GL.iNet VPN routers: choosing a model for home and travel

GL.iNet VPN routers configured with WireGuard can route an entire network’s traffic through a VPN, from your laptop and phone to the TV in a rental apartment. This is also useful for a work computer that does not allow you to install a VPN app.

We’ll compare five models for home and travel, configure the router to block internet access outside the VPN, and test whether it works when the connection drops. We’ll also cover backup power during outages, accessing your home network from abroad, and securing the router itself: a device that handles your traffic needs regular updates and careful configuration.

A VPN router vs a VPN app: what’s the difference?

A VPN app only works on devices that let you install it. A TV, game console, or e-reader may not have a suitable client, while company laptops often restrict software installation. Configuring a VPN on the router for the whole network sends all connected devices’ traffic through a single tunnel.

A router also lets you block direct internet access for the entire network if the VPN connection drops. A VPN app on your phone may have its own kill switch, but how it works depends on the app and operating system settings. On a router, you can configure the kill switch for all connected devices, including those without a VPN client.

When you travel, a portable router creates a separate network for your devices. Connecting your laptop directly to hotel Wi-Fi means using a network whose settings you do not control. In the default Router mode, GL.iNet creates its own local network, and the built-in firewall restricts connections to it from the hotel network. The hotel network usually sees the router as a single device, which is useful when the number of connections per room is limited. Keep Router mode enabled and use the Repeater section to connect the router to hotel Wi-Fi. In network bridge mode, your devices will not have the same separation from the hotel network.

When choosing a model, consider its processor performance, your internet connection speed, and the VPN server’s capacity. The manufacturer measures maximum speeds in laboratory conditions over Ethernet with the router acting as a VPN client. Results in server mode may differ, while Wi-Fi performance also depends on signal strength and congestion. An entry-level model may be enough for slow hotel internet, whereas differences between routers become more noticeable on a gigabit home connection.

What GL.iNet VPN routers can do

GL.iNet routers run the company’s firmware, built on OpenWrt, an open-source operating system for routers. You can manage them through the web interface at 192.168.8.1 or the GL.iNet mobile app. Individual features depend on the model and firmware version; we’ll cover those differences below.

WireGuard and OpenVPN

WireGuard has a small codebase and usually runs faster on low-power processors, making it a sensible first choice. OpenVPN is supported by many VPN providers and corporate networks. Compatible GL.iNet models offer OpenVPN-DCO (Data Channel Offload), which moves data channel processing into the system kernel to improve performance. For Flint 2, the manufacturer claims up to 880 Mbps with DCO, close to its WireGuard speed. DCO requires compatible firmware and suitable VPN connection settings.

A router can act as a VPN client, connecting to a provider’s service or your own server, or as a VPN server, accepting connections from outside your network. The manufacturer lists compatibility with more than 30 commercial VPN services. Some let you retrieve connection details directly in the router’s admin panel; others require you to upload a configuration file. For WireGuard, download the configuration file from your provider’s account dashboard and import it into the router. A VPN service subscription is not included with the router: you need an account with a provider or your own server.

Kill switch and VPN routing rules

Starting with firmware 4.8, GL.iNet supports multiple VPN tunnels at once and can distribute traffic between them. Tunnel Kill Switch is enabled by default for an active tunnel. If the VPN connection drops, it blocks traffic covered by that tunnel’s rules. Other devices or requests may still access the internet directly.

To make all connected devices use only the VPN, select Policy Mode in VPN Dashboard and configure an All Clients → All Targets rule to route all internet traffic from every connected device through the selected VPN tunnel. Keep that tunnel’s Kill Switch enabled and block direct access under All Other Traffic. Depending on the interface version, this means disabling All Other Traffic or Allow Non-VPN Traffic, or enabling Enhanced Kill Switch. With these settings, devices can access the internet only through the VPN. The differences between versions are explained in the GL.iNet documentation.

On firmware 4.7 and earlier, the corresponding option is called Block Non-VPN Traffic. You can enable it under Global Options in the VPN Client section of VPN Dashboard. Mango runs firmware from the 4.3 series, so this is the setting to use for that model.

Routing rules let you decide which devices or requests use the VPN and which access the internet directly. For example, you can route the whole network through the tunnel but let a TV connect directly if its streaming service blocks VPN providers’ IP addresses. Rules can be based on a device, domain, or IP address.

