DrayTek Vigor 2867-4G
Product Overview
Key Features & Benefits
The Ideal xDSL and FTTP Gateway for Fast, Secure Business Networks
A high-speed xDSL and FTTP business router with integrated firewall, 10GbE connectivity, and a built-in VDSL modem, designed for demanding fibre and broadband environments. It delivers powerful routing performance, dependable WAN failover, secure VPN connectivity for remote workers, and flexible multi-gigabit LAN connectivity. An ideal next-generation FTTP and VDSL gateway for SMBs, branch offices, and organisations that need a fast, secure, and flexible network foundation.
Flexible 4G/LTE Broadband Connectivity
The integrated 4G/LTE modem provides flexible Internet connectivity for locations where fixed-line broadband is unavailable, impractical, or still being deployed. Supporting both traditional SIM cards and eSIM technology, it enables rapid deployment and greater service provider flexibility. Whether used as the primary WAN connection or as a backup for fibre and broadband services, automatic failover ensures your business stays connected when it matters most.
Future-proof Multi-Gigabit Router
The DrayTek Vigor 2867 is engineered for ambitious SME and SMB environments that demand high performance and flexibility. Delivering up to 9.1Gbps throughput, it supports today’s bandwidth‑intensive applications and future multi‑gigabit connectivity. With an integrated VDSL/ADSL modem and a switchable 10GbE WAN interface, the Vigor 2867 enables direct DSL access or high‑speed fibre connections, providing versatile deployment options with load balancing and failover for resilient, scalable networking.
Built on DrayTek’s advanced feature set, the Vigor 2867 combines powerful routing with intelligent traffic management. Quality of Service (QoS) prioritises mission-critical applications, ensuring consistent performance for voice, video and cloud services. Comprehensive VPN capabilities enable secure site-to-site and remote access connectivity, while robust Content Filtering tools give administrators granular control over web access and network usage.
Route Policy - Routing Management for WAN & VPN
The Vigor 2867 provides full policy-based control of where and how outbound traffic is routed with Route Policy, to send traffic through VPN services and alternative LAN gateways:
| Feature | Description |
|---|---|
VPN Routing |
Send all or select traffic through VPN services. |
Service Routing |
Push specific services or ports, such as DNS, through a set WAN, an alternative Gateway or VPN Tunnel. |
Failover & Failback |
Extensive control of Failover with multiple Failover rules and paths. Manage how connections are moved back to the primary connection, after a failover has occurred with Failback settings. |
Integrated 4G LTE Modem
The Vigor 2867-4G router provides high speed mobile broadband connectivity for Internet access and VPN, with its built-in 4G modem. The Category 6 mobile module is an affective way of setting up the primary or failover connection.
DrayTek's LTE routers are not locked to any mobile network and are compatible with all major UK mobile providers, such as EE, Vodafone, O2 and Three, as well as any MVNOs on those networks. The Vigor 2867-4G router uses two LTE aerials. The external antennas can rotate and tilt for optimum reception.
Embedded-SIM (eSIM)
In addition to dual physical SIM slots, the router supports eSIM setup, enabling remote activation and seamless network management without the need to swap SIM cards — ideal for businesses that require secure, scalable, and hassle-free connectivity.
The router supports up to three eSIM profiles, with one active at a time, providing added flexibility when managing multiple carrier options. This allows organisations to store alternative networks for rapid switching, improving service continuity and simplifying connectivity planning across different regions or coverage scenarios.
Powerful VPN Hub for Expanding Business Networks
Optimised for high-speed fibre broadband, the Vigor 2867 provides great IPsec VPN throughput, delivering fast and secure encrypted connections between sites and cloud platforms. Future firmware updates are expected to further enhance performance through hardware acceleration. Whether deployed as a central office gateway or as part of a multi-site infrastructure, the Vigor 2867 offers the scale, speed and security required for modern business connectivity.
It supports all common industry standard VPN protocols, for it to connect to VPN services, link remote offices and handle connections from all types of VPN clients. Supporting IPsec IKEv1 & IKEv2 protocols with EAP and XAuth authentication, OpenVPN and WireGuard for both LAN to LAN and Dial-In teleworker VPNs.
Connecting Remote Sites with LAN to LAN VPN
Supporting up to 50 concurrently active VPN tunnels and great VPN throughput, the Vigor 2867 series is ideal as a business router, to connect with other branches.
Once connected, they have access to your office/remote resources through a secure encrypted tunnel allowing remote desktop, file sharing and seamless access to other resources and devices.
