Beryl AX setup guide: VPN and OpenWrt

Updated October 2026: GL.iNet firmware 4.9.0 and OpenWrt 25.12.5.

This Beryl AX setup guide for the GL-MT3000 covers choosing firmware, installing OpenWrt, and creating a secure Wi-Fi network with VPN access for your laptop and phone. We will configure WireGuard, DNS and a kill switch — a rule that blocks direct internet access if the VPN connection drops. We will also connect the router to hotel Wi-Fi, set up USB tethering from a phone and, optionally, configure the switch on the case to change connection modes.

This guide requires erasing the factory settings and using SSH, a secure connection to the router’s terminal. If you want VPN access with minimal manual configuration, read the firmware comparison below first.

Why use a VPN router with a hardware wallet?

A hardware wallet protects your private keys, while a VPN hides your home or hotel IP address from the servers your wallet app contacts. Wallet addresses included in those requests remain visible. You still need to check transaction details on your hardware wallet before signing and protect your seed phrase, whether or not you use a VPN.

With this connection, the hotel’s network administrator can see that you are connected to a VPN server, but cannot read the traffic inside the tunnel. Your VPN provider becomes the intermediary you trust with that traffic; HTTPS content is also encrypted between the app and the website. Our guide to VPNs and privacy explains these limits in more detail.

Your laptop and phone can use the VPN without separate VPN apps: the router counts as the connected device for the VPN service.

Beryl AX specifications and capabilities

The router needs 5 V / 3 A from a single USB-C port, so check that your power bank supports this output. Use the supplied power adapter when flashing firmware: a power interruption can disrupt installation.

GL.iNet advertises up to 300 Mbps with WireGuard and 150 Mbps with OpenVPN. These figures come from tests of the factory firmware; OpenWrt performance will depend on the software, VPN server and internet connection. Do not expect gigabit speeds over the VPN.

There is no built-in battery or cellular modem, so you need external power and an internet connection over Ethernet, Wi-Fi or a phone. To connect several wired devices, you will need an Ethernet switch, as the router has only one LAN port.

GL.iNet firmware or official OpenWrt?

The factory firmware offers a simpler control panel and ready-made travel features. According to GL.iNet’s firmware table, version 4.9.0 for the GL-MT3000 is based on OpenWrt 21.02 and MediaTek SDK components. GL.iNet supplies its updates.

This guide uses OpenWrt 25.12.5 with Linux kernel 6.12, the current stable release dated July 1, 2026. For a new installation, choose the supported 25.12 series.

After installing official OpenWrt, LuCI, OpenWrt’s web interface, replaces the GL.iNet control panel. You will need to configure the VPN and travel features again, and the GL.iNet app and cloud services will no longer work with the router. The manufacturer’s U-Boot bootloader remains in place for emergency recovery.

The factory firmware is sufficient for ordinary trips and a ready-to-use VPN client; GoodCloud can be disabled. Choose official OpenWrt if you want to manage the system and its updates yourself and are comfortable using LuCI and a terminal. If you are still choosing a device, see our comparison of GL.iNet VPN routers for home and travel.

Preparing for Beryl AX setup

You will need a computer with an Ethernet port or USB-to-Ethernet adapter, a network cable and the supplied power adapter. Configure the router over a wired connection: Wi-Fi will be disabled after installing OpenWrt.

First login to the GL.iNet control panel

Connect your computer to the LAN port, open 192.168.8.1 and set an administrator password. Skip the remaining initial settings, as they will be erased during installation.

Download two files

In the OpenWrt Firmware Selector, search for GL-MT3000 and download SYSUPGRADE for 25.12.5 or a newer stable release in the 25.12 series. An example filename is openwrt-25.12.5-mediatek-filogic-glinet_gl-mt3000-squashfs-sysupgrade.bin. You do not need the KERNEL file for this installation.

For recovery, also download a stable factory firmware image from the GL.iNet download center for the MT3000. It must be compatible with U-Boot. If separate files are offered for normal upgrades and U-Boot, save the U-Boot version.

Verify the checksum

Run the appropriate command from the folder containing the image and compare the result with the SHA256 value in Firmware Selector. The values must match exactly; if they differ, download the file again. If you chose another version, substitute its filename.

