A travel router earns its place in your bag for one reason: it runs your VPN so every device behind it lands on your home network the moment you connect to a hotel, cafe, or conference Wi-Fi. The laptop, the phone, the work tablet, all of them ride an encrypted tunnel you control, and none of them ever touch the untrusted network directly. That is the job. Fast Wi-Fi on the box is a nice bonus, but the thing you are actually buying is a small, portable VPN endpoint that speaks both WireGuard and Tailscale without you having to configure each device.
GL.iNet owns this niche because its OpenWrt-based firmware ships WireGuard, OpenVPN, and a one-toggle Tailscale client built in, so the same box works as a VPN client on the road and a VPN server at home. Two things reshaped the 2026 lineup and the buying decision with it. Wi-Fi 7 arrived on the travel line (the Slate 7 and the Flint 3), which split the range into mature, heavily discounted Wi-Fi 6 boxes and pricier Wi-Fi 7 boxes. And native Tailscale is now a firmware feature across the range, which quietly turns any of these routers into a pocket-sized mesh exit node you carry with you. Every spec and price band below was checked against GL.iNet’s official product pages and live Amazon listings in July 2026; the WireGuard and OpenVPN numbers are GL.iNet’s own published lab figures, and we call that out rather than passing them off as our own bench runs.
Top picks at a glance
If you only want the short answer, here is where each box wins. The full reasoning, specs, and the honest trade-off for each one follow below.
- Best overall (home and VPN): GL.iNet Flint 2 (GL-MT6000). The one most people should buy. WireGuard up to 900 Mbps, dual 2.5G ports, and it doubles as a capable home router. Check the price on Amazon.
- Best travel router for most people: GL.iNet Beryl AX (GL-MT3000). Pocket-sized, a 2.5G WAN port, and the price band that makes it an easy carry. Check the price on Amazon.
- Best Wi-Fi 7 travel router: GL.iNet Slate 7 (GL-BE3600). Wi-Fi 7, dual 2.5G, and a touchscreen, for the bag that has to be current. Check the price on Amazon.
- Best always-on VPN gateway: GL.iNet Brume 2 (GL-MT2500A). No Wi-Fi, just a tiny wired box that sits at home as a Tailscale exit node or WireGuard server. Check the price on Amazon.
How we picked
This is a spec-and-firmware guide, and we want to be straight about that. We did not run every one of these routers on a bench and record throughput; instead each pick was verified three ways: against GL.iNet’s official product page and datasheet for the hardware, against the live Amazon listing to confirm the model, price band, and that it is actually buyable, and against independent reviews and price history. The VPN throughput figures you see are GL.iNet’s published maximums measured on a local link, which is the fairest apples-to-apples comparison across the range, but real-world speed drops when the box acts as a server rather than a client and when the remote link is the bottleneck.
Where we can add something the spec sheet does not: all of these run OpenWrt under GL.iNet’s UI, so the VPN stack is the real Linux one. WireGuard is a kernel module, OpenVPN uses data-channel offload (DCO) on the newer boxes to spread crypto across cores, and Tailscale is the official client toggled from the admin panel. If you already know how to set up a WireGuard server on a Linux host or install the Tailscale client on a Linux box, none of the router-side setup will surprise you. The trade-off between the boxes is almost entirely CPU headroom for encryption versus size, price, and Wi-Fi generation.
GL.iNet travel and VPN routers compared
The table lines up the whole shortlist on the specs that actually change the decision. The WireGuard and OpenVPN columns are GL.iNet’s published figures.
| Model | Best for | Wi-Fi | WireGuard | OpenVPN | Ethernet | Price band |
|---|---|---|---|---|---|---|
| Flint 2 (GL-MT6000) | Home + VPN, overall | Wi-Fi 6 | 900 Mbps | 880 Mbps | 2x 2.5G + 4x 1G | ~$110 to $170 |
| Flint 3 (GL-BE9300) | Wi-Fi 7 home flagship | Wi-Fi 7 | 680 Mbps | 680 Mbps | 5x 2.5G | ~$200 to $210 |
| Beryl AX (GL-MT3000) | Travel, most people | Wi-Fi 6 | 300 Mbps | 150 Mbps | 1x 2.5G + 1x 1G | ~$70 to $99 |
| Slate AX (GL-AXT1800) | Travel, VPN throughput | Wi-Fi 6 | 550 Mbps | 560 Mbps | 3x 1G | ~$100 to $120 |
| Slate 7 (GL-BE3600) | Wi-Fi 7 travel | Wi-Fi 7 | 490 Mbps | 100 Mbps | 2x 2.5G | ~$120 to $150 |
| Brume 2 (GL-MT2500A) | Headless VPN gateway | None (wired) | 355 Mbps | 150 Mbps | 1x 2.5G + 1x 1G | ~$80 to $90 |
1. GL.iNet Flint 2 (GL-MT6000): best overall
The Flint 2 is the router we would hand to most people asking this question, even though it is a home router rather than a pocket box. The reasoning is throughput headroom: a quad-core MediaTek at 2 GHz with 1 GB of RAM pushes WireGuard to a published 900 Mbps and OpenVPN to 880 Mbps with data-channel offload, which means the VPN is no longer the thing throttling your gigabit line. Dual 2.5G ports and four gigabit LAN ports let it anchor a home network, and when you travel you pack the small box and leave the Flint 2 running at home as the WireGuard server your travel router dials into.