Encrypted VPN for Dial-In Teleworkers & LAN to LAN
Connect up to 50 VPN tunnels. These encrypted tunnels securely link teleworkers or remote DrayTek Vigor routers back to your main office using SSL/TLS technology - similar to the HTTPS security that's used for most secure websites on the internet such as on-line banking and shopping services.
Teleworkers can connect with the secure IPsec, OpenVPN, or WireGuard VPN tunnels to the DrayTek Vigor 2867, using the free DrayTek Smart VPN Client app. Available for Windows, macOS, Apple iOS (iPad, iPhone) and Android devices. The latter two protocols may need additional native software installed on your mobile devices.
Download the SmartVPN client and learn more about DrayTek VPN here.
Identity and Access Control Security Framework
Identity and Access Control (IAM) framework is designed to meet network security requirements. The network administrator can define access policies, control user privileges, and coordinate group policies with the firewall and traffic shaping settings.
| Feature | Description |
|---|---|
Device Authentication |
Using each device’s unique IP and MAC address provides a strong basis for device identification and authentication. |
Reduced False Positives |
Using IP and MAC addresses reduces the likelihood of legitimate devices being blocked due to other potential factors. |
Holistic Security |
Combining user, device, and session-based policies enhances overall security without relying solely on one aspect. |
Enhanced Incident Response |
When security incidents occurs, you can quickly pinpoint the devices involved and take appropriate actions. |
Multi-Gigabit LAN Ports with VLANs
The Vigor 2867 provides up to four active LAN ports, including one dedicated 10Gb SFP+ LAN port, one switchable 10GbE LAN/WAN port, and three 1GbE ports for connecting computers, servers and network-attached storage (NAS).
With a flexible 10GbE port that can operate as either LAN or WAN, alongside a dedicated 10Gb SFP+ LAN port, the Vigor 2867 supports high-speed local networking for demanding applications such as servers, shared storage and virtualised environments. The additional three Gigabit LAN ports provide versatile connectivity for standard network devices, making it suitable for both high-performance and conventional Ethernet deployments.
With multiple LAN subnets and VLANs, the Vigor 2867 can segment the network into separate broadcast domains, improving both security and traffic management. For example, an internal office network can operate independently from a guest network, with each segment applying its own firewall rules, content filtering, quality of service and routing policies.
The router provides full support for 802.1Q VLAN tagging, allowing these VLANs to be extended to compatible switches and wireless access points for additional network expansion. By connecting VLAN-aware access points, such as the DrayTek VigorAP series, separate wireless SSIDs can be mapped to individual VLANs for guest and private networks, maintaining consistent security and traffic policies across both wired and wireless infrastructure.
Designed for Central Management
The Vigor 2867 can be centrally managed along with VigorAP's and switches, with the VigorACS central management platform.
This scalable solution provides visibility, control and reporting of your entire DrayTek product estate, ideal for dealers/SIs managing customers' devices or any user who wants to know what's going on with their devices. VigorACS also provides features like automated/bulk firmware updates, VPN management and alarms for connectivity or other issues.
For full details of VigorACS, click here.
Robust & Comprehensive IPv4 / IPv6 Firewall
Security is always taken seriously with DrayTek routers. The firewall protects against attacks including DoS (Denial of Service) attacks, IP-based threats and access by unauthorised remote systems. Ethernet and VPN connections are safeguarded by multiple layers of protection.
The DrayTek object-based firewall enables you to create combinations of firewall rules and content filtering policies to suit a business environment, applying content filtering across the entire network, to specified devices, or to individual VLAN segments such as a dedicated guest network.
The Vigor 2867 supports both IPv4 and IPv6 with dual-stack IPv4/IPv6 capability. Advanced networking features, including the object-based firewall, quality of service, content filtering and VLANs, operate across both IPv4 and IPv6 networks.
Web Content Filtering with DNS Filter
The content control features of the Vigor 2867 allow you to set restrictions on web site access, blocking download of certain file or data types, blocking specific web sites with whitelists or blacklists, blocking IM/P2P applications or other potentially harmful or wasteful content. Restrictions can be per user, per PC or universal and according to time schedules.
Content filtering can also block sites using HTTPS/SSL where URLs are encrypted (and normal routers cannot block).
Using the GlobalView service, you can block whole categories of web sites (e.g. gambling, adult sites etc.), subject to an annual subscription, which is continuously updated with new or changed site categorisations or sites which have become compromised (such as infected with Malware). A free 30-day trial is included with your new router.
Quality of Service with App QoS
Prioritise latency-sensitive applications on your network with Quality of Service.
App QoS simplifies setting up Quality of Service significantly, simply select which applications or services to prioritise, such as Zoom and Teams.
