Same! And the best thing is that you can install Tailscale, so you can connect to your tailnet, and exit all traffic through one of your nodes (e.g., your home/office network).
It's incredibly useful, with the added bonus that you don't need to install tailscale client in any of your travel devices (phone, tablet, work computer, etc).
I’m seeing a lot of this same comment here, so I went to check out this tailscale thing, which clearly I must need.
Can anybody explain what Tailscale is, does, or why everybody seems to have it?
Looking at their website, it’s just a huge wall of business jargon. Really! Read it. It’s nothing but a list of enterprise terminology. There’s a “how it works “ page full of more (different) jargon, acronyms and buzzwords, but no simple explanation of why everybody on this thread seems to be paying money for this thing?
Any help? Should I just pay them my $6/month and hope I figure it out at some point?
It's a wrapper around Wireguard that lets you use common SSO providers (Apple ID, Google, etc) to manage access.
It also handles looking up the IP address of your "nodes" through their servers, so you don't need to host a domain/dns to find the WAN IP of your home network when you're external to it (this is assuming you don't pay for a fixed IP).
Most people put an instance of it on a home server or NAS, and then they can use the very well designed and easy to use iOS/mac/etc client to access their home network when away.
You can route all traffic through it, so basically your device operates as if you're on your home network.
You can accomplish all of this stuff (setting up a VPN to your home network, DNS lookup to your home network) without Tailscale, but it makes it so much easier.
TS makes it super easy to use a VPC I have in the US as my VPN exit while I live in other parts of the world. Apps that work on phones, computers, and my AppleTV are big pluses over Wireguard which I have also used.
I was still completely mystified until your last sentence. And now I'm just mostly mystified. I, too, keep hearing Tailscale Tailscale Tailscale from HN commenters but have no idea why I'd need it. For anything I need to access on (or from) my home network I just use a VPN I've hosted in my home for the last decade or so.
If you've already got a VPN solution your happy with, Tailscale probably adds very little value for you. It's just basically the easiest / most user friendly way to setup a VPN to your home network.
It can do way more than just being a VPN-to-home, but that's how most users use the free part.
It's still valuable. You can access your server with your own VPN set up, but what if you want to share a server to a friend or a family member (examples includes VaultWarden/Bitwarden, Plex, Jellyfin)?
If this is on Tailscale, you can just ask people to install tailscale client and login using one of the IdP, then ask them to accept the node you shared to them, and they can immediately access the server.
The alternative would be 1) sending VPN configs over and maybe also configure their VPN client for them, or 2) expose the service on the Internet protected by some OAuth proxy which really only works for web apps. Neither is easy/trivial.
I'd guess a plurality of people are only sharing Plex with family members, and nothing else. If you only care about sharing Plex, you don't need Tailscale to give a family member access, assuming you have Plex Pass, since Plex does a proxy as you describe.
It’s worth pointing out that it can be both. The hub and spoke model, relays, is often used for cloud setups where the overhead of installing clients on nodes is not worth the tradeoff
Basic version is it's a sort of developer focused zero trust network service.
Encrypted overlay network based on wireguard tunnels, with network ACLs based around identity, and with lots of nice quality-of-life features, like DNS that just works and a bunch of other stuff.
(Other stuff = internet egress from your tailscale network ('tailnet') through any chosen node, or feeding inbound traffic from a public IP to a chosen node, SSH tied into the network authentication.
There is also https://github.com/juanfont/headscale - which is a open source implementation of some of tailscale's server side stuff, compatible with the normal tailscale clients.
(And there are clients for a very wide range of stuff).
I can’t tell if you’re trying to help, or just getting into the spirit of the website’s “how it works (using ten pages of terminology and acronyms we just made up)” page.
None of the terminology or acronyms that user used were made up or unique to this. I think you are blaming other people for your unfamiliarity with this kind of tech.
It is simply a managed service that lets you hook devices up to an overlay network, in which they can communicate easily with each other just as though they were on a LAN even if they are far apart.
For example, if you have a server you'd like to be able to SSH into on your home network, but you don't want to expose it to the internet, you can add both it and your laptop to a Tailscale network and then your laptop can connect directly to it over the Tailscale network no different than if you were at home.