Encrypted DNS and AdGuard Home

DNS tells a device which IP address corresponds to a website’s domain name. Ordinary, unencrypted DNS queries sent outside the VPN may be visible to the network operator or intercepted. GL.iNet supports encrypted DNS, including DNS over HTTPS and DNS over TLS. A VPN encrypts traffic between the router and the VPN server, while DoH or DoT separately encrypt DNS queries between the device or router and the DNS server. Available DNS modes depend on the firmware.

Beryl AX, Slate 7, and Flint 2 also include AdGuard Home, which blocks advertising, tracking, and malicious domains using selected blocklists. It only affects queries processed through it and does not remove every ad from apps or video services. Opal and Mango do not support this feature. If you use domain-based VPN rules, note that AdGuard Home Handle Client Requests can make them ineffective. Check the AdGuard Home settings for this use case.

Tor, Tailscale, and ZeroTier

Tor is built into the firmware for Beryl AX, Slate 7, and Flint 2. On Opal, it can be installed as a plugin; Mango does not support it. The manufacturer warns that enabling Tor on the router prevents VPN, IPv6, AdGuard Home, and the usual DNS settings from working correctly. Although Tor hides your IP address, sites can still recognize you through your accounts, browser settings, and device fingerprint. For private browsing over Tor, use Tor Browser, which also limits browser-level tracking.

Tailscale or ZeroTier can connect your devices in a private network without manually opening inbound ports or obtaining a public IP address. They are useful for accessing a home NAS (network-attached storage) or Bitcoin node while away. Among the models covered here, Beryl AX, Slate 7, and Flint 2 support both services; Opal and Mango do not. The manufacturer advises against running them alongside VPN clients or each other because routing conflicts may occur.

Firmware 4.9 introduced the Run Exit Node switch for Tailscale, allowing a home router to serve as the internet exit point for your other devices. In Custom Exit Nodes mode, the router itself connects to an exit node on another device. Both options are covered in the GL.iNet Tailscale guide.

GL.iNet firmware and OpenWrt

Standard GL.iNet firmware uses the chip manufacturer’s SDK, a set of drivers and code for the processor. As a result, its underlying OpenWrt version may lag behind the current release: 21.02 on Beryl AX and Flint 2, 23.05 on Slate 7, and 18.06 on Opal. The company says it backports security fixes to these builds.

GL.iNet also releases alternative firmware based on OpenWrt 24.10 for Beryl AX and Flint 2. Independent builds from the OpenWrt community are available for both models as well. With these community builds, you configure the router yourself through LuCI, the standard OpenWrt web interface, rather than GL.iNet’s interface. For most users, we recommend stable GL.iNet firmware with regular updates.

GL.iNet VPN routers: which model should you choose?

Here is a comparison of five models we sell and work with. The tables show the manufacturer’s claimed maximum VPN speeds in client mode.

Wi-Fi and VPN speeds

Ports and power

Mango: a basic option for hotel stays

Mango weighs about 40 g and fits in a pocket. Its Wi-Fi works only in the 2.4 GHz band, its ports are limited to 100 Mbps, and WireGuard tops out at 45 Mbps. That may be enough for slow hotel Wi-Fi and a few devices, but the model runs firmware from the 4.3 series, lacks Tor, Tailscale, and AdGuard Home, and uses micro-USB power. We recommend Mango as a spare router or a budget option for occasional trips.

Opal: an affordable dual-band router

Opal supports the 5 GHz band, has three gigabit ports, and uses USB-C power. WireGuard speeds of up to 65 Mbps are enough for browsing, video calls, and other everyday travel needs, but the VPN will become a bottleneck on a faster connection. You can configure the physical switch on the case to turn the VPN on without opening the admin panel.

When considering Opal, keep in mind that its SiFlower platform uses OpenWrt 18.06, the oldest underlying version in this group. GL.iNet continues to support the model, but it lacks AdGuard Home, Tailscale, and ZeroTier. If you need those features, choose Beryl AX or a higher-end model.

