Draytek VIGOR2925 SERIES User Manual page 289

Enable Strict Security
Firewall
Block routing packet
from WAN
priority, you cannot enable "Accept large incoming
fragmented UDP or ICMP Packets".
For the sake of security, the router will execute strict
security checking for data transmission.
Such feature is enabled in default. All the packets, while
transmitting through Vigor router, will be filtered by
firewall. If the firewall system (e.g., content filter server)
does not make any response (pass or block) for these
packets, then the router's firewall will block the packets
directly.
Usually, IPv6 network sessions/traffic from WAN to LAN
will be accepted by IPv6 firewall in default.
IPv6 - To prevent remote client accessing into the PCs on
LAN, check the box to make the packets (routed from WAN
to LAN) via IPv6 being blocked by such router. It is
effective only for the packets routed but not for packets
translated by NAT.
IPv4 - To prevent remote client accessing into the PCs on
LAN, check the box to make the incoming packets via IPv4
being blocked by such router. It is effective only for the
packets routed but not for packets translated by NAT.
273
Vigor2925 Series User's Guide