How to set up VPN on a DrayTek Vigor Router

This manual describes how to set up IPsec IKEv2 on a DrayTek Vigor router. The manual was originally created by DrayTek, and is published here in a slightly modified version with kind permission of DrayTek.

Downloading the Perfect Privacy IPsec Root CA certificate

Download the Perfect Privacy IPsec Root CA certificate and unpack the ZIP file on your computer.

Download

IPsec information: Choose a VPN server | How to set up VPN on a DrayTek Vigor Router

On our page with information regarding IPsec choose the VPN server, to which you want to establish the VPN connection (e.g. "rotterdam.perfect-privacy.com").

Import the IPsec certificate | How to set up VPN on a DrayTek Vigor Router

Go to the settings of the DrayTek Vigor router and then go to the Certificate Management → Trusted CA Certificate page and click the Import button.

Click Choose File to select the CA certificate file perfect-privacy_ipsec_ca.crt from the downloaded and unpacked archive, then click Import.

Certificate successfully imported | How to set up VPN on a DrayTek Vigor Router

Wait for a few seconds. The Vigor router will respond “Import Success” and you can see the Certificate Status is OK.

Go to VPN and Remote Access → IPsec Peer Identity page, edit a profile to add an "identity profile" for Perfect Privacy server. Click Enable this account and select Accept Any Peer ID.

Go to VPN and Remote Access → LAN to LAN, click on an available "index" number and edit the profile as follows:
a. In Common Settings:

Give the profile a name and activate Enable this profile
Set Call Direction to Dial-Out
Select the WAN interface that the VPN will Dial-Out through

b. In Dial-Out Settings:

Select IPsec EAP as the "VPN server type"
Enter the VPN server IP address/ Hostname of the previously selected VPN server
Enter the Username and Password (of your Perfect Privacy account)
Choose Digital Signature and select the previously created"IPsec Peer Identity Profile"
As "IPsec Security Method" select High (ESP) and AES with Authentication

Edit IKE Advanced Settings | How to set up VPN on a DrayTek Vigor Router

Click the Advanced button for configuring advanced IKE/ IPsec Settings and configure:

IKE phase 1 proposal: AES256_SHA1_G14
IKE phase 2 proposal: AES256_SHA1
IKE phase 1 key lifetime: 3600
IKE phase 2 key lifetime: 1200

Edit TCP/IP Network Settings | How to set up VPN on a DrayTek Vigor Router

c. In TCP/IP Network Settings:

Remote Network IP /Mask: 0.0.0.0/00
Select NAT for this VPN connection
Enable the Change Default Route to this VPN tunnel option if you want all traffic to be routed to the Perfect Privacy VPN server

Connection Management shows status of VPN | How to set up VPN on a DrayTek Vigor Router

After finishing above settings, you can check the VPN status via the VPN-Status via VPN and Remote Access → Connection Management page.

Perfect Privacy Check-IP | How to set up VPN on a DrayTek Vigor Router

You can optionally create a Policy Route via Routing → Load-Balance/Route Policy to define only specific traffic to be routed through the Perfect Privacy-VPN tunnel.

You can verify that the VPN connection works correctly by visiting our Check IP website on any device connected via the router.