Beryl AX: for home and travel

Beryl AX is our first recommendation if you have no specialized requirements. It offers Wi-Fi 6, a 2.5 Gbps WAN port, and USB 3.0 for a modem or phone. Its 5 V / 3 A USB-C power input and consumption of up to 8 W let you use a power bank with a suitable output. Claimed WireGuard speeds of up to 300 Mbps make it useful for travel and home connections rated at 100–300 Mbps, although actual speeds will depend on the VPN server. The model supports Tor, AdGuard Home, Tailscale, and ZeroTier.

In August 2026, CVE records were published for critical Beryl AX vulnerabilities, covered in more detail in the security section below. If the router has been unused for a long time or you bought it secondhand, update the firmware first.

Slate 7: Wi-Fi 7 and a touchscreen

Slate 7 has the highest claimed VPN speeds among the portable models in this group: up to 490 Mbps with WireGuard and up to 385 Mbps with OpenVPN-DCO. It supports Wi-Fi 7 and has two 2.5 Gbps ports plus USB 3.0. The touchscreen lets you control an already configured VPN, check network status, and display a QR code to connect a phone to the router’s Wi-Fi. Initial VPN setup takes place in the web interface.

The router uses USB-C power and supports 5 V / 3 A, 9 V / 3 A, and 12 V / 2.5 A. It consumes up to 18 W without devices connected to its USB port. For power on the go, we recommend a USB Power Delivery (PD) power bank rated at 30 W or more that supports 9 V / 3 A or 12 V / 2.5 A. Check the specifications of the port you will actually use, not just the power bank’s combined output. Slate 7 is a good choice if you use fast internet and want one router for home and travel.

Flint 2: a home VPN router

Flint 2 is designed for stationary use in an apartment or office. It offers Wi-Fi 6 AX6000, two 2.5 Gbps ports, and four gigabit ports, with claimed speeds of up to 900 Mbps for WireGuard and up to 880 Mbps for OpenVPN-DCO. It is the only model in this group of five whose claimed VPN speed approaches 1 Gbps.

Flint 2 also works well as a home WireGuard server for a portable router to connect to while you travel. The newer Wi-Fi 7 Flint 3 has a lower claimed VPN speed of 680 Mbps, so we prefer Flint 2 for VPN use.

Power outages and access to your home network from abroad

Internet access during power outages

Portable models can run from a power bank: Opal, Beryl AX, and Slate 7 use USB-C, while Mango uses micro-USB. The required voltage and current are listed in the table above. Beryl AX consumes up to 8 W without devices connected to its USB port; adding a phone or modem increases total consumption.

A 20,000 mAh power bank with cells rated at a nominal 3.7 V stores about 74 Wh of energy. If 80% of that energy is available after voltage conversion, it provides roughly seven hours of runtime for a router drawing 8 W, although actual runtime depends on the power bank, cable, and load. A connected phone or modem reduces runtime, while a lower router power draw extends it.

Flint 2 needs a source with a 12 V output and a DC5521 connector; its supplied adapter is rated at 12 V / 4 A. When choosing a UPS or DC supply to replace it, match these specifications and the connector polarity. USB-C PD with a trigger cable is another option if the specific output and cable can deliver 12 V with sufficient power. Check both components’ specifications: a “PD” label alone does not establish compatibility.

If your provider uses GPON, the optical network unit (ONU) also needs backup power. The UPS outputs must match both devices’ voltage requirements, and the UPS must be rated to power both devices at once. Ask your provider whether its own equipment works during outages: powering your home router and ONU does not, by itself, ensure internet access.

If the fiber connection stops working during an outage, you can switch to mobile internet by connecting a phone to the router’s USB port and enabling USB tethering. All five models support USB tethering, which uses the phone as a modem; compatibility also depends on the phone and its settings. On Beryl AX, Slate 7, and Flint 2, you can configure Multi-WAN → Failover to use Ethernet as the primary connection and a USB-tethered phone or another Wi-Fi network as the backup. The router switches when the primary connection fails, but the VPN may need time to reconnect. Keep the kill switch enabled during this transition too.

Using your home IP address while abroad

Banks, exchanges, and payment services may consider your country and network when checking a login. You can use your home IP address while traveling, although services may still ask for additional verification. To do this, configure a WireGuard server at home on Flint 2 or another compatible GL.iNet router, then connect the portable router to it as a client. Devices whose traffic passes through this tunnel will access the internet through your home’s Ukrainian IP address.