Who it’s for: anyone who wants one box to run the home network and terminate VPN traffic at full line speed, and who is happy to pair it with a smaller router for the actual travel.
Skip it if: you need something pocket-sized for the bag, or you specifically want Wi-Fi 7. The Flint 2 is Wi-Fi 6, and the newer Flint 3 covers the Wi-Fi 7 case at a higher price.
Check the current price on Amazon.
2. GL.iNet Beryl AX (GL-MT3000): best travel router for most people
The Beryl AX is the pocket router that gets the balance of size, price, and capability right, and it is the one we would actually throw in a bag. It is a dual-core box, so WireGuard tops out around 300 Mbps rather than the numbers the bigger routers post, but that ceiling comfortably exceeds the real bandwidth of nearly every hotel, cafe, or cruise-ship link you will ever tunnel over. The detail that matters more than the headline speed is the 2.5G WAN port: plug it into a fast wired drop or a fibre ONT in a rental and the uplink is no longer capped at gigabit.
Who it’s for: the traveller who wants one small box that connects to any hotel or public Wi-Fi, brings up the WireGuard or Tailscale tunnel automatically, and puts every device on a private network they trust.
Skip it if: you routinely need to saturate a home fibre line through the VPN. The 300 Mbps WireGuard ceiling is generous for travel but not the fastest small box here; the Slate AX trades the 2.5G port for more crypto headroom.
Check the current price on Amazon.
3. GL.iNet Slate 7 (GL-BE3600): best Wi-Fi 7 travel router
The Slate 7 is the travel box for people who want their kit to be current: it is dual-band Wi-Fi 7, carries two 2.5G ports in a pocket chassis, and adds a small touchscreen that shows connection state and a QR code for the guest network. In practice the Wi-Fi 7 support matters less on the road (public Wi-Fi is the bottleneck, not your radio) than the 2.5G ports and the newer platform do. WireGuard runs to a published 490 Mbps, which sits between the Beryl AX and the Slate AX.
Who it’s for: the traveller who wants the newest platform, dual 2.5G ports, and the touchscreen convenience, and who values Wi-Fi 7 client support for when they get home.
Skip it if: you lean on OpenVPN, because it tops out around 100 Mbps on this box (use WireGuard here). If VPN speed is the priority over Wi-Fi generation, the older Slate AX is faster on both protocols and often cheaper.
Check the current price on Amazon.
4. GL.iNet Slate AX (GL-AXT1800): best small router for VPN throughput
The Slate AX is the older Wi-Fi 6 travel router, and it earns a spot precisely because its quad-core Qualcomm IPQ6000 gives it the most VPN headroom in the small class: a published 550 Mbps on WireGuard and 560 Mbps on OpenVPN with offload, both higher than the newer Slate 7. The compromise is that it stays on gigabit Ethernet (three ports, one WAN and two LAN) with no 2.5G, and Wi-Fi 6 rather than 7. For a lot of Linux users who mostly care about the tunnel and rarely see a multi-gig uplink in a hotel, that is the right compromise.
Who it’s for: the traveller who wants the fastest VPN in a pocket box and does not care about 2.5G ports or Wi-Fi 7, and who often finds it on sale below the newer models.
Skip it if: you want a multi-gig WAN port or Wi-Fi 7. The Beryl AX gives you the 2.5G WAN for less, and the Slate 7 gives you Wi-Fi 7, both at the cost of some crypto throughput.
Check the current price on Amazon.
5. GL.iNet Brume 2 (GL-MT2500A): best always-on VPN gateway
The Brume 2 is the odd one out, and on purpose: it has no Wi-Fi at all. It is a tiny fanless wired box built to sit at home and be the always-on end of your setup, a WireGuard or OpenVPN server, a Tailscale exit node, or a site-to-site gateway between two locations. This is the piece that ties a travel setup together. Leave the Brume 2 running behind your home router, dial into it from the Beryl AX in a hotel, and your traffic egresses from home. The ASIN linked here is the aluminium-cased GL-MT2500A; a cheaper plastic GL-MT2500 exists under a separate listing with the same internals.
Who it’s for: the homelabber who wants a low-power, always-on VPN endpoint at home to pair with a travel router, or who runs it as a Tailscale subnet router in front of the LAN. If you would rather virtualise it, you can also run OpenWrt in a Proxmox VM or put Tailscale in a Proxmox container instead of buying the hardware.
Skip it if: you need Wi-Fi. This box has none by design; it wires into an existing access point or router. If you want the gateway and the Wi-Fi in one unit, the Flint 2 is the better buy.
Check the current price on Amazon.
6. GL.iNet Flint 3 (GL-BE9300): best Wi-Fi 7 home flagship
The Flint 3 is the top of the range and the box that stays current the longest: tri-band Wi-Fi 7, a quad-core Qualcomm, and five 2.5G Ethernet ports, which is genuinely unusual at this price and turns it into a small multi-gig switch as well as a router. One counterintuitive detail worth knowing before you spend the extra money: its published WireGuard throughput is 680 Mbps, lower than the cheaper Flint 2’s 900 Mbps, because the crypto path on the two platforms differs. You buy the Flint 3 for Wi-Fi 7 and the five multi-gig ports, not for a faster tunnel.
Who it’s for: the reader building out a Wi-Fi 7 home network who wants multi-gig ports and a strong VPN in the same box, and who has the Wi-Fi 7 clients and the internet plan to use them.
Skip it if: your internet is gigabit or slower and your devices are Wi-Fi 6, because the cheaper Flint 2 will actually push your VPN faster. This is a spend-up for radios and ports, not tunnel speed.
Check the current price on Amazon.
What to look for in a VPN travel router
If none of the picks above is an obvious fit, these are the specs that decide it, roughly in the order they matter for a VPN-first router.
WireGuard throughput, and the server-versus-client catch
WireGuard is the protocol to plan around. It is faster and lighter than OpenVPN on the same CPU, and every box here posts a higher WireGuard number. The catch that trips people up: the published figures are the router acting as a client on a local link. When the router is the server that others dial into, or when the far end is a slow hotel uplink, real throughput is lower. In practice this means you size for the tunnel you will actually use, not the headline. For pure travel, anything above about 200 Mbps is more than the venue Wi-Fi will feed it.
Native Tailscale, not just WireGuard
Every router in this guide exposes Tailscale as a toggle in the admin panel (a firmware feature since version 4.2; only GL.iNet’s oldest low-memory boxes lack it), so the router joins your tailnet and you can reach its LAN from anywhere without opening a port. That reframes the travel router into a mesh device: the box in your bag and the box at home are two nodes on the same private network, and one can be the exit node for the other. If you have not used it before, our guide to the Tailscale client on Linux covers the concepts that carry straight over to the router UI. WireGuard remains the choice when you want a fixed, self-hosted tunnel with no third-party coordination; the two are complementary, not either-or.
2.5G ports and Wi-Fi generation
A 2.5G WAN port only helps if your uplink is faster than gigabit, which on the road is rare but at home is increasingly common. For a travel-only box it is a nice-to-have; for a home router it is worth paying for. Wi-Fi 7 is the same story inverted: it does little for you against public Wi-Fi, so on a travel router treat it as headroom for later rather than a reason to spend up. On a home flagship like the Flint 3 it earns its keep. If access-point coverage is the real problem you are solving at home, that is a different purchase, and our roundup of Wi-Fi 7 access points is the better starting point than a router.
AdGuard Home and the OpenWrt base
Every model here ships AdGuard Home in the firmware, so network-wide DNS filtering runs on the router with no extra hardware, which is genuinely useful on a travel box that a whole family connects through. Because the base is OpenWrt, you also keep an escape hatch: SSH access, the LuCI interface, and the ability to install packages that the GL.iNet UI does not expose. It is the same platform you would run if you chose to build an OpenWrt router in a VM, which is why the skills transfer both ways. If you would rather self-host the server side entirely, an OpenVPN server on a Linux host is the classic alternative to letting the router be the endpoint.
Which one is actually worth your money
The cost angle sorts this cleanly. If you buy one box, buy the Beryl AX: it is the cheapest way to put every device behind a VPN on any network you connect to, and its 300 Mbps WireGuard ceiling outruns the hotel Wi-Fi that will ever feed it. If you want one box to also run the home network at full VPN line speed, the Flint 2 is the better value than the Wi-Fi 7 Flint 3 unless you already have multi-gig internet and Wi-Fi 7 clients to justify the premium. The two-box setup is where this range shines: a Brume 2 or Flint 2 living at home as the always-on server, and a Beryl AX or Slate 7 in the bag as the client, both stitched together over Tailscale so you never open a port. That pairing costs less than a single mid-range mesh system and gives you a private network that follows you. If you are kitting out the same rack, the box you pair with this is often an IP-KVM for out-of-band access to the machine the gateway runs on.