Sorry if I appeared rude. That was very much tongue in cheek.
But notice how you just did a much better job of explaining what this thing does without using any jargon at all. The jargon helps if everyone already knows what you’re talking about. It hurts if anyone doesn’t.
That’s what I’m poking fun at. There’s a trait in lots of engineers I’ve worked with over the years to be almost afraid to talk about tech stuff in layman terms. Like they’re worried that someone will think less of them because they used words instead of an acronym. Like they won’t get credit for knowing what a zero trust network is if they describe the concept in a way that regular people might understand.
One of those guys was certainly in charge of this company’s website copy.
Perhaps if we were on Reddit, and also on a general subreddit, then people would speak in less technical terms.
Since this is HN, it’s almost expected the participants here would either know the terms, or at the very least be able to find out what they mean on their own and realize it’s not made up jargon but rather common industry terms.
Tailscale is not trying to sell to the average buyer, it’s trying to sell to a specific audience.
> Like they won’t get credit for knowing what a zero trust network is if they describe the concept in a way that regular people might understand.
I've been trying to get a definition of zero trust at $client from the security people who are pushing tools onto our platform, so we can have an honest conversation around threats and risks, and finding the best balance of tools, techniques and processes to achieve their desired outcomes.
Unfortunately, it seems like everybody just want "zero trust" because a vendor sold them on that idea and they gave money to the vendor, so now there's the need to justify that expense and "extract value" from the tool - even if it may in fact be worse than the controls that are already in place.
I don't think you need to pay $6 a month to try it out.
Install it on all the machines you want. When you are running it on the machine, it is networked to the other machines that are running it. Now make an 'exit node' on one of those machines by selecting it in the UI, and all your gear can access the internet via that exit node. Your phone can run it. Your apple tv can run it. You can have multiple exit nodes. So you can have a worldwide network and not once did you have to open ports in firewalls etc.
How does it compare to Zerotier? The way I understand it it's kind of overlapping functionality but not necessarily everything.
What I want from Zerotier is basically what you described about Tailscale.
The two problems I have with zerotier are:
1) It's supposed to let a mobile device like an Android tablet route its traffic through zerotier (functioning as a VPN to my home site, in this case). However, I've never got that to work. It's running, but doesn't affect anything network-wise for the other applications (unlike running e.g. openvpn on it)
2) On a couple of computers with specific routing set up to various destinations, when Zerotier runs it simply blocks all of that and there's no way for me to continue accessing anything else than the Zerotier network. No fiddling with routing tables etc. changes any of that. On other computers, also some running OpenVPN, Zerotier does not interfere. I've never figured out what causes this.
So, in short, I'm pondering if I should ditch Zerotier and try Tailscale instead. If it does the same - I simply want a way to connect my devices, but I also don't want to lose total control over routing. For mobile devices I would want full VPN, for computers I don't. Edit: So, I'm both after connecting my multiple networks, as well as VPN'ing certain things or devices through another location.
Having tried both Zerotier and Tailscale, I found Tailscale to be a significant improvement. Tailscale uses Wireguard as the base encrypted protocol instead of a semi-homebrew protocol Zerotier came up with that notably lacks things like ephemeral keys/perfect forward secrecy. Tailscale also has a faster pace of improvement and is responsive to customer asks, regularly rolling out new features, improving performance, or fixing bugs. Zerotier by contrast seems to move slower, regularly promising improvements for years that never materialize (e.g. fixing the lack of PFS).
My last gripe is more niche, but I found Zerotier's single threaded performance to be abysmal, making it basically unusable for small single core VMs. My searching at the time suggested this was a known bug, but not one that was fixed before I switched to Tailscale. Not impossible to work around, but also the kind of issue that didn't endear the product to me or inspire confidence.
It's been a minute since I ran ZeroTier, so my memory is fuzzy.
Tailscale and ZT are not the same. ZT can do certain things that TS can't. One example is acting as a layer 2 bridge. Or a layer 3 bridge. TS can do neither. It can achieve mostly similar results though.
ZT can be a pain to setup. TS is a breeze. ZT's raw performance is quite poor. TS's is usually very good.
If I understood you correctly, you want both a way to access your home LAN when you're out - this is easy. Set up a node with NICs on the LAN subnets you want access to (I run it on my router), and configure the TS node to announce routes to those subnets. Install the TS client on your laptop and mobile and accept those routes. Job done.
If you also want to mask your egress - i.e. reach the Internet via your home network as if you were there - then you need a node (can be the same as above) configured to act as an Exit Node. When you want one of your devices to use this, just select the appropriate exit node. Job done.
So, somewhere on that website, there’s a free version that can be downloaded onto a desktop and run without signing up for their service?
I think I understand what it does now. So, basically you leave a computer running at home, and this thing lets you pretend to be running your internet stuff through it while you’re on the road?
The first plan on the left called 'Personal' is free.
It uses a central orchestrator which is what requires you to sign up. If you prefer to self host your orchestrator you can look into Headscale, an alternative that seeks to be compatible with the clients.
> So, basically you leave a computer running at home, and this thing lets you pretend to be running your internet stuff through it while you’re on the road?
That's one thing you can do with it, yes. You can also run custom DNS entries across it, ACLs, it is very flexible.
Ugh. On mobile, the first plan on the pricing page is “ starter” for $6. The plan to the right is partly visible, indicating that you can scroll that way. There’s nothing to indicate that you can scroll left.
A less hostile website design would have (again) saved me a question.
It seems like it defaults to Business, which is paid. If you tap "Personal" you'll see the free plan.
Sorry, but try a little harder. Tailscale isn't hostile, but it seems you are -- you claim to think you need it, but don't know what it does and can't put in the effort to determine and foist those inabilities on Tailscale?
I've been using Tailscale for many years now and they have a terrific product.
Tailscale is one of the simplest, most useful things I use. I only use the personal plan, but I keep toying with signing up for paid because it’s a damn good product.
The service is free up to certain amount of connected people and devices. You most likely don't need to pay for it. I am pretty heavy user and don't.
It is virtual private network orchestrator. It allows you to connect to other devices that you add to your network as long as they are connected to the internet. So your office computer, home server or NAS. If you have some home automation like home assistant you can connect to it from anywhere. That kind of stuff.
You can run it on a capable router or on a RPi, or on your NAS. It's especially useful if you want to self-host (e.g. Immich). You can use it to authenticate for ssh if you like, or simply give you an IP you can ssh to.
It's especially handy if you want a secondary way in, in case you have problems connecting using wireguard, since it supports using a relay if you're stuck in a hotel with a heavily restricted connection.
If you run DNS at home, you can even configure it to use your home DNS and route to your home subnet(s).
So basically wireguard, but you have to pay for it, and you have create an account through Google/Apple/Microsoft/whatever.
Wireguard is not that hard to set up manually. If you've added SSH keys to your Github account, it's pretty much the same thing. Find a youtube video or something, and you're good. You might not even need to install a wireguard server yourself, as some routers have that built in (like my Ubiquity EdgeRouter)
It's not really "basically wireguard" and you don't have to pay for it for personal use. Wireguard is indeed pretty easy to set up, but basic Wireguard doesn't get you the two most significant features of Tailscale, mesh connections and access controls.
Tailscale does use Wireguard, but it establishes connections between each of your devices, in many cases these will be direct connections even if the devices in question are behind NAT or firewalls. Not every use-case benefits from this over a more traditional hub and spoke VPN model, but for those that do, it would be much more complicated to roll your own version of this. The built-in access controls are also something you could roll your own version of on top of Wireguard, but certainly not as easily as Tailscale makes it.
There's also a third major "feature" that is really just an amalgamation of everything Tailscale builds in and how it's intended to be used, which is that your network works and looks the same even as devices move around if you fully set up your environment to be Tailscale based. Again not everyone needs this, but it can be useful for those that do, and it's not something you get from vanilla Wireguard without additional effort.
I guess I'm still not following. Is there an example thing that you can do with Tailscale that you can't do with Wireguard? "Establishes connections between each of your devices" is pretty vague. The Internet can already do that.
I install tailscale on my laptop. I then install tailscale on a desktop PC I have stashed in a closet at my parents. If they are both logged in to the same tailnet, I can access that desktop PC from my home without any addition network config (no port forwarding on my parents router, UPNP, etc. etc).
I like to think of it as a software defined LAN.
Wireguard is just the transport protocol but all the device management and clever firewall/NAT traversal stuff is the real special sauce.
You can run two nodes both behind restrictive full cone NATs and have them establish an encrypted connection between each other. You can configure your devices to act as exit nodes, allowing other devices on your "tailnet" to use them to reach the internet. You can set up ACLs and share access to specific devices and ports with other users. If you pay a bit more, you can also use any Mullvad VPN node as an exit point.
Tailscale is "just" managed Wireguard, with some very smart network people doing everything they can to make it go point-to-point even with bad NATs, and offering a free fallback trustless relay layer (called DERP) that will act as a transit provider of last resort.
Tailscale is free for pretty much everything you'd want to do as a home user.
It also doesn't constantly try and ram any paid offerings down your throat.
I was originally put off by how much Tailscale is evangelised here, but after trying it, I can see why it's so popular.
I have my Ubuntu server acting as a Tailscale exit node.
I can route any of my devices through it when I'm away from home (e.g. phone, tablet, laptop).
It works like a VPN in that regard.
Last year, I was on a plane and happened to sit next to an employee of Tailscale.
I told him that I thought his product was cool (and had used it throughout the flight to route my in-flight Wi-fi traffic back to the UK) but that I had no need to pay for it!
One of the things keeping me from adopting Tailscale is that I need to sign up with one service, but I can't add multiple services as login options in case one of those SSO providers lock me out, like what happened to Dr Paris Buttfield-Addison with Apple.
I checked, and Tailscale only allows a single Owner [1], so it would still be pretty disastrous if the Owner account was suspended by the single sign-on organisation.
Great, yet another opportunity for Big Tech to track people. I’ll stick to my Wireguard setup, I have a fixed IP and would rather have full control of what is happening by setting up the keys myself than trust a third party.
Not sure if anybody gives you the answer to "what is tailscale?". So, this is my answer (hopefully it's correct and simple enough to understand).
Tailscale allows devices that can access the Internet (no matter how they access the Internet) to see each other.
To do that, you create a tailscale network for yourself, then connect your devices to that network, then your devices can see each other. Other devices that are connecting to the Internet but not to our tailscale network won't see your devices.
AI might explain it better :-) Don't know why I wanted to explain it.
A multipoint VPN that punches through NAT and can be configured to do a lot of neat things besides.
Nothing that a network guru or even a sufficiently motivated hacker couldn’t do on their own, except that the maintenance is practically zero for the personal user and it’s actually easy enough for a very nontechnical person to use (not necessarily to set up, but to use), perhaps with a bit of coaching over the phone. Want to use a different exit point for your traffic? It’s a dropdown list. Share a file? Requires one config step on the client for macOS, once, and then it’s just in the share menu. Windows, Android, iOS are ready to go without that. Share whole directories? Going to require some command-line setup once per shared directory, but not after that.
There are features that are much more enterprise-focused and not as useful for personal stuff, but everything above is in the free version.
I’m not in tech at all, professionally, and never have been. I’m savvy for an end user - I can install Linux or a BSD, I can set up a network, I can install a VPN myself to get back to my home network - but I would never, ever call myself anything more than an interested layman. I probably could figure most of this out on my own, if I had to. Thing is, I don’t have to. It’s more than just Wireguard in a pretty wrapper.
Try it. It won’t take long to figure out why so many people here like it, even if you may not want to use it.
Tailscale can tunnel all your traffic through a chosen exit node so you browse the web and whatnot as if you were at home (or wherever the exit node is), so in this way it's a bit like a VPN from a VPN company, but it doesn't give you a list of countries to select from.
VPN companies aren't really in the business of selling VPNs. They sell proxies, especially proxies that let you appear to come from some country, and you typically connect to the proxy using the VPN functionality (particularly if you're using a consumer device instead of a laptop), but often you can use SOCKS5 instead.
Tailscale isn't in the business of selling proxies.
Which is nice, but still a beta feature. Tailscale itself is indeed a mesh VPN that lets you connect all your devices together.
> If I do not want to expose local services but only protect me and hide from untrusted WiFi, would