Before you start: The methods in this guide are for educational purposes only. You are solely responsible for understanding your employment agreement and the risks associated with working remotely from unapproved locations. HomeLink is not responsible for termination of employment, legal issues, or tax liabilities that result from your decisions.
Phase 0
How It Works — The Architecture
Before touching any hardware, understand what you're building. The goal is a permanent encrypted tunnel between your travel location and your home network, so all your internet traffic exits through your home IP address.
Your Devices
Laptop, phone, tablet
WiFi / Ethernet
Travel Node
GL-MT3000 in your bag
WireGuard tunnel
Home Node
GL-MT3000 at home
Your home IP
Internet
Exits as your home
The Travel Node creates a WiFi network wherever you are. All traffic encrypts and travels through a WireGuard tunnel to your Home Node, which decrypts it and sends it to the internet. To the outside world — including your company's security systems — you're sitting on your couch.
The Handshake Problem
Your home IP address changes periodically (your ISP rotates it). In a DIY setup you use Dynamic DNS to track it — but DDNS can lag by minutes, causing disconnections. HomeLink kits use a proprietary relay server that maintains a permanent link between your routers regardless of IP changes.
Phase 1
Assemble the Gear
You need two identical routers — one for home, one for travel. Don't mix models. Identical hardware makes configuration significantly easier and reduces failure points.
| Item | Role | Notes |
|---|---|---|
| 2× GL.iNet Beryl AX (GL-MT3000)Available on Amazon | Home Node + Travel Node | Best WireGuard performance in this price range. Same model on both ends simplifies setup. |
| 2× Cat6 Ethernet cableShort lengths fine | WAN connections | Routers come with one short cable. Get extras — you'll use them during setup. |
This guide is written for firmware v4.8.1. The core steps are the same on other versions, but your screens may look slightly different than described.
Phase 2
Set Up the Home Node
This is the most critical step. If the Home Node isn't reachable from the internet, the whole system fails. Do this at home before anything else.
Critical: The Home Node must be physically at your home and plugged into your home ISP modem before you configure anything. It needs to be online and reachable from the internet.
Wiring
- 1Plug the power adapter into the Home Node router.
- 2Run an Ethernet cable from the WAN port (blue) on the Home Node to any LAN port on your ISP modem/router (the Comcast or AT&T box).
- 3Wait 2–3 minutes for the device to boot fully.
Access the Admin Panel
- 1Connect your laptop to the Home Node's WiFi. Look for a network named GL-MT3000-xxxx. The password is on the back of the router, labeled Key.
- 2Open a browser and go to 192.168.8.1.
- 3Select English, create a strong admin password, and save it somewhere safe.
Activate the WireGuard Server
- 1In the left sidebar, click VPN → WireGuard Server.
- 2Click Start.
- 3Click Options (top right). Toggle "Allow Remote Access to LAN Subnet" ON. Click Apply.
The "Allow Remote Access" toggle is what lets your travel router reach devices on your home network — like your home NAS or smart home devices. Don't skip it.
Phase 2 cont.
Port Forwarding — The Hard Part
For the Travel Node to reach the Home Node from outside your network, you need to open a port on your ISP modem. This is called port forwarding, and it's where most DIY setups stall.
- 1Log into your ISP modem — not the GL.iNet. Usually at 192.168.1.1 or 10.0.0.1. If unsure, Google your ISP name + "how to access router".
- 2Find Port Forwarding — usually under Advanced or Firewall.
- 3Create a new rule with these exact values:
# Port forwarding rule
Service Name: WireGuard
External Port: 51820
Internal Port: 51820
Protocol: UDP
Internal IP: [IP address of your GL.iNet Home Node]
T-Mobile 5G, Starlink, or some Fiber providers use CGNAT — a shared IP system that makes port forwarding impossible. If this is your ISP, port forwarding will never work regardless of how correctly you follow these steps. There is no DIY fix for CGNAT.
HomeLink Advantage
HomeLink kits don't use port forwarding at all. Our relay server creates an outbound connection from your Home Node — meaning it works on Starlink, T-Mobile 5G, CGNAT, and any ISP without needing modem access.
Dynamic DNS (DDNS)
Your home IP address changes periodically. DDNS gives your home a stable hostname the Travel Node can always find.
- 1Back on the GL.iNet admin panel (192.168.8.1), go to Applications → Dynamic DNS.
- 2Toggle Enable DDNS on and accept the terms.
- 3Wait for a URL like xxxx.glddns.com to appear. Write this down — it's your Home Node's permanent address.
- 4Click Apply.
DDNS can lag by up to 10 minutes when your home IP changes. During that window, your Travel Node loses connection. This is a known limitation of DIY setups — HomeLink's relay server eliminates this gap entirely.
Phase 3
Set Up the Travel Node
Now configure the router that goes in your bag. First you need the WireGuard configuration key from your Home Node.
Get the Configuration Key
- 1On the Home Node admin panel, go to VPN → WireGuard Server → Profiles tab.
