TL;DR
Hotel, airport, and café WiFi is a shared network you don't control, sitting between you and everything you do online. A travel router fixes this by being the only device that touches the bad network. You connect the router to the hotel WiFi (as a WISP/repeater), and all your own gear connects to the router's private network instead — with WireGuard and a firewall running by default. One trusted hop, always encrypted. Below: the actual threat model, the full setup, and a MAC-clone trick to beat "one device per room" limits.
I travel with a device the size of a deck of cards that I trust more than any hotel's network engineer. It's a travel router, and it has quietly become the single most useful piece of security gear in my bag — more than any USB drive, more than any hardware key. Not because it does anything magical, but because it changes where the trust lives. (The other travel-security question I get constantly — whether public USB charging ports are dangerous — I cover separately in is juice jacking actually real.)
The normal way you use public WiFi, every device you own connects directly to a network run by strangers, shared with strangers. A travel router collapses that down to one connection you control. Here's exactly how the threat model works, why the router fixes it, and how I set mine up in about five minutes at check-in.
What's actually wrong with hotel WiFi
"Public WiFi is dangerous" is one of those phrases that gets repeated so often it stops meaning anything. So let me be specific about what I'm worried about — because it isn't the vague spectre of a hacker in the lobby. It's three concrete things.
You're on a shared LAN with everyone else in the building. On most hotel and hostel networks, every guest is on the same flat local network. That means the laptop two rooms over can potentially see your device, scan its open ports, and poke at anything you're running. Client isolation (which stops guests from talking to each other) is a setting the venue has to deliberately enable — and plenty don't. You have no way to check, and no reason to assume they did.
Rogue access points are trivially easy. Anyone can stand up a WiFi network called Marriott_Guest or Airport_Free_WiFi and wait for devices to connect. Your phone, helpfully, will happily join a network with a familiar-looking name. Once you're connected to an attacker's access point, they sit in the middle of everything — a classic evil-twin setup. HTTPS protects the contents of most traffic, but not which sites you visit, and not you from a well-built captive-portal trap.
The network operator sees everything you don't encrypt. DNS lookups, connection metadata, any legacy service that isn't on HTTPS — all of it flows through equipment you don't control and can't audit. Even if nobody's being actively malicious, you're trusting a budget router in a wiring closet that hasn't been patched since it was installed.
None of this is exotic. It's the default condition of every network you connect to away from home. The question isn't "will I be attacked" — it's "why am I exposing every device I own to this in the first place?"
How a travel router changes the game
A travel router sits between you and the hostile network and becomes the only thing that touches it. Think of it as a tiny, hardened buffer zone you carry with you.
The flow looks like this: the router connects to the hotel WiFi as its uplink (this mode is usually called WISP or repeater). Your phone, laptop, tablet, and anything else connect to the router's own private WiFi network — a network with a name and password only you know. From your devices' point of view, they're on a clean home network. They never see the hotel LAN at all.
That single architectural change gives you three things for free:
One trusted hop instead of five exposed devices. Only the router is on the shared network. Your actual devices are one layer removed, invisible to the other guests, invisible to the evil twin, invisible to the port scanner. If anything gets probed, it's a locked-down router with nothing interesting on it.
Always-on WireGuard. This is the big one. You load a VPN config onto the router once, and every device behind it is tunneled automatically — no per-app VPN, no forgetting to toggle it on, no phone that silently drops the tunnel when it sleeps. The encrypted tunnel comes up at the router and stays up. If the tunnel drops, a kill switch cuts traffic rather than leaking it. I use WireGuard for its speed and simplicity; if you're new to it, my guide on setting up a VPN for Kali Linux walks through the same protocol on a laptop.
Its own firewall. The router runs a real stateful firewall (OpenWrt underneath, on the models I recommend). Inbound connections from the hostile side are dropped by default. Your devices are behind NAT and a firewall you actually control, not the hotel's.
The MAC-clone trick to beat "one device per room"
Here's the practical bonus that pays for the router on its own. Plenty of hotels cap you at one or two devices per room, or make you pay per device, or throttle you after the first connection. They enforce this by tracking the MAC address of whatever connects — the hardware identifier every network adapter broadcasts.
Because your travel router is the only device the hotel sees, you're already down to one MAC as far as they're concerned — all your gear hides behind it. But there's a sharper move. Say you paid for WiFi on your laptop, went through the portal, and now you want the same access on the router without paying again. You clone your laptop's already-authorized MAC address onto the router's uplink. The hotel sees the same MAC it already approved and waves the router through — and now every device behind the router inherits that access.
On GL.iNet firmware it's a single field in the network settings: set the WAN/repeater interface's MAC to match your laptop's. On the OpenWrt command line it's a one-liner per interface.
If MAC addresses are new to you, they're worth understanding rather than copy-pasting — they're a recurring theme in wireless security. I've written the full walkthrough on how to spoof a MAC address and the theory behind it, plus a hands-on guide to changing your MAC address with macchanger on Kali Linux if you want to practice on a laptop first. The router is just applying the same idea at the network's edge instead of on one machine.
