DrayTek Vigor WireGuard Remote Access: Browser RDP and SSH to Your Whole LAN

DrayTek Vigor routers sit in front of a large share of the small and mid-size business networks European MSPs manage: the Vigor 2865, 2927, 2962, and 3910 are everywhere in offices, clinics, retail units, and branch sites. Since firmware 4.x, DrayTek ships native WireGuard support, which turns any modern Vigor into a clean ProxyLink tunnel host. One outbound WireGuard peer on the router covers every device on the LAN and every VLAN behind it, with nothing installed on the machines you actually need to reach.

The reason this matters: most branch sites run on whatever broadband or LTE line was cheapest to install, with a dynamic IP and, increasingly, carrier-grade NAT (CGNAT). There is no static address to point a tool at and no port to forward. Because a ProxyLink tunnel dials outbound and holds itself open with a keepalive, none of that is relevant. The Vigor never accepts an inbound connection, so a scan of the site's ISP range finds nothing to connect to.

Before You Start

Confirm the router runs a firmware release that includes WireGuard. On current Vigor models the feature lives under VPN and Remote Access in the web UI. If you do not see a WireGuard option, update the firmware first. You will also want the site's LAN subnet to hand (the DrayTek default is 192.168.1.0/24) and a list of any extra VLANs the router serves.

Getting the Config from ProxyLink

In ProxyLink, create a new tunnel for the site and set the LAN subnet to match the router. ProxyLink assigns the Vigor a peer address in the 10.100.0.0/16 range and shows you the relay public key and endpoint. The values you need from the generated config are:

Address    = 10.100.0.X/16
PublicKey  = <proxylink-server-public-key>
Endpoint   = 46.225.153.241:51820
AllowedIPs = 10.100.0.0/16
PersistentKeepalive = 25

AllowedIPs = 10.100.0.0/16 sends only ProxyLink tunnel traffic through the VPN, so the site's normal internet traffic still exits through the WAN. PersistentKeepalive = 25 is not optional: it keeps the NAT mapping alive and re-initiates the handshake after a reboot or an ISP reconnect.

Configuring WireGuard on the Vigor

Open VPN and Remote Access and go to the WireGuard section. The Vigor generates its own key pair for the local WireGuard interface; you do not paste ProxyLink's private key here. Instead, take the router's own public key that the Vigor shows you and enter it back into the ProxyLink tunnel as the peer key, so the two ends agree on keys. Then set the router's tunnel interface address to the assigned 10.100.0.X/16.

Now add a peer profile pointing at the relay:

Peer Public Key: the ProxyLink relay public key from the config.
Remote Endpoint: 46.225.153.241, port 51820.
Allowed IPs: 10.100.0.0/16.
Persistent Keepalive: 25.

Enable the profile and apply. The Vigor dials outbound to the relay and the tunnel forms within a few seconds.

Routing the LAN Through the Tunnel

A formed tunnel is not the same as a reachable LAN. The Vigor needs to route and forward traffic between the WireGuard interface and your local subnets. Make sure the site's LAN subnet, and each additional VLAN, is permitted to pass to and from the tunnel. On tightly filtered Vigor setups, confirm the firewall does not drop traffic sourced from the 10.100.0.0/16 relay range toward the LAN.

Multi-VLAN Sites

You do not need a second tunnel for a segmented network. Declare each extra subnet in ProxyLink under Additional Subnets, and every declared subnet becomes reachable through the same peer. A site with a main LAN on 192.168.1.0/24, a voice VLAN on 192.168.10.0/24, and a camera VLAN on 192.168.20.0/24 uses one Vigor and one ProxyLink tunnel. Keep the peer's Allowed IPs at the relay range only.

What Engineers Access

Once the tunnel is up, create a proxy link for each device and service:

Windows PCs and servers (port 3389): browser RDP, no mstsc.exe or VPN client on the engineer's laptop.
Linux and the router itself (port 22): browser SSH terminal, with session recording on paid plans.
NVRs and IP cameras (port 80 or 443): HTTP or HTTPS proxy link to the web UI, no port forwarding.
PBX panels and managed switches: HTTP proxy to the web interface, or SSH for CLI changes.

Every session is logged with engineer identity, target IP and port, start time, and duration. The site keeps zero open inbound ports, and access requires a ProxyLink login with two-factor authentication. The relay runs on EU infrastructure in Germany with no third-party remote-access network in the path.

Verifying the Tunnel

Check the WireGuard status page on the Vigor. A healthy tunnel shows a recent handshake and a non-zero received-bytes count. If the handshake never completes, confirm outbound UDP 51820 is not blocked upstream, check the ProxyLink relay public key was pasted exactly, and confirm the keepalive is set to 25.

Try ProxyLink free at app.proxylink.dev, no card required, free during early access. A DrayTek site takes about 10 minutes to configure. Setup guides for MikroTik, pfSense, OPNsense, OpenWRT, and EdgeRouter are in the docs.