# Windows (PowerShell or cmd)
certutil -hashfile openwrt-25.12.5-mediatek-filogic-glinet_gl-mt3000-squashfs-sysupgrade.bin SHA256
 
# macOS / Linux
shasum -a 256 openwrt-25.12.5-mediatek-filogic-glinet_gl-mt3000-squashfs-sysupgrade.bin

Installing OpenWrt through the GL.iNet web interface

1. Connect the router to the supplied power adapter and your computer to the LAN port with an Ethernet cable.
2. Open 192.168.8.1 and go to SYSTEM → Upgrade → Local Upgrade.
3. Select the OpenWrt sysupgrade image you downloaded.
4. Turn off Keep Settings. The GL.iNet configuration is incompatible with official OpenWrt, so keeping it may leave the router inaccessible after installation.
5. Confirm the installation. If the panel warns that the image was not created by GL.iNet, double-check the model and file: this warning is expected for an official OpenWrt image.
6. Wait for installation to finish and the router to reboot. Do not disconnect power during these few minutes.

After the reboot, open 192.168.1.1. If your computer has not obtained a new address automatically, reconnect the cable or restart the network adapter.

If Local Upgrade rejects the image, open SYSTEM → Advanced Settings → LuCI → System → Backup / Flash Firmware → Flash new firmware image. Select the same file and uncheck Keep settings.

Initial Beryl AX setup with OpenWrt

Root password and SSH key

Open 192.168.1.1, log in as root without a password, then set one under System → Administration → Router Password. Under SSH Access, select the lan interface to restrict access to the local network.

Use the command below to log in from a terminal. For key-based login, generate a key on your computer with ssh-keygen -t ed25519 and add the contents of the .pub file on the SSH-Keys tab. Disable SSH password login only after confirming that your key works in a new terminal window.

ssh [email protected]

Under System → System, select Europe/Kyiv and check NTP time synchronization. Correct system time is needed for logs and certificate validation.

Wi-Fi

Under Network → Wireless, open Edit for each radio: 2.4 GHz and 5 GHz.

1. Set Country Code to the country where you are using the router: UA for Ukraine. This determines the permitted channels and transmit power.
2. Under General Setup, enter a network name in ESSID and select Access Point mode.
3. Under Wireless Security, select WPA2-PSK/WPA3-SAE Mixed Mode and set a password of at least 12 characters. This mode also supports devices without WPA3.
4. Click Save, enable each network with Enable, then apply the changes with Save & Apply.

Connecting to the internet without an address conflict

Connect the WAN port to a network with internet access; the default wan interface obtains an address through DHCP. LAN and WAN must use different subnets, so change the Beryl AX’s local address if your main router also uses 192.168.1.1.

1. Under Network → Interfaces → lan → Edit, set an address such as 192.168.77.1 with subnet mask 255.255.255.0, provided that subnet is free.
2. Apply the changes, reconnect your computer and open the new address, 192.168.77.1.
3. Check that wan has obtained an address and gateway. If it later conflicts with a hotel network, choose another unused local subnet in the same way.

From now on, use the router’s current address, including for SSH. The U-Boot recovery address remains 192.168.1.1.

Packages and updates

OpenWrt 25.12 uses apk instead of opkg to install packages. Run all subsequent commands on the router over SSH.

Use Attended Sysupgrade, included by default in the 25.12 series, to update the system. It builds a new image with your chosen packages. Make a backup first; the developers advise against upgrading all installed packages at once.

WireGuard: configuring the tunnel

Install WireGuard support, then obtain a configuration from one of the VPN services below.

apk update
apk add luci-proto-wireguard conntrack

luci-proto-wireguard installs WireGuard support in LuCI, while conntrack is needed for the mode-switching setup later in this guide. Reboot the router through System → Reboot.

Option A: Mullvad

In your Mullvad account, open the WireGuard configuration generator, select Linux, create a separate key for the router, choose a server and download the .conf file. Do not use this key on another device at the same time, as this can disrupt the connection.

Option B: Proton VPN

In your Proton VPN account, open Downloads → WireGuard configuration, enter a name, select Router and a server, then download the .conf file. Configurations are available even on the free plan, though server choice is limited.

Option C: your own VPS

If you already run WireGuard on a VPS — a rented virtual server — use the .conf configuration created for the router. The server must provide routing and internet access; setting it up is outside the scope of this guide. You are responsible for VPS updates, and you still need to trust the hosting provider.

