01No VPN
Direct internet
The GL.iNet uses whichever local internet connection is currently available. This can be hotel or apartment Wi-Fi, Ethernet, or another available connection. In this mode, traffic reaches the internet directly without a VPN.
In-house network project • VPN • redundancy
Three internet paths in one travel router
A GL.iNet GL-MT3600BE configured so the same private Wi-Fi network can use three completely different exit paths: direct local internet, a dedicated server-room OpenVPN endpoint, or WireGuard to a MikroTik endpoint with ONE and Telekom failover.
Operational system • September 17, 2026
System topology
One router, three independent exit paths
At a glance: the no-VPN path uses only the locally available internet connection; OpenVPN goes to a separate server-room endpoint; and WireGuard reaches the remote MikroTik, which has two separate internet uplinks from ONE and Telekom.
Travel router
GL.iNet GL-MT3600BE
private Wi-Fi network • local Wi-Fi / Ethernet uplink
1. path
No VPN
Local Wi-Fi / Ethernet
↓
Internet
2. path
OpenVPN
Encrypted OpenVPN tunnel
↓
Server-room Linux server
fixed public IP address
fixed public IP address
↓
Internet
3. path
WireGuard
Encrypted WireGuard tunnel
↓
MikroTik hAP lite
ONE
Telekom
dual-WAN • failover
Internet
3
selectable internet paths
2
separate VPN technologies
2
independent internet uplinks behind WireGuard
1
portable private network
The three operating modes
Three paths, three distinct roles
02Fixed-IP endpoint
Server-room OpenVPN
The second path is a separate OpenVPN tunnel terminating on a dedicated Linux server in a server-room environment with a fixed public IP address. The local internet connection only carries the encrypted tunnel.
03MikroTik • ONE + Telekom
WireGuard + dual-WAN
The third path reaches a remote MikroTik router over WireGuard. Behind the MikroTik are two separate residential internet connections, ONE and Telekom, configured for failover.
Local internet
The router uses whichever internet connection is available
The GL.iNet can join an existing Wi-Fi network as a repeater, while Ethernet can also be used. Without a VPN, devices simply use that connection directly. The private SSID and internal network can remain unchanged, so laptops and phones do not need to be reconfigured at every location.
Two separate VPNs
Not two protocols to the same endpoint
OpenVPN terminates on a separate server-room Linux server with a fixed IP address. WireGuard, by contrast, connects to the remote MikroTik. The two tunnels therefore serve different purposes and use different underlying infrastructure.
Quick control on the router
The physical side switch can quickly enable or disable WireGuard, while OpenVPN can be started manually from the VPN Dashboard when needed.
WireGuard endpoint
Two separate internet connections behind the remote exit
The WireGuard tunnel leads to a MikroTik hAP lite RouterBOARD. The MikroTik manages two separate residential internet connections: ONE and Telekom. The two WAN links operate in failover mode, so if one provider fails, the other can continue carrying the remote internet exit.
ONETelekomMikroTik hAP litefailover
Why we built it
The same private network wherever we are
Laptops, phones and other devices do not need to know which hotel Wi-Fi, VPN or remote internet connection is currently in use. They always connect to the same private GL.iNet network, while the exit strategy is selected on the router.
Related 1B solutions
The project combines several network solutions that we also deploy as standalone services.