- 2Click + Add. Name it "Travel Node". Click Apply.
- 3A configuration block appears. Before copying it, make sure the Address field shows your DDNS hostname (xxxx.glddns.com) — not a raw IP. Select it from the dropdown if needed.
- 4Click Download or copy the entire configuration block.
Configure the Travel Node
- 1Power up the Travel Node. Connect your laptop to its WiFi (GL-MT3000-xxxx, password on back).
- 2Go to 192.168.8.1 and log in.
- 3Go to VPN → WireGuard Client. Click + New Group, name it "HomeLink".
- 4Click Manually Add Configuration. Paste the configuration block you copied. Click Apply.
- 5Click the ⋯ menu next to the configuration and select Start.
Enable the Kill Switch
This is non-negotiable. The kill switch cuts internet access entirely if the VPN tunnel drops — preventing your real IP from leaking even for a moment.
- 1On the Travel Node, go to VPN → VPN Dashboard.
- 2Click the gear icon next to the WireGuard Client toggle.
- 3Find "Block Non-VPN Traffic" or "Kill Switch". Toggle it ON. Click Apply.
Firmware update risk: GL.iNet firmware updates can silently reset the kill switch toggle. After any update, verify the kill switch is still enabled before traveling. HomeLink kits hard-code the kill switch at the firmware level — it cannot be overridden by updates.
Bonus
Add Your Phone
You can also route your phone's traffic through the Home Node directly — useful when you're away from the Travel Node but still need a US IP for banking or work apps.
- 1Download the WireGuard app on your phone (iOS App Store or Google Play).
- 2On the Home Node admin panel, go to VPN → WireGuard Server → Profiles. Click + Add, name it "My Phone".
- 3This time, click the QR Code tab instead of Configuration File.
- 4In the WireGuard app on your phone, tap + → Create from QR Code. Scan the QR code on screen.
- 5Name the tunnel and toggle it on. Verify your IP at whatismyip.com.
The phone tunnel only changes your IP — it does not affect GPS location data. If your phone's GPS is enabled and an app reads it, your physical location is still visible. Disable GPS for sensitive apps and consider enabling Airplane Mode + WiFi only when using the tunnel.
Phase 4
Verification — The Pre-Flight Test
Do not get on a plane until you pass this test. Run it at a coffee shop or using your phone's hotspot — anywhere other than your home network.
Phase A — Get your baseline IP
- 1At home on your normal WiFi (not the HomeLink router), go to whatismyip.com.
- 2Write down the IPv4 address. This is your "Safe" home IP.
Phase B — Field test
- 1Go to a coffee shop or enable your phone's mobile hotspot.
- 2Power up the Travel Node. Connect it to the coffee shop WiFi or hotspot via the admin panel (192.168.8.1 → Internet → Repeater → scan and connect).
- 3Connect your laptop to the Travel Node WiFi. Wait 30 seconds for the tunnel to establish — look for a green/blue dot next to VPN in the sidebar.
- 4Go to whatismyip.com on your laptop.
✅ Pass
The IP address shown matches your baseline home IP exactly. You're digitally sitting on your couch. Safe to travel.
❌ Fail
IP doesn't match. Stop — do not travel until you resolve this. See troubleshooting below.
If it fails — troubleshooting checklist
- Is the WireGuard Server running on the Home Node? Check VPN → WireGuard Server — should show active/green.
- Is the WireGuard Client running on the Travel Node? Check VPN → WireGuard Client — should show connected.
- Is port forwarding correctly configured on your ISP modem? Double-check port 51820 UDP is forwarded to the Home Node's IP.
- Does the DDNS hostname resolve correctly? Go to Applications → Dynamic DNS on the Home Node and run the DDNS Test — the IP shown should match whatismyip.com from your home network.
- Is your ISP using CGNAT? If so, port forwarding won't work. See the HomeLink option below.
Ongoing discipline
The Golden Rules — Never Get Complacent
Having the hardware set up is half the battle. Maintaining operational discipline is the other half.
- Run the leak test before opening Slack. Go to whatismyip.com every time you connect from a new location. Takes 10 seconds.
- Keep the Travel Node in your carry-on. Never checked luggage — if it gets lost you have no tunnel.
- Have a backup plan. If your home internet goes down (power outage, ISP issue), your tunnel goes down too. Know what you'll do.
- Don't take Zoom calls in front of location-revealing backgrounds. Street signs, landmarks, and foreign-language signage are visible to anyone on the call.
- Check your kill switch after firmware updates. GL.iNet updates can silently reset it. Verify it's on before every trip.
- Lock your system timezone. Don't let your laptop auto-update to the local timezone — it creates log inconsistencies that SIEM systems flag.
Prefer it done for you?
If you hit a wall — CGNAT, port forwarding issues, or just don't want to maintain this — HomeLink kits handle all of it. No port forwarding, permanent relay connection, hardcoded kill switch.