Protect Router's Management Interface by Port Knocking

Port knocking is a technology that enhances router security by adding an extra layer of protection. The core concept is that only open ports are vulnerable to attacks. To mitigate this, all ports are kept closed by default, and access is controlled using a "password" based on a specific sequence of port interactions. Only users who know the correct sequence can open the ports and establish a connection.

Vigor Router supports Port Knocking with TOTP for its Local Services. The supported models are:

Below are the configuration steps for using the Port Knocking feature on Vigor Router.

1. Download the DrayTek Port Knocking Tool and execute it on the client’s computer.

2. Login the router’s Web interface.

3. Navigate to System Maintenance >> Time and Date. Ensure the router gets the correct system time. If the time is not updated correctly.

4. Navigate to System Maintenance >> Management, and select Enable port knocking protection at the Port Knocking for Local Service area.

5. The details of the Port Knocking configurations will be displayed.

a. Select the Local Services which require the Port Knocking protection.

b. Configure the 1st Knock Port.

c. Scan the QR code using the Google Authenticator app installed on your phone, or copy the TOTP key. Then, paste the TOTP key into the DrayTek Port Knocking Tool. In this configuration example, we are using the DrayTek Port Knocking Tool.

d. Enter the Profile Name, the first knocking port, and paste the TOTP Key into the DrayTek Port Knocking Tool. A 6-digit code will be generated. Click Copy to copy the code.

e. Paste the 6-digit code from the tool to the Validation Code field on the router, then click Verify.

f. Once the message “Verify success.” appears, click OK to save the configuration.

The Port Knocking setup on the Vigor Router is now complete.

6. Try to connect to the router’s management interface using its WAN IP through the connection method you enabled. The connection will not be established because the service port is closed.

7. Continue the configuration on the PortKnocking Tool.

a. Enter the router’s WAN IP or Domain Name

b. Select More Settings. Enter the server’s Public Port and Protocol you want to access.

c. Click Knock Ports. The tool will knock the router’s ports by sequence.

8. Click the Status link to browse the router’s web interface. You are able to see the Web Login page of the router now.