Use 4 separate queues to give priority to servers & PCs (IP address), services such as VoIP or DNS, or packet tagging used by IP phones with 802.1p and DSCP support
Auto Voice VLAN allows the router to automatically prioritise VoIP calls as they pass through the router without additional configuration.
Control throughput with Bandwidth Limit, by setting speed limits for all clients individually, groups of IPs, or a shared bandwidth limit for a whole subnet, such as a Guest network.
DrayDDNS - DrayTek Dynamic DNS Address
DrayTek provides a free Dynamic DNS address to each Vigor 2867 router, allowing you to link the router's current IP address to a memorable "drayddns.com" hostname, such as "vigor2867.drayddns.com".
This address automatically updates whenever the Internet connection's IP changes, so if one WAN’s IP address allocation is dynamic, or the IP changes when switching from the primary WAN connection to a backup, you can easily locate and access your Vigor 2867 router. Just use the hostname to access the router's VPN services, management and any other services you have made accessible through the router.
The Vigor 2867 can also authenticate your DrayDDNS hostname with free SSL/TLS certificates provided by LetsEncrypt, the router manages and automates the certificate process. Keeping the certificate up to date and ready for use with SSL VPN and other services.
Virtual Controller
DrayTek's Virtual Controller provides centralised management of compatible VigorAP access points and VigorSwitches from a single interface. It can automatically discover supported devices, simplify deployment with provisioning profiles, and provide ongoing monitoring, configuration, and maintenance across the network.
Wireless Management
The Vigor 2867 can centrally manage up to 20 wired DrayTek VigorAP access points through Virtual Controller AP Management. Configuration profiles can be applied across multiple access points, while Auto Provision enables newly installed VigorAPs to be automatically detected and configured when connected to the network.
Switch Management
The Vigor 2867 can centrally manage up to 10 DrayTek VigorSwitches. Virtual Controller assists with device discovery, provisioning, monitoring and ongoing maintenance, simplifying the deployment and operation of wired network infrastructure.
Administrators can configure VLANs, apply port settings, monitor switch status and manage network services directly from the router’s web interface.
Vigor 2867 Web Interface
Dashboard
View the status of the Vigor 2867 in one place from the router's Dashboard.
VigorACS Management
The new DrayOS 5 system provides the same WUI experience via the VigorACS Management platform as on the standalone Dashboard page mentioned above.
CSM - Web Content Filtering, URL Filtering & App Enforcement
Control access to the Internet, either for all users or specific networks / clients only. Category based filtering greatly simplifies the task of filtering Internet access:
Virtual Controller
Discover, adopt, synch configuration, maintain and monitor your DrayTek wireless access points and switches thanks to the Virtual Controller management system
IAM - Identity and Access Control
Configure IAM users and groups and apply network security policies
Vigor 2867-4G Router
Key Specifications
- Multi-WAN xDSL and Ethernet FTTP Router with Failover and Load Balancing
- 4G / LTE with Dual-SIM slots and eSIM support
- 10 Gigabit Ethernet Port for future-proof connectivity
- Up to 9.1Gbps Total Maximum Throughput
- Up to 540Mbps IPsec VPN Throughput
- 50 LAN-to-LAN & Remote Teleworker VPN Tunnels
- Switchable 10GbE/SFP+ and dedicated 3x GbE RJ-45 LAN Ports
- QoS and VLAN support for traffic prioritisation and network segmentation
- SPI Firewall and Content Filtering
- Optional VigorCare Available
- Can be centrally Managed by VigorACS
The Vigor 2867 series comes in several different models depending on the features required. Please double check when ordering that you have selected the correct product and a product intended for the correct region/network.
This model:
| UK Product Code | EAN | Product Name | Product Description |
|---|---|---|---|
| V2867-4G-K | 4711637181807 | Vigor 2867-4G (UK/IE) | Vigor 2867-4G Multi-Gigabit Multi-WAN VDSL & FTTP Firewall VPN Router and integrated 4G/LTE Modem |
Other models in the Vigor 2867 router series:
| UK Product Code | EAN | Product Name | Product Description |
|---|---|---|---|
| V2867-K | 4711637180985 | Vigor 2867 (UK/IE) | Vigor 2867 Multi-Gigabit Multi-WAN Wired VDSL & FTTP Router |
| V2867BE-K | 4711637180961 | Vigor 2867be (UK/IE) | Vigor 2867be Multi-Gigabit Multi-WAN VDSL & FTTP Router with BE7200 Wireless |
| V2867-5G-K | 4711637181821 | Vigor 2867-5G (UK/IE) | Vigor 2867-5G Multi-Gigabit Multi-WAN VDSL & FTTP Firewall VPN Router and integrated 5G/4G Modem |
| V2867BE-4G-K | 4711637181814 | Vigor 2867be-4G (UK/IE) | Vigor 2867be-4G Multi-Gigabit Multi-WAN VDSL & FTTP Firewall VPN Router with BE7200 Wireless and integrated 4G/LTE Modem |
| V2867BE-5G-K | 4711637181241 | Vigor 2867be-5G (UK/IE) | Vigor 2867be-5G Multi-Gigabit Multi-WAN VDSL & FTTP Firewall VPN Router with BE7200 Wireless and integrated 5G/4G Modem |
These product codes are for UK/Irish products only. Please check with your local DrayTek office for the correct part nos. for your region if you are not in the UK/IE to ensure that you get the correct hardware and local support/warranty.
