Disabling LAN ports on DrayTek Routers

It is possible to physically disable the LAN ports on some DrayTek routers, which can be used along with the Bind IP to MAC facility to increase security on a network. When a port is disabled, the port will be completely inactive and the LEDs will not light when a device is plugged into it.

When disabling ports, it's recommended to take a configuration backup from the router before proceeding - if all ports are disabled, it will not be possible to access the router locally and if there is no way to access the router remotely, then it would be necessary to factory reset the router to regain access to the router.

{tab Current Router Models}

DrayTek's current routers, including the Vigor 2865 and Vigor 2862 series feature [Panel Control], which allows the router's LAN ports, LEDs, buttons and USB ports to be disabled. This can be used to enhance security of the router and ensure it can continue to operate if tampered with, for example disabling the Factory Reset button.

Notice for Vigor 2962 and Vigor 3910 users - The Panel Control feature is unavailable on these router models.

We recommend to double check which port is to be disabled before proceeding, to check that go to the [Diagnostics] > [ARP Cache Table] and look at the Port column on the right of the table. The port that each LAN device is connected to will be listed here, there can be more than one device on each port if there's a switch or access point connected to that port.

To use the Panel Control feature, log in to the router's web interface and go to [System Maintenance] > [Panel Control]. From there, click on the LAN Ports tab to control LAN port operation:

To disable a port, uncheck the Enable tickbox for that port. The router will display a warning immediately when unchecking any LAN port, to confirm the operation:

Click OK for the message box and the LAN port checkbox will now be unchecked. To apply the change, click OK on the Panel Control menu:

Wait a few seconds for the router to apply the change, then the LAN port will show "---" as its status to indicate that it's disabled, instead of "Link Up" / "Link Down".

To re-enable the LAN port, simply re-tick the tickbox and click OK.

{tab Legacy Routers - Vigor 2860 & 2830}

This feature was added from firmware version 3.6.8 on the Vigor 2830 and 3.7.8 on the Vigor 2860.

Applicable Router Models
Vigor 2760	Vigor 2830	Vigor 2850
Vigor 2860	Vigor 2920	Vigor 2925

---

Disabling LAN ports on the router can be performed through the router's command line interface with this procedure. Replace 192.168.1.1 with your own router's IP address if you have changed it:

1. On Windows go to the Start menu, select Run and on there type "cmd" and click OK,  or  if  the  Run  option is not present, type "cmd" in the "Start Search" textbox above the Start button and press enter.  Make sure that telnet is enabled in Windows, check this guide if it isn't available. Other operating systems also have an equivalent telnet program or app.
2. Type "telnet 192.168.1.1"
3. Enter the username of "admin", press enter, then enter the password for the router.
4. Enter "port status" to check the current state of the ports and note which ports will be disabled:
   
   

   > port status
   % port 1 : link UP  , speed= 1000 Mbps, duplex= FULL, FlowControl= ON
   % port 2 : link UP  , speed= 1000 Mbps, duplex= FULL, FlowControl= ON
   % port 3 : link DOWN, speed= ---- Mbps, duplex= ----, FlowControl= --
   % port 4 : link DOWN, speed= ---- Mbps, duplex= ----, FlowControl= --
   % port 5 : link DOWN, speed= ---- Mbps, duplex= ----, FlowControl= --
   % port 6 : link DOWN, speed= ---- Mbps, duplex= ----, FlowControl= --
   % WAN2   : link DOWN, speed= ---- Mbps, duplex= ----, FlowControl= --

5. To disable a port, type "port disable 3" to disable port 3 for instance, the port will then be inactive until re-enabled.
   
   

   > port disable 3
   Disable lan port [3] successfully.

6. Check the status of the port by entering "port status", which will then show that the port is disabled:
   
   

   > port status
   % port 1 : link UP  , speed= 1000 Mbps, duplex= FULL, FlowControl= ON
   % port 2 : link UP  , speed= 1000 Mbps, duplex= FULL, FlowControl= ON
   % port 3 : <Disabled>
   % port 4 : link DOWN, speed= ---- Mbps, duplex= ----, FlowControl= --
   % port 5 : link DOWN, speed= ---- Mbps, duplex= ----, FlowControl= --
   % port 6 : link DOWN, speed= ---- Mbps, duplex= ----, FlowControl= --
   % WAN2   : link DOWN, speed= ---- Mbps, duplex= ----, FlowControl= --

7. To re-enable a port, type "port enable 3" which will then allow the port to operate.
   
   

   > port enable 3
   Enable lan port [3] successfully.

{/tabs}

---