What a Location Bubble Actually Is
A location bubble is not about hiding. It's about reconstructing home. Every signal that identifies your location — your IP address, your timezone, your device metadata, your activity patterns — gets replaced with a version that says "home." Not fake-home. Actual home. Your real home IP, your real home timezone, your real home network. You just happen to be accessing it from somewhere else.
Each layer handles a different category of signal. Miss one and that signal leaks through. Build all four and your digital footprint is genuinely indistinguishable from working from your home network — because in every way that matters to the detection systems, you are.
The Network Layer — Your IP Address
This is the foundation everything else rests on. If your IP address says Bangkok, no amount of app settings will fix the metadata. The network layer has to come first.
The goal is simple: all your internet traffic exits through your home router, using your home residential IP. Not a VPN data center. Not a foreign hotel IP. Your actual home connection — the same one your company's systems have been seeing for months or years.
Hardware Tunnel — The Most Complete Solution
A travel router at your physical location connects to the local WiFi (hotel, Airbnb, café). All your devices connect to the travel router. All traffic goes through an encrypted WireGuard tunnel back to a home router sitting on your home network. Traffic exits the internet through your home IP.
- 1Home router — plugged into your home internet. Acts as the exit point. Never moves.
- 2Travel router — goes in your bag. Connects to local WiFi wherever you are. Creates your bubble.
- 3Kill switch — if the tunnel drops for any reason, all traffic stops. No real IP leakage even for a second.
- 4Every device connected to the travel router is automatically inside the bubble — laptop, phone, tablet, no per-device setup.
DIY WireGuard — If You Want to Build It
If you own a GL.iNet router and want to set this up yourself, the implementation guide covers the full process. The main limitations to be aware of:
- !CGNAT: T-Mobile 5G, Starlink, and some fiber providers use shared IPs that make port forwarding impossible. The DIY method won't work without a relay server workaround.
- !Kill switch: The GL.iNet software kill switch can be reset by firmware updates. You have to check it manually after every update.
- !DDNS lag: When your home ISP rotates your IP, DDNS can lag by minutes — causing tunnel drops during that window.
The OS & Browser Layer — Lock Your Timezone
With the network layer in place, your IP is home. Now your OS and browser timezone need to match. If they auto-update to local time, the timezone mismatch between your IP (home) and your device metadata (Bangkok) creates a new flag.
macOS — Lock the Timezone
- 1Open System Settings → General → Date & Time
- 2Turn off "Set time zone automatically using your current location"
- 3Manually select your home timezone from the dropdown
- 4Do this before you travel — not after you land
Windows — Lock the Timezone
- 1Open Settings → Time & Language → Date & Time
- 2Turn off "Set time zone automatically"
- 3Select your home timezone from the dropdown
The Device Layer — Kill Location Services
Even with your IP and timezone locked to home, your device can still betray you through GPS and WiFi triangulation if location services are on. This layer shuts that down.
macOS — Disable Location Services
- 1System Settings → Privacy & Security → Location Services
- 2Either turn off Location Services entirely, or scroll down and disable it for every work application — Slack, Teams, Chrome, Safari, Zoom
- 3Scroll to System Services at the bottom → turn off "Significant Locations" and "Location-Based Suggestions"
Windows — Disable Location Services
- 1Settings → Privacy & Security → Location
- 2Turn off "Location services" entirely, or toggle off individual apps
- 3Scroll down and disable location access for any work apps listed
The Ethernet trick for WiFi triangulation
Even with location services off, your laptop's WiFi radio is still scanning for networks in the background. Those network names can be cross-referenced to physical locations. The cleanest way to stop this entirely: connect your laptop to the travel router via Ethernet cable and disable your WiFi entirely. No WiFi radio, no visible networks, no triangulation possible.
This isn't always practical in a hotel room — but for high-stakes work from sensitive locations, it's the most complete option.