Technical Specification (UK Hardware Spec.)
Physical Interfaces
- WAN Port (P1): 1x Gigabit Ethernet (1G/100M/10M), RJ-45
- P2/P3/P4: 2 can be used out of 3 at once
- WAN Port (P2): 1x VDSL2/ADSL2+, RJ-11
- WAN/LAN Switchable (P3): 1x 10 Gigabit Ethernet (10G/2.5G/1G/100M/10M), RJ-45
- LAN Port (P4): 1x 10G/1G SFP+ Slot
- LAN Ports (P5-P7): 3x Gigabit Ethernet (1G/100M/10M), RJ-45
- 1x USB 2.0 Ports for LTE Modem, Thermometer or Printer
- 2x Removable 4G/LTE Antennas
- Recessed Factory Reset button
- SIM Slot: 2x Nano-SIM (1 Active SIM)
Performance
- NAT Performance:
- Up to 9.1 Gb/s NAT Throughput
- 100,000 NAT Sessions
- VPN Performance:
- Up to 540 Mb/s IPsec VPN Performance
- Max. 50 Concurrent VPN Tunnels
WAN Interfaces
- WAN1: Gigabit Ethernet
- WAN2: VDSL2/ADSL2+ built-in modem
- WAN3/LAN Switchable Port: 10 Gigabit Ethernet
- WAN7: 4G/LTE Built-in Modem
- WAN8: LTE USB Modem (not included)
Internet Connection
- Load Balancing and Failover / Backup WAN
- 802.1p/q Multi-VLAN Tagging
- Multi-VLAN/PVC
- Connection Detection: ARP Detect, Ping Detect
- WAN Data Budget
- Dynamic DNS
- DrayDDNS – with automated Let’s Encrypt Certificates
- IPv4 Connection Types: PPPoE, DHCP, Static IP
- IPv6 Connection Types: Ethernet: PPP, Static IPv6, DHCPv6, TSPC, 6in4, 6rd
VDSL & ADSL2+ Features
- Compliant with Openreach SIN 498
- Auto Detection of VDSL and ADSL line modes
- Support for Vectoring
- VDSL Standards:
- ITU-T G.993.1 VDSL
- ITU-T G.993.2, G.997.1 VDSL2
- Annex A, Annex B, Annex C
- VDSL2 Profile: 8a, 8b, 8c, 8d, 12a, 12b, 17a, 30a, 35b
- OLR, UPBO, DPBO Supported
- US0 Supported
- Loop Diagnostic Mode
- DSL Forum WT-114
- ADSL2 Standards:
- ITU-T G.992.3 ADSL2
- ITU-T G.992.5 ADSL2+
- ATM Protocols:
- RFC-2684/RFC-1483 Multiple Protocol over AAL5
- RFC-2516 PPP over Ethernet
- RFC-2364 PPP over AAL5
- Support for RFC4638 for MTU up to 1500
Integrated 4G Modem Features
- Dual-SIM Failover
- 4G Modem / LTE Category 6 Modem
- Unlocked to any network (EE, 3, O2, Vodafone, Eircom)
- 4G Max Data Rates:
- 300Mbps Downlink
- 50Mbps Uplink
- 4G LTE (FDD) Bands: 1, 3, 7, 8, 20, 28
- 4G LTE (TDD) Bands: 38, 40
- 3G (WCDMA) Bands: 1, 8
- 2x External 4G Antennas included
- SIM Slot: 2x Nano-SIM (1 Active sim)
- Removable SIM slot cover
- eSIM compatible
- SMS Inbox - Send & Receive SMS text messages
Antenna Specifications
- 4G Cellular Antennas:
- 2x External Dipole
- SMA fitting antenna connectors
Firewall & Content Filtering
- IP-based or User-based (IAM) Firewall Policy
- User-based Time Quota (IAM)
- DoS Attack Defence
- Spoofing Defence
- Content Filtering:
- Application Content Filter
- URL Content Filter
- Web Category Filter*
- VigorShield Threat Protection Guardian AI-assisted Security Solution compatible***
NAT Features
- NAT Port Forwarding/Redirection
- DMZ Host
- Port Trigger
- UPnP
- ALG (Application Layer Gateway): SIP, RTSP, FTP, H.323
- NAT Traversal (NAT-T)
LAN Management
- 802.1q Tag-based, Port-based VLAN
- Up to 8 LAN Subnets (NAT or Routing mode selectable per LAN interface)