Importing the configuration into LuCI

1. Open Network → Interfaces → Add new interface.
2. Name it wg0, select WireGuard VPN as the protocol, then click Create interface.
3. On the General Settings tab, click Load configuration…, paste the contents of the .conf file and confirm the import. LuCI will fill in the keys, interface address and VPN server settings on the Peers tab.
4. Under Peers, keep 0.0.0.0/0 in Allowed IPs, enable Route Allowed IPs and set Persistent Keep Alive to 25. Remove ::/0 if present: this guide configures clients for IPv4 only.
5. On the Firewall Settings tab, create a new zone named vpn.
6. Click Save, then apply the settings with Save & Apply.

Endpoint must contain the server’s IP address rather than a domain name. Otherwise, once DNS outside the VPN is blocked, the router may be unable to resolve the address needed to establish the tunnel. Check this after importing the configuration.

Kill switch: blocking traffic outside the VPN

Allow local devices to reach the internet only through vpn, so that they lose internet access when the tunnel stops.

1. Open the Zones tab under Network → Firewall.
2. For the vpn zone, set Input to reject, Output to accept and Forward to reject. Enable Masquerading and MSS clamping, and make sure Covered networks includes wg0.
3. In the lan zone, keep only vpn under Allow forward to destination zones, removing wan.
4. Apply the changes with Save & Apply. Leave Software flow offloading and Hardware flow offloading disabled during setup so that acceleration does not interfere with testing the block.

These rules restrict traffic from connected devices. The router itself can still reach the VPN server to restore the tunnel; we will restrict its DNS requests separately.

Preventing DNS leaks

DNS translates website names into IP addresses. We will send these queries through the tunnel and block the router’s ordinary DNS requests over WAN.

1. Open Network → Interfaces → wan → Edit → Advanced Settings and clear Use DNS servers advertised by peer. Repeat for wan6.
2. Under wg0 → Advanced Settings → Use custom DNS servers, enter the IPv4 DNS address from your .conf file: usually 10.64.0.1 for Mullvad or 10.2.0.1 for Proton. Remove any extra addresses.
3. Clients should obtain DNS automatically from the router. Under Network → DHCP and DNS, remove any third-party addresses from DNS forwards and apply the changes.

Add the following rule over SSH to block the router’s DNS requests over WAN on TCP/UDP port 53 while leaving the tunnel available. For this setup, the WireGuard port in Endpoint must not be 53. The script later in this guide will temporarily disable the rule in direct mode.

uci set firewall.block_wan_dns=rule
uci set firewall.block_wan_dns.name='Block-router-DNS-outside-VPN'
uci set firewall.block_wan_dns.dest='wan'
uci set firewall.block_wan_dns.proto='tcp udp'
uci set firewall.block_wan_dns.dest_port='53'
uci set firewall.block_wan_dns.family='any'
uci set firewall.block_wan_dns.target='REJECT'
uci set firewall.block_wan_dns.enabled='1'
uci commit firewall
/etc/init.d/firewall reload

If your VPN’s DNS address falls within the upstream network’s range, such as 10.0.0.0/8, add a route under Network → Routing → Static IPv4 Routes: select wg0 as the interface, set Target to the DNS address followed by /32, and leave Gateway blank.

To test the router’s settings, temporarily disable Secure DNS / DNS over HTTPS in the browser and on the device. A different DNS service in the results does not, by itself, prove that queries are leaking outside the VPN.

IPv6 in this configuration

This setup disables IPv6 internet access to prevent it from bypassing the IPv4 tunnel.

1. Under Network → Interfaces, stop wan6 with Stop and disable Bring up on boot in its settings.
2. Under lan → DHCP Server → IPv6 Settings, disable RA-Service, DHCPv6-Service and NDP-Proxy. Under Advanced Settings for lan itself, disable IPv6 assignment by clearing the prefix length, then apply the changes.
3. Reconnect client devices to refresh their settings. Local IPv6 addresses may remain, but there must be no internet access over IPv6.

Testing the connection

When checking your Beryl AX setup, leave the test device connected only through this router, with mobile data, other network connections and other VPNs disabled. Under Status → WireGuard, check that Latest Handshake is recent and the traffic counters are increasing. On ipleak.net, the IPv4 address should belong to the VPN server, with no IPv6 internet access.

On dnsleaktest.com, check that the DNS results match your chosen service. Then stop wg0 under Network → Interfaces: new websites should stop loading, while the router’s control panel remains accessible. Restore the tunnel with Restart and repeat the tests. In the WebRTC test, check public IP addresses; a local address alone does not indicate a leak.

Using the router on the road: hotel Wi-Fi and phone tethering

Connecting to hotel Wi-Fi with travelmate

Travelmate manages Wi-Fi connections while you travel and reconnects to saved networks. Install the package:

apk update
apk add luci-app-travelmate

1. Under Services → Travelmate → Interface Wizard, create trm_wwan in the wan zone. Do not add lan → wan forwarding: clients must continue to use vpn.
2. On the Wireless Stations tab, click Scan for the appropriate radio, select the hotel network, enter its password and save the settings.
3. Enable travelmate on the General Settings tab and click Save & Apply.
4. Under Network → Interfaces → trm_wwan → Advanced Settings, clear Use DNS servers advertised by peer, as you did for wan.

You can split the load between the radios by using different bands: for example, connect to the hotel on 5 GHz and your own devices on 2.4 GHz. If both connections use the same radio, they share its channel.

Opening a hotel login page with the kill switch enabled

If the hotel requires a browser login, the VPN cannot connect until you have signed in. After configuring the switch in the next section, temporarily enable direct mode and open an HTTP page, such as example.com, to trigger the login page. Sign in, then switch back to VPN mode. Leave travelmate’s own VPN management disabled so that it does not conflict with the script.

USB tethering from a phone

Install the packages for your phone:

# Android
apk add kmod-usb-net-rndis kmod-usb-net-cdc-ncm
 
# iPhone
apk add kmod-usb-net-ipheth usbmuxd libimobiledevice

1. Connect the phone to the router’s USB-A port with a data-capable cable. Enable USB tethering on Android or Personal Hotspot on iPhone.
2. Under Network → Interfaces → Devices, find the new device: usually usb0 for Android or eth1 for iPhone, though the name may differ.
3. Click Add new interface and create usbwan using DHCP client, the device from the previous step and the wan firewall zone. Under Advanced Settings, clear Use DNS servers advertised by peer.
4. For iPhone, start usbmuxd over SSH and confirm “Trust This Computer” on the phone. Add usbmuxd under System → Startup → Local Startup, before exit 0, so the service starts after a reboot.

The hardware switch: VPN or direct access

The two-position switch, identified in OpenWrt as BTN_0, can select VPN mode or temporary direct access for hotel logins. In direct mode, WireGuard is disabled and the router uses DNS servers from the upstream network. You can skip this section if you only need a permanent VPN connection without hotel logins.

Before starting, save your changes in LuCI and create a backup through System → Backup / Flash Firmware. These scripts depend on the exact interface and rule names used in this guide.

mkdir -p /etc/hotplug.d/button
echo 'logger "button $BUTTON: $ACTION"' > /etc/hotplug.d/button/00-log
logread -f

uci set firewall.lan_wan_bypass=forwarding
uci set firewall.lan_wan_bypass.src='lan'
uci set firewall.lan_wan_bypass.dest='wan'
uci set firewall.lan_wan_bypass.enabled='0'
uci set firewall.block_wan_dns.enabled='1'
uci commit firewall
/etc/init.d/firewall reload

cat > /usr/bin/vpnmode << 'EOF'
#!/bin/sh
set -eu

vpn_mode="${1:-}"
case "$vpn_mode" in
  on|boot) vpn_wg_disabled=0; vpn_bypass=0; vpn_peerdns=0; vpn_dns_block=1 ;;
  off)     vpn_wg_disabled=1; vpn_bypass=1; vpn_peerdns=1; vpn_dns_block=0 ;;
  *) echo 'usage: vpnmode on|off|boot' >&2; exit 1 ;;
esac

mkdir /tmp/vpnmode.lock 2>/dev/null || {
  logger -t vpnmode 'Mode change already in progress'
  exit 1
}
trap 'rmdir /tmp/vpnmode.lock' EXIT
trap 'exit 1' HUP INT TERM

uci set network.wg0.disabled="$vpn_wg_disabled"
uci set firewall.lan_wan_bypass.enabled="$vpn_bypass"
uci set firewall.block_wan_dns.enabled="$vpn_dns_block"
for vpn_uplink in wan wan6 trm_wwan usbwan; do
  if uci -q get "network.$vpn_uplink" >/dev/null; then
    uci set "network.$vpn_uplink.peerdns=$vpn_peerdns"
  fi
done
uci commit network
uci commit firewall

if [ "$vpn_mode" = boot ]; then
  rm -f /tmp/vpnmode-ready
  exit 0
fi

if [ "$vpn_mode" = on ]; then
  /etc/init.d/firewall reload
  conntrack -F >/dev/null 2>&1
  /etc/init.d/network reload
  ifup wg0
else
  /etc/init.d/network reload
  /etc/init.d/firewall reload
  conntrack -F >/dev/null 2>&1
fi
/etc/init.d/dnsmasq restart
touch /tmp/vpnmode-ready
logger -t vpnmode "mode $vpn_mode"
EOF
chmod +x /usr/bin/vpnmode

cat > /etc/hotplug.d/button/10-vpnmode << 'EOF'
[ "$BUTTON" = "BTN_0" ] || exit 0
[ -e /tmp/vpnmode-ready ] || exit 0
case "$ACTION" in
  pressed)  /usr/bin/vpnmode on ;;
  released) /usr/bin/vpnmode off ;;
esac
EOF

cat > /etc/init.d/vpnmode-boot << 'EOF'
#!/bin/sh /etc/rc.common
START=18

start() {
  /usr/bin/vpnmode boot
}
EOF
chmod +x /etc/init.d/vpnmode-boot
/etc/init.d/vpnmode-boot enable

/usr/bin/vpnmode on

for vpn_file in \
  /usr/bin/vpnmode \
  /etc/init.d/vpnmode-boot \
  /etc/rc.d/S18vpnmode-boot \
  /etc/hotplug.d/button/10-vpnmode \
  /etc/rc.local; do
  grep -qxF "$vpn_file" /etc/sysupgrade.conf 2>/dev/null || \
    echo "$vpn_file" >> /etc/sysupgrade.conf
done

Restoring the factory firmware

If the bootloader is working, use the U-Boot recovery web interface to restore the GL.iNet firmware or recover a router whose normal control panel will not open. Settings and installed packages will be erased.

1. Disconnect the router’s power, connect your computer to the LAN port and unplug any other network cables. Hold Reset while reconnecting power.
2. For the Beryl AX, release Reset when the indicator turns solid white after six blue flashes. Colors or sequences may vary between production batches, so also follow the change in flashing described by the manufacturer.
3. Set your computer’s Ethernet adapter to the static address 192.168.1.2, subnet mask 255.255.255.0 and gateway 192.168.1.1.
4. Open http://192.168.1.1 in Chrome or Firefox to access U-Boot.
5. Select the downloaded GL.iNet image that is compatible with U-Boot and click Update firmware. Do not disconnect power until installation and the reboot are complete.
6. Set your computer back to obtaining an IP address automatically. After recovery, the GL.iNet panel will be available at 192.168.8.1 again.

If OpenWrt boots and the problem is only in its settings, you can reset the configuration: with the router powered on, hold Reset for more than five seconds, release it and wait for a reboot. This leaves OpenWrt installed with its default configuration, no password and Wi-Fi disabled.

Beryl AX setup: common mistakes

The router does not respond after installation. Check the new address, 192.168.1.1, and reconnect the cable. If you left Keep Settings enabled and still cannot connect, use U-Boot to recover the router, then repeat the installation without keeping the old settings.

The U-Boot page will not open. Check the LAN port, your computer’s static address 192.168.1.2 and when you release Reset. Temporarily disable any VPN or proxy on your computer and try Chrome or Firefox.

There is no Wi-Fi. Connect by cable, configure wireless security and enable the networks under Network → Wireless.

WireGuard is enabled, but websites will not load. Check Latest Handshake, Route Allowed IPs, whether wg0 belongs to the vpn zone, Masquerading and MSS clamping. If IP addresses are reachable but website names are not, check DNS and its route.

The test shows a different DNS service. Check Secure DNS on the device, the DNS forwards field and whether DNS from upstream networks is disabled. The block_wan_dns rule must stay enabled in VPN mode.

The hotel login page does not appear. Temporarily switch to direct mode, sign in, then return to VPN mode.

Is OpenWrt on the Beryl AX right for you?

The Beryl AX with official OpenWrt suits users who are comfortable maintaining their own VPN and network configuration. For ordinary trips, the factory GL.iNet panel is easier to use and already includes WireGuard and travel features.

For protecting the assets themselves, see our guides to holding cryptocurrency on a hardware wallet or an exchange and common cryptocurrency scams.