Setting it up: start to finish
This is the whole process. Do steps 1–3 at home; step 4 takes thirty seconds at the hotel.
1. Create the router's private network. Power on the router, connect to its default admin network, and open the admin panel (typically 192.168.8.1 on GL.iNet gear). Set a strong admin password. Rename the router's own WiFi (its SSID) to something non-obvious and give it a long passphrase. This is the network your devices will trust — treat it like your home WiFi.
2. Load your WireGuard config. Export a WireGuard config file from your VPN provider or your own server, then import it in the router's VPN section. Turn on the kill switch (often labelled "block non-VPN traffic" or "internet kill switch") so nothing leaks if the tunnel drops. Confirm the handshake succeeds while you're still at home.
3. Connect your devices to the router. Join your phone, laptop, and tablet to the router's private SSID from step 1. From now on, this is the only network they ever join while travelling. They're tunneled and firewalled automatically.
4. At the hotel, point the uplink at their WiFi. Open the admin panel, go to the repeater/WISP section, scan for the hotel's network, and connect the router to it. If there's a captive portal, the router will surface it — complete it once, from the router, and every device behind it is online. If you're beating a device limit, clone your MAC (above) before connecting. Done.
curl ifconfig.me check from any device — if the IP is your VPN's and not the hotel's city, the tunnel is doing its job across the whole network. Ten seconds, total peace of mind.The gear I actually travel with
You don't need much, and you shouldn't overspend. The whole category runs on the same OpenWrt foundation; the difference between models is WiFi speed and how much VPN throughput the chip can push. I've standardised on GL.iNet because the firmware makes every step above a menu click, and it drops to a real Linux shell when I want one.
The all-rounder — GL.iNet Beryl AX. This is the one I hand people who ask. WiFi 6, enough CPU to run WireGuard at speeds that don't annoy you, dual-band, and pocket-sized. It does everything in this article without fuss and costs about as much as a couple of hotel WiFi upgrades. For most travellers this is the right answer and you can stop reading.
View on Amazon →The step-up — GL.iNet Slate 7. If you push a lot of traffic, tether from multiple devices at once, or want the extra headroom of the newest WiFi and a faster VPN ceiling, the Slate 7 is the upgrade. Same firmware and workflow, more performance under it. I reach for this on longer trips where the router is my only connection for a week.
View on Amazon →Affiliate links — I may earn a commission at no extra cost to you. Full disclosure.
Whichever you pick, the value isn't the hardware — it's the model change. You stop trusting networks and start trusting one small box you carry. And while you're tightening up your travel setup, it's worth doing the same for your footprint at rest: I keep a running guide on how to remove yourself from popular people-search sites, which pairs well with locking down your connection on the road.
Most travelers should just buy the GL.iNet Beryl AX — WiFi 6, enough CPU to run WireGuard without annoying you, and every step in this guide is a menu click. Only step up to the Slate 7 if you push heavy traffic or live off the router for a week straight.
- GL.iNet Beryl AX — Best all-rounder; WiFi 6, easy WireGuard View on Amazon →
- GL.iNet Slate 7 — Step-up for heavy traffic, longer trips View on Amazon →
Affiliate links — I may earn a commission at no extra cost to you. Full disclosure.
Frequently Asked Questions
Do I still need a VPN app on my phone if I use a travel router?
No — that's the point. The router runs the WireGuard tunnel for the whole network, so every device behind it is covered automatically without per-device apps. Keeping a VPN app on your phone for when you're not behind the router (mobile data, a friend's house) is still sensible, but at the hotel the router handles it.
Will the always-on VPN slow everything down?
A little, but far less than you'd expect on the models I recommend. Hotel WiFi is usually the bottleneck, not the router's encryption. The Beryl AX and Slate 7 both push WireGuard fast enough that streaming and calls feel normal. Older or cheaper routers with weaker chips are where you'd notice a real hit.
Is cloning a MAC address to beat a device limit legal?
Using it to spread access you've legitimately paid for across your own devices is generally fine and is exactly what the router does anyway by design. Using it to steal someone else's paid session or evade a ban is not — and may breach the venue's terms or worse. Check the terms, and keep it to your own access.
What if the hotel network only allows one device and blocks routers?
This is precisely where the MAC clone helps — the hotel sees one MAC (the router's, or your cloned laptop's), so it looks like a single device. Some networks fingerprint deeper, but in practice cloning an already-authorized MAC clears the vast majority of one-device gates.
Can I use a travel router with hotel wired Ethernet instead of WiFi?
Yes, and it's even cleaner. Plug the room's Ethernet into the router's WAN port instead of using repeater mode. Your devices still connect to the router's private WiFi, the VPN and firewall still apply, and you skip the flaky wireless uplink entirely. Wired uplink where available is my preference.
Does this protect me if I go through a malicious captive portal?
Largely, yes. Only the router loads the portal, so your actual devices never touch it. And because the VPN and firewall live on the router, the moment the portal is cleared your traffic is tunneled. The router is the sacrificial layer that deals with the one unavoidable moment of exposure so your devices don't have to.