A direct connection to the home server requires a public IP address and an externally reachable WireGuard UDP port. With CGNAT, several subscribers share a public address, so ordinary port forwarding on your router does not provide inbound access. Ask your provider whether a public IP address is available. If the GL.iNet router sits behind another home router, forward the WireGuard port on that upstream router to the GL.iNet device.

For a public IP address that changes, use DDNS to associate a fixed domain name with it. DDNS does not bypass CGNAT. Your home and portable routers must use different local subnets, such as 192.168.8.0/24 at home and 192.168.20.0/24 while traveling. Server and client setup is described in the GL.iNet home WireGuard guide. Without a public IP address, compatible models can use Tailscale or ZeroTier; to route internet traffic through home, configure a Tailscale exit node.

Using a router for cryptocurrency activities

When you log in to an exchange or web wallet over hotel Wi-Fi, you rely on someone else’s network. HTTPS already encrypts the connection to the site and checks its certificate. A VPN additionally hides the contents of tunneled traffic and the destination server addresses from the hotel. The network operator can still see that a VPN connection exists, how long it lasts, and how much data it transfers. Never ignore a browser certificate warning, even with a VPN.

At home, it is worth separating devices used to manage funds from the rest of your equipment. On GL.iNet, you can create a guest network for smart speakers, a TV, and visitors’ devices, keeping your work laptop on the main network. With guest network isolation enabled, devices on that network cannot directly access the work laptop on the main network.

If you run a Bitcoin node at home, a WireGuard server on Flint 2 or Tailscale lets you access it while away. Keep the node’s RPC ports, which accept commands, accessible only within the private network; there is no need to expose them to the public internet.

A VPN protects the connection, but it does not check the transactions you sign. An address substituted in your clipboard, a phishing site with a valid certificate, and a malicious browser extension remain dangerous with an active tunnel. When confirming a transaction on a hardware wallet, compare the recipient address on its screen. For other details to check before signing, see our guide to Clear Signing and Blind Signing. If you use MetaMask, also read what transaction simulation shows and which risks it can miss.

Securing the router itself

GL.iNet firmware combines open-source OpenWrt with the company’s own components and the chip manufacturer’s drivers. If you prefer independent firmware, community OpenWrt builds are available for Beryl AX and Flint 2, but installation and ongoing configuration require relevant experience. If you use the manufacturer’s firmware, update it regularly and restrict access to the admin panel.

The GoodCloud service lets you manage the router remotely through GL.iNet’s servers. If you do not use GoodCloud, leave it disabled to avoid an unnecessary remote access channel.

Devices running outdated firmware need particular attention. On 3 August 2026, records were published for five critical Beryl AX vulnerabilities, from CVE-2026-18612 to CVE-2026-18616. The records list firmware versions 4.4.0–4.4.5 and a CVSS 3.1 score of 9.8 out of 10. These vulnerabilities allow arbitrary system commands to be executed through the web interface without authentication, and exploit code has been published.

These vulnerabilities can be exploited by someone with network access to the admin panel: a user on your Wi-Fi network, or someone on the internet if the panel is exposed externally. If Beryl AX is still running firmware 4.4.x, update it before connecting your devices.

Follow these rules for any model:

• Connect visitors’ devices and smart home equipment to the guest network, reserving the main network for your own work devices.
• Enable WPA3, a newer Wi-Fi security standard, if both the router and all your devices support it.
• Do not expose the admin panel to the public internet. For remote administration, use a secure connection to your home network.
• Set a long, unique admin password. It is also used for SSH access from the local network, which can provide full control of the system.

Initial router and VPN setup

Start with passwords and a firmware update, then configure the VPN and test what the router does when the tunnel drops.