- Up to 8 VLANs
- DHCP Server:
- Multiple IP Subnet
- Custom DHCP Options
- Bind-IP-to-MAC
- DHCP Relay per LAN
- Wired 802.1x Port Authentication
- Port Mirroring
- Conditional DNS Forwarding
- Hotspot Web Portal
- Hotspot Authentication: Click-Through, External Portal Server, Social Login
Networking Features
- Policy-based Routing: Protocol, IP Address, Port, Domain/Hostname
- DNS Security (DNSSEC)
- Local RADIUS server
- SMB File Sharing (Requires external USB storage)
- Routing Features: IPv4 & IPv6 Static Routing, Inter-VLAN Routing, RIP v1/v2/ng, BGP, OSPF
VPN Features
- Up to 50 active VPN tunnels
- Up to 540Mb/s IPsec
- LAN-to-LAN - Dial-In VPN Server & Dial-Out VPN Client
- Teleworker-to-LAN – Dial-In VPN Server
- IKE Authentication: Pre-Shared Key and Digital Signature (X.509)
- Encryption: DES, 3DES, AES (128/192/256)
- Authentication: SHA-256, SHA-1
- Dead Peer Detection (DPD)
- IPsec NAT-Traversal (NAT-T)
- DHCP over IPsec
- VPN Protocols:
- IPsec IKEv1, IKEv2, IKEv2 EAP
- IPsec-XAuth
- OpenVPN
- WireGuard
- EasyVPN – New!
- User Authentication:
- Local
- RADIUS
- TACACS+
- TOTP - Time-based One Time Password, compatible with Google Authenticator
Bandwidth Management
- IP-based Bandwidth Limit
- IP-based Session Limit
- QoS (Quality of Service):
- Classify via TOS, DSCP, 802.1p, IP Address, Service Type
- 4 Priority Queues
- App QoS
- VoIP Prioritization
Management
- Local Service: HTTP, HTTPS, Telnet, SSH v2, FTP, TR-069
- Config File Export & Import
- Firmware Upgrade via TFTP, HTTP, TR-069
- 2-Level Administration Privilege
- Access Control Features: Access List, Brute Force Protection
- Syslog
- SMS, E-mail Notification Alert
- SNMP: v1, v2c, v3
- Compatible with DrayTek VigorACS Management Platform**
Router-based Central Management Features
- Virtual AP Controller: Up to 20 wired VigorAP wireless access points
- Virtual Switch Controller: Up to 10 VigorSwitch network switches
Operating Requirements
- PSU Power Requirements: 100-240VAC
- Power Consumption (Watts, maximum):
- Vigor 2867-4G: 18W
- Temperature Operating: 0 °C ~ 45 °C
- Storage: -25 °C ~ 70 °C
- Humidity 10% ~ 90% (non-condensing)
- Wall or Shelf Mountable
- Rack Mountable (Optional Vigor RM1 mounting bracket required)
Physical Specifications
- Dimensions:
- 241mm Width
- 210mm Depth
- 44mm Height
- Weight
- Vigor 2867-4G: 1.158 kg
Box Contents
- Vigor 2867-4G router
- 2x External 4G/LTE Antennas
- Quick Start Guide
- RJ-11 DSL Cable
- RJ-45 Network Cable
- DC 12V Power Supply with UK Plug
Compliance & Warranty
- Standard: Two (2) Year, RTB
- Software security updates:
5 years after the EOL notification. Please note that this only applies to products sold in the UK - Optional VigorCare Extended Warranty
- VigorCare B3 3 Year Subscription: VCARE-B3
- VigorCare B5 5 Year Subscription: VCARE-B5
- ROHS
- UKCA
- CE
- PSTI
* - subscription required: Group A, URLR-A (includes free 30-day trial)
** - VigorACS subscription required
*** - VigorShield Threat Protection Guardian subscription required
