Seb's Draytek VPN Auditor

This tool expects the Draytek quoted-CSV dial-in user export: a header line starting NumberOfCfg:..., followed by one line per user slot (the first line prefixed begin), each a sequence of "-delimited fields, terminated by a line reading endofdialincfg!.

Fields confirmed against real exports include: Enable, Idle Timeout, Multiple Concurrent, dial-in types (PPTP/IPsec/SSL/OpenVPN/WireGuard), the L2TP policy dropdown, all four IPsec Security Method ciphers (Medium AH, DES, 3DES, AES), Subnet, Static IP, Specify Remote Node IP, Username, Password (obfuscated), mOTP PIN/secret, TOTP secret (2FA status is derived from whether this is present), and the WireGuard key block (public key, pre-shared key, keepalive, and a private key field that's only present once WireGuard has actually been configured with real keys - this is also why row length varies between 49 and 50 fields). A handful of low-impact numeric flags remain unconfirmed and are preserved untouched on export rather than guessed at.

Slot count varies by router model - smaller models export fewer than 500 rows. The tool reads whatever count is in the file's header line and works with that, so this isn't something to worry about.

Password handling: Draytek stores passwords with a simple reversible +13 byte offset, not real encryption. This tool decodes them for display behind the reveal toggle, but never shows plaintext in the audit panel, diff view or export preview by default.

2FA: clicking the TOTP badge on a row shows a live, auto-refreshing 6-digit code and a scannable QR code, generated entirely in your browser from the stored secret using a standard RFC 6238 implementation - nothing is sent anywhere. Bulk edit can flag accounts as needing 2FA set up, but deliberately never fabricates a secret, since a made-up one wouldn't match anything in an authenticator app and would lock the account out.

This tool expects a Draytek LAN-to-LAN (site-to-site) VPN configuration export: a flags line, a header line starting NumberOfCfg:..., followed by one comma-delimited row per profile slot, then remotemore: and virtualmap: blocks, then password/PSK arrays, terminated by a line reading endoflan2lanfile!.

This view is read-only. Fields confirmed so far include: Enable, Profile Name, Call Direction, Idle Timeout, Remote Gateway IP, Local/Remote Network and Subnet Mask, and all four IPsec Security Method ciphers (AH, ESP-DES, ESP-3DES, ESP-AES) for Dial-In and Both profiles. A number of fields - including routing mode settings and a couple of low-impact numeric flags - are not yet confirmed and are simply not shown, rather than displayed with guessed meaning.

Password/PSK handling: uses the same reversible +13 byte offset as the Remote Dial-in User file. Decoded for display behind the reveal toggle only.

Coming soon: additional remote subnets per profile (the GUI's "More Remote Subnet" option - the file's remotemore/virtualmap blocks likely hold this but aren't mapped yet), VPN Server Type for Dial-Out profiles (PPTP/IPsec/L2TP/SSL/OpenVPN/WireGuard), and a combined weak-cipher summary across both the Dial-in and LAN-to-LAN tabs.