ROUTER SETUP
How to Setup GL.iNet Beryl AX (GL-MT3000) for Remote Work
Working remotely while keeping your home residential IP address is the whole point of a home IP VPN. The idea is simple: a small VPN server on your home…
✓Why the GL-MT3000 Beryl AX is the✓What you need before you start✓Step 1: Set up the home gateway
Quick Answer
The GL.iNet Beryl AX (GL-MT3000) is the travel router HomeIPVPN recommends for remote workers: Wi-Fi 6, WireGuard at up to 300 Mbps, and pocket sized. Pair it with a WireGuard server at home and every site sees your house, not the hotel.
- Performance: Wi-Fi 6, 1.3 GHz dual-core chip, 512 MB RAM: enough for 4K calls, transfers, and screen sharing.
- Portability: Deck-of-cards size, USB-C powered (5V/3A), with a 2.5G WAN port, a gigabit LAN port, and USB 3.0.
- Home side: Home server: a GL.iNet router, Raspberry Pi, or mini PC, with UDP 51820 forwarded and DDNS set.
- On the road: Join hotel WiFi as a repeater, clear the captive portal once, paste the home config, confirm the tunnel.
Working remotely while keeping your home residential IP address is the whole point of a home IP VPN. The idea is simple: a small VPN server on your home internet, and a travel router in your bag that connects back to it. Every site you visit sees your house, not the hotel. This guide walks through doing exactly that with the GL.iNet Beryl AX (GL-MT3000), the travel router we recommend most for this job.
Why the GL-MT3000 Beryl AX is the top BYOH choice
There are cheaper travel routers and there are faster ones, but the Beryl AX sits in the sweet spot for remote work. It runs Wi-Fi 6 (up to 574 Mbps on 2.4 GHz and 2402 Mbps on 5 GHz), carries a MediaTek dual-core 1.3 GHz processor with 512 MB of RAM, and pushes WireGuard at up to 300 Mbps in client mode. That is real throughput, enough for 4K video calls, large file transfers, and screen sharing at the same time.
It is genuinely pocket sized, roughly the size of a deck of cards, powered over USB-C (5V/3A), with a 2.5G WAN port, a gigabit LAN port, and a USB 3.0 port. It runs both WireGuard and OpenVPN as client and server, handles Tailscale, and works as a Wi-Fi repeater, which matters more than it sounds. When you join hotel Wi-Fi, the Beryl AX joins it for you and rebroadcasts your own private network, so your laptop never touches the hotel network directly.
What you need before you start
A complete setup has two ends. On the travel side: the Beryl AX itself. On the home side: something always on to act as your VPN server. That can be a second GL.iNet router (the Flint 2 is the usual pick for a home gateway), a Raspberry Pi, or a mini PC. You also need a home ISP connection that you can reach from the internet, which usually means either a public IP with one forwarded UDP port, or Tailscale if your ISP uses CGNAT. If any of that sounds like a lot, our complete home IP VPN setup guide covers the full architecture, and our one-time remote configuration service does the whole thing with you on a screen share.
Step 1: Set up the home gateway
Plug your home gateway router into your home ISP router and get it on the internet first. Then enable its WireGuard server. On GL.iNet firmware this is a toggle in the admin panel under the VPN section: turn on the WireGuard server, let it generate keys, and note the port it listens on (51820 by default). If your ISP gives you a dynamic IP, set up the built-in DDNS hostname now so your travel config keeps working when the IP changes.
Next, make the server reachable. If you have a public IP, forward one UDP port (51820) from your ISP router to the gateway. If your router’s WAN address sits in the 100.64.x.x range, you are behind CGNAT and port forwarding will not work; use Tailscale instead and make the home gateway an exit node. Our WireGuard server walkthrough covers both paths step by step, including the “works on home Wi-Fi but not from outside” checklist.
Step 2: Connect the Beryl AX as the travel client
Power the Beryl AX over USB-C wherever you are: hotel room, Airbnb, coworking space. In its admin panel, join the local Wi-Fi as a repeater (WISP mode). If the network has a captive portal login page, the Beryl AX can pop that page for you once, you click through on your phone, and then every device behind the router is online without each one doing the portal dance.
Then add your home server as a WireGuard client profile: paste the client config the home gateway generated, hit connect, and confirm the tunnel is up in the dashboard. From this point, connect your laptop and phone to the Beryl AX’s Wi-Fi instead of the hotel network. All of their traffic now exits through your house. Run a quick IP and DNS leak check before you open anything sensitive, and re-run it on each new network. Networks vary, so trust, then verify.
Which protocol should you use?
WireGuard is the default for most people: fastest, simplest config, lowest battery impact on the router. Keep a Tailscale setup as your CGNAT-proof fallback, and an OpenVPN or Stealth profile for hotel networks that block WireGuard’s UDP outright. If you are torn, our WireGuard vs Tailscale comparison breaks down which fits which situation.
Pro tip: Never install VPN software directly on your employer-issued laptop. Running the VPN at the hardware router level keeps 100% device isolation with zero software footprint on your work machine.