The App Layer — Lock Your Profile Settings
With the first three layers in place, app settings are the final polish. They handle the human-visible signals — what your colleagues see when they look at your profile or status. See Part 1 of this series for the full per-app breakdown. The summary:
- 1Slack: Profile → Edit Profile → Time Zone → set to home
- 2Google Calendar: Settings → Time Zone → Primary → set to home (this propagates to all Google apps)
- 3Zoom: zoom.us → Profile → Edit → Time Zone → set to home
- 4Teams: Settings → General → Language and region → set to home
- 5Slack Do Not Disturb: Set DND to hours that match your home working schedule so your active/inactive status looks normal
MDM — What It Is, How to Check, and What It Changes
MDM stands for Mobile Device Management. It's software your company installs on work laptops to enforce security policies and sometimes collect telemetry. It's the one part of this picture that the bubble doesn't fully contain — but the risk depends entirely on what your specific MDM setup is configured to do.
Step 1 — Check if MDM is installed on your device
System Settings → Privacy & Security → ProfilesIf you see any profiles listed that you didn't install yourself, MDM is present.
Also check:
Apple menu → About This Mac → System Report → Software → Managed Client — if this section exists and has content, your device is managed.
Settings → Accounts → Access work or schoolIf your work account is listed with an organization name and "Managed by [Company]," MDM is enrolled.
Also check:
Settings → Privacy & Security → Windows Security → Device Security — corporate MDM often appears here.
Step 2 — Understand what MDM can do if present
Not all MDM deployments are equal. MDM is a platform — what it actually does depends on what policies your IT team configured. Here's what's possible vs. what's common:
| MDM capability | Technically possible | Common in practice |
|---|---|---|
| Enforce security policies (encryption, password requirements) | Yes | Very common |
| Report device IP address | Yes | Common |
| Report installed applications | Yes | Common |
| Force location services on | Yes | Less common |
| Report GPS coordinates actively | Yes | Less common — mainly larger enterprises |
| Report WiFi networks nearby | Yes | Less common |
| Bypass your network routing (VPN bypass) | Yes | Varies — some MDM agents do this |
Step 3 — The practical answer for most people
If you work at a small to medium company, use a personal device for travel where possible, and your company hasn't explicitly told you the laptop is managed — MDM is unlikely to be running aggressive location collection. The bubble covers you for the detection scenarios that actually affect most remote workers.
If you work in finance, healthcare, defense contracting, or a large enterprise, assume more aggressive MDM. In that case, use a personal device connected to the travel router for any work that matters for location privacy. Your personal device isn't enrolled in your company's MDM. The bubble around it is complete.
The Pre-Travel Checklist
What the Bubble Covers — and What It Doesn't
| Detection scenario | Bubble coverage |
|---|---|
| IP-based geolocation and country detection | ✓ Fully covered |
| Impossible travel from VPN drop | ✓ Covered by kill switch |
| Risky IP / VPN IP blocklists | ✓ Covered — residential IP |
| Timezone metadata mismatch | ✓ Covered by OS lock + app settings |
| GPS location data | ✓ Covered if location services off |
| WiFi triangulation | ✓ Covered via Ethernet + location services off |
| App-level timezone display signals | ✓ Covered by app settings |
| MDM GPS reporting (if location services forced on) | ✗ Not covered — use personal device |
| MDM device telemetry on enrolled work laptop | ~ Partial — IP covered, other telemetry varies |
| Human observation (colleagues noticing your hours) | ~ Partial — covered by DND/status settings |
A complete bubble on a personal device with no MDM covers everything in this table. The only gap that matters in practice is MDM-enrolled company laptops with active location telemetry — and the solution for that is using a personal device connected to the travel router, which closes the gap entirely.
📋 Get the Pre-Travel Checklist
Every setting from this guide, in one printable PDF.
The network layer, handled.
HomeLink takes care of Layer 1 — the hardest one. Pre-configured, residential IP, hardcoded kill switch, works on any ISP. You handle the other three layers in about 15 minutes.