Beginner
Private Internet with a Travel Router
Set up a GL.iNet router with WireGuard VPN. Encrypt all your traffic on public Wi-Fi — coffee shops, hotels, airports.
What You'll Need
- A GL.iNet travel router (see the table below for recommendations)
- A VPN subscription that supports WireGuard (Mullvad, ProtonVPN, IVPN, Surfshark, etc.)
- A laptop or phone for the initial setup
- USB-C cable for power (most run off a phone charger or laptop port)
💡 Why a travel router? A VPN app on your phone only protects that device. A travel router encrypts everything connected to it — laptop, phone, tablet, Kindle, smart watch — all through one VPN tunnel. And it fits in your pocket.
1 Choose Your Router
GL.iNet makes the best travel routers with built-in WireGuard support. Here's the lineup:
| Model | Price | Wi-Fi | VPN Speed | Best For |
|---|---|---|---|---|
| Slate AX (GL-AXT1800) | ~$95 | Wi-Fi 6 | ~300 Mbps | Best overall — fast, reliable, great UI |
| Beryl AX (GL-MT3000) | ~$100 | Wi-Fi 6 | ~350 Mbps | Compact + powerful, slightly faster |
| Mango (GL-MT300N-V2) | ~$30 | Wi-Fi 4 | ~25 Mbps | Ultra-portable, budget pick, tiny |
| Slate Plus (GL-A1300) | ~$60 | Wi-Fi 5 | ~120 Mbps | Mid-range, good balance of price/speed |
| Flint 2 (GL-MT6000) | ~$160 | Wi-Fi 6 | ~900 Mbps | Home use — replace your main router |
💡 Tip: For travel, the Beryl AX or Slate AX is the sweet spot. Fast enough for streaming, small enough for a backpack. The Mango is great if you just want to protect yourself at coffee shops and don't need speed.
2 Initial Router Setup
Every GL.iNet router works the same way out of the box:
- Plug the router into power via USB-C
- Connect to its Wi-Fi network — it'll be named
GL-XXXX-xxx - Open a browser and go to
192.168.8.1 - Set your admin password
- Choose your internet source:
- Repeater — connect to existing Wi-Fi (hotel, coffee shop, airport)
- Ethernet — plug in a cable if available
- Tethering — share your phone's data via USB
That's it — you now have internet through the router. But it's not encrypted yet.
⚠️ Change the default Wi-Fi name and password in the admin panel under Wireless. Use something that doesn't identify the router brand — just name it anything generic.
3 Get Your WireGuard Config
You need a WireGuard configuration file from your VPN provider. Here's how for a few popular ones:
Mullvad (recommended — no email, no account, pay with crypto):
- Go to mullvad.net → WireGuard config
- Generate a key, pick a server location
- Download the
.conffile
ProtonVPN:
- Log in → Downloads → WireGuard configuration
- Select a server, download the
.conffile
Any provider: Look for "WireGuard config" or "Manual setup" in their dashboard. You need a .conf file that looks like this:
[Interface]
PrivateKey = aBcDeFgHiJkLmNoPqRsTuVwXyZ...
Address = 10.66.0.2/32
DNS = 10.64.0.1
[Peer]
PublicKey = xYzAbCdEfGhIjKlMnOpQrStUvW...
Endpoint = 185.213.154.68:51820
AllowedIPs = 0.0.0.0/0
💡 Tip: Download configs for 2-3 different server locations (e.g. US, EU, Asia). You can load them all into the router and switch between them with one click.
4 Set Up WireGuard on the Router
This is the key step — once done, every device connecting to your router is automatically encrypted.
- In the admin panel (
192.168.8.1), go to VPN → WireGuard Client - Click Add a New WireGuard Configuration
- Click Upload and select your
.conffile - Give it a name (e.g. "Mullvad-US", "Proton-EU")
- Click Apply
- Toggle the VPN ON
The dashboard will show a green indicator when connected. Verify it's working:
# From any device connected to the router
# Visit this in a browser or run:
curl ifconfig.me
# Should show the VPN server's IP, not your real one
# Or check for DNS leaks:
# https://www.dnsleaktest.com
⚠️ Enable the VPN kill switch: In VPN settings, turn on "Block Non-VPN Traffic" (also called VPN Policy → Global Proxy). This prevents any data from leaking if the VPN connection drops.
5 Travel Workflow
Here's the actual routine when you arrive somewhere with public Wi-Fi:
- Power on the router (USB-C into a charger or laptop)
- Connect the router to the local Wi-Fi — Admin panel → Internet → Repeater → scan → pick the network → enter password
- VPN auto-connects (if you left it enabled — it remembers)
- Connect your devices to the router's Wi-Fi instead of the public one
- Done — everything is encrypted end-to-end
The whole process takes about 30 seconds once you've done it a couple times.
💡 Tip: Some hotel Wi-Fi has a captive portal (the "agree to terms" page). Connect the router first without VPN, accept the portal on your laptop, then enable VPN. GL.iNet has a built-in "Captive Portal" button that helps with this.
💡 Pair with Pi-hole: If you run Pi-hole at home, you can point your router's DNS at your home Pi-hole via the VPN. Now you get ad-blocking and encryption everywhere you go.
✅ What You've Set Up
- A pocket-sized router that encrypts all your internet traffic via WireGuard
- Every device protected automatically — no VPN app needed per device
- Multiple VPN server configs you can switch between with one click
- A kill switch to prevent any data leaking if the VPN drops
Next Steps
- Set up AdGuard Home on the router — GL.iNet routers support it natively. Go to Applications → AdGuard Home for on-device ad blocking without needing Pi-hole.
- Add a second VPN provider — load configs from two different VPNs for redundancy. If one goes down, switch to the other.
- Create a guest network — useful when traveling with others. They get internet, but can't see your devices.
- Set up Tailscale — access your home network (NAS, Pi-hole, AI OS) from anywhere through the router. GL.iNet has native Tailscale support.
⚠️ Some Wi-Fi networks block VPN ports. If WireGuard won't connect at a hotel or airport, try switching to a VPN config on port 443 (HTTPS port) — most providers offer this. In GL.iNet, you can also try the OpenVPN client as a fallback since it handles port restrictions better.