1. Connect to the router by cable or over Wi-Fi using the password on its label. Open 192.168.8.1 and set a unique admin password.
2. Connect the router to the internet by cable, in repeater mode, or through a USB modem. Under SYSTEM → Upgrade, update to the latest stable firmware.
3. Change the Wi-Fi name and password and check that GoodCloud is disabled if you do not use it. Keep the default Router network mode.
4. Download a WireGuard configuration from your VPN provider’s account dashboard or generate one on your home server. Add the file under VPN → WireGuard Client → Add Manually. If your firmware uses the VPN Client Profile section, import it there with Add Manually instead.
5. On firmware 4.8 and later, select Policy Mode in VPN Dashboard and set an All Clients → All Targets rule for the imported profile. Keep the tunnel’s Kill Switch enabled and block direct access using All Other Traffic / Allow Non-VPN Traffic or Enhanced Kill Switch. On 4.7 and earlier, enable Block Non-VPN Traffic under Global Options in the VPN Client section. Then activate the tunnel.
6. Check the settings under NETWORK → DNS. For initial setup, use the DNS servers from the VPN profile and leave Allow Custom DNS to Override VPN DNS disabled. If needed, enable Override DNS Settings for All Clients so the router intercepts devices’ ordinary unencrypted DNS queries. Secure DNS in your browser is configured separately and may use a different server.
7. Check whether your VPN profile supports IPv6. If it does not, disable IPv6 under NETWORK → IPv6 to avoid leaving a separate route outside the tunnel. If it does, check the IPv6 address during testing too.
8. Test your public IP address, DNS, and kill switch using the instructions below, then repeat the checks on the other devices you will use.

How to test the VPN and traffic blocking

During testing, turn off mobile data on your phone and disable other active connections on your computer so requests pass through the router. Open ipleak.net or browserleaks.com: your public IP address should match the VPN server, including IPv6 if you use it.

Compare the detected DNS servers with your VPN and browser settings. If you use DNS from the VPN profile, the results should correspond to that service. If you configured your own encrypted DNS, the test should show the server you chose. A different provider name in the results does not, by itself, prove a leak.

Next, turn off the VPN tunnel while keeping the kill switch active: internet access should stop. Turn the tunnel back on and check that the connection returns. This tests both normal VPN operation and the blocking of direct access when it stops.

Connecting to hotel Wi-Fi with a login page

Many hotels require you to log in through a browser page, known as a captive portal, before using Wi-Fi. With the VPN and kill switch active, the page may not open because the router blocks direct network access. On firmware 4.6 and later, first try Auto-Enable Login Mode for Public Hotspots in the Repeater connection settings. This mode temporarily changes how some services and DNS work, so complete the login from one phone with all other devices disconnected.

If automatic login mode does not work or is unavailable:

1. Connect the router to hotel Wi-Fi in repeater mode.
2. In VPN Dashboard, temporarily disable the VPN client and the full block on non-VPN traffic. If the page will not open, temporarily select Automatic under NETWORK → DNS and disable DNS Rebinding Attack Protection. Also stop AdGuard Home if it is enabled.
3. Connect the phone to the router and log in on the hotel’s page.
4. Restore your previous DNS and AdGuard Home settings if you changed them, then re-enable the VPN and blocking of non-VPN traffic. Check the connection status and public IP address before connecting other devices.

If the page does not appear, turn your phone’s Wi-Fi off and back on. At hotels that tie access to a device’s MAC address, MAC cloning may help: the router uses the address of the phone you already logged in with.

What a VPN router does not protect against

A VPN encrypts traffic between the router and server, hiding its contents from the hotel and your internet provider. The VPN provider, in turn, may see the addresses of servers you connect to and other network metadata, although HTTPS content remains encrypted. When choosing a service, check its no-logs policy, under which it does not keep activity logs, as well as the scope and date of an independent audit. We discuss these criteria in more detail in our VPN guide.

Services you sign in to with your account can still identify you over a VPN. Crypto phishing, malware on your device, and recipient address substitution need separate safeguards. Use a hardware wallet to confirm transactions, a FIDO2 security key to sign in to accounts, and check transaction details before signing.

Which router to choose

For most trips, we recommend Beryl AX: it combines performance, power from a compatible power bank, and support for AdGuard Home and Tailscale. Slate 7 is a good fit if you need Wi-Fi 7, a touchscreen, and higher VPN speeds. For occasional trips on a limited budget, consider Opal or Mango, taking their limitations into account.

For a home network and a WireGuard server you can connect to while traveling, choose Flint 2. Whichever model you buy, update its firmware, block non-VPN traffic, test for leaks, and check how the router behaves when the tunnel drops.