filter Profiles, all which can be applied to the Firewall Filter Setup.

The main menu also offers the Bandwidth Management (see in “Features and Performance”), Applications (DDNS, LAN DNS / DNS Forwarding, DNS Security, Schedule, RADIUS / TACACS+, Active Directory / LDAP, UPnP, IGMP, Wake on LAN, SMS / Mail Alert Service, Bonjour, High Availability and Local 802.X general Setup), VLAN and Remote Access, Certificate Management (Local and Trusted CA Certificate), SSL VPN, USB Application (includes Temperature Sensor and Modem Support List), the System Maintenance (here, you can view the System Status, set up TR-069 connection to the ACS Server, change the Admin or User Password, modify the Login Page Greeting, Restore settings from a configuration file (which makes it easy to migrate from the Vigor2925 without having to reconfigure everything), enable SysLog / Mail Alert, set Time and Date, enable SNMP / SNMPV3 Agent, perform IPv4 / IPv6 management and LAN Access Setup, enable or disable LEDs, buttons or ports via the Panel Control, view the Self-Signed Certificate, Reboot the router, Upgrade or Backup the Firmware and more) and Diagnostics (includes log info and tools for an easy diagnosis for any problem that may arise in specific departments).

It’s interesting to see that DrayTek decided to also include some Central Management features, so you can monitor other compatible devices that are connected to the network, such as Access Points, Switches or other External Devices (it also includes VPN setup), but the Vigor2926 can also be added to the VigorACS 2 Controller (in the same manner as with the Vigor920RP Outdoor Wireless Access Point), so it can be monitored and configured alongside other DrayTek devices.

Conclusion
The DrayTek Vigor2926 has kept the same design for almost a decade (and it still manages to look better than a lot of consumer-type routers from the same price range), but this new series comes with improved internal hardware (which means better VPN speed performance), the multi-WAN feature works really well with a decent switch latency and the software is very well designed, with a plethora of features that ensure a complete control over how the network will behave. It’s true that the device is not the cheapest, especially since it lacks wireless capabilities, but considering that the software implementation (including the VigorACS 2 controller) is a lot more mature than on some competitors, it makes the Vigor2926 a great solution for SMBs and for enthusiasts as well (it you’re into this type of routers).