WireGuard VPN Setup

First check if you can use bare WireGuard method: https://icanhazvpn.com

How?

You will use your own travel router between your personal/work device and the local Airbnb/hotel’s internet router. On the travel router, you will use WireGuard as well as on the VPN server at home to host the server.

WireGuard Method

What to Buy

A self-hosted travel VPN normally uses two routers: one that remains on your home internet connection and runs the WireGuard server, plus a second router that travels with you and connects back to it as the WireGuard client.

For most people who want to keep their existing home router, the best-balanced pairing is a Brume 3 (when available) or Beryl AX at home and a Slate AX for travel. Your home internet upload speed is often the real bottleneck, so buying the fastest router will not necessarily make the VPN faster. Routine remote work commonly needs only a fraction of the 300 Mbps supported by the entry-level recommendations.

Home VPN server routers

These stay connected at home and are listed from the least expensive to the most capable.

Brume 2 (GL-MT2500A): A small, economical WireGuard gateway with no built-in Wi-Fi. Its low power use and minimal footprint also make it a practical backup server to leave with a trusted friend or relative. Rated for WireGuard speeds up to 355 Mbps.
Beryl AX (GL-MT3000): A compact Wi-Fi 6 router that can serve either role. It includes one LAN port and supports WireGuard speeds up to 300 Mbps, making it a flexible choice when you may later reuse the device for travel.
Brume 3 (GL-MT5000): The newer high-throughput version of GL.iNet's compact, Wi-Fi-free security gateway. It is rated for WireGuard up to 1,100 Mbps and OpenVPN-DCO up to 1,000 Mbps.
Flint 2 (GL-MT6000): A full-size Wi-Fi 6 home router for people who want to replace a compatible ISP router, improve home wireless coverage, or support several VPN users. Its six Ethernet ports support flexible dual-WAN/LAN layouts, and WireGuard is rated up to 900 Mbps.

Travel VPN client routers

These accompany you and connect your laptop and other devices to the WireGuard server at home.

Beryl AX (GL-MT3000): The lower-cost high-performance option. It provides Wi-Fi 6, one LAN port for a wired device, and WireGuard client speeds up to 300 Mbps in a small package.
Slate AX (GL-AXT1800): Slightly larger, with two LAN ports and WireGuard client speeds up to 550 Mbps. It is also the more convenient choice when you regularly encounter EAP networks in offices or coworking spaces.
Beryl 7 (GL-MT3600BE): A compact Wi-Fi 7 model with one LAN port, WireGuard speeds up to 1,100 Mbps, and OpenVPN-DCO up to 1,000 Mbps.
Slate 7 (GL-BE3600): A Wi-Fi 7 travel router with one LAN port, a built-in display, EAP compatibility, and WireGuard client speeds up to 540 Mbps.
Optional laptop adapter: Thunderbolt to Ethernet or USB-C to Ethernet, if your laptop lacks an Ethernet port.

Speeds above are manufacturer-rated maximums. Real performance depends on both internet connections, protocol settings, distance, congestion, and the devices connected to the router. As an Amazon Associate, The Wired Nomad may earn from qualifying purchases.

Instruction Links:

WireGuard GL.iNet Server/Client Setup Tutorial (Video)
WireGuard GL.iNet Server/Client Setup Tutorial (Written)

Recommended DNS Settings

For the server router, DNS settings can really be anything you like. I personally recommend setting the DNS to Manual and using Cloudflare + Google. The only reasons for this are distrust of ISP DNS and generally better performance from Cloudflare. If for some reason Cloudflare DNS servers are far away from you, then it may be best to keep your ISP's DNS (Mode: Automatic). You can always compare ping times of DNS servers using the "ping" command in your command prompt while connected to your home internet.

You will also need to enable "Remote Access LAN" in the Global Options of the server router on the VPN Dashboard page.

Example VPN Server Page (your Tunnel Address may be different)

For the client GL.iNet travel router, you should use your Wireguard server’s IP address in the profile config. To edit the profile config, go to Wireguard Client and edit the “DNS = ” line to equal your server IP (ex. 10.0.0.1).

Then, set the DNS mode to “Automatic”. This uses the DNS servers configured on your Wireguard server and ensures your server router’s DNS cache is checked before sending the DNS requests to whatever server you chose.

A regular WireGuard server may be blocked or unavailable when a home network is behind CGNAT. Tailscale or AstroWarp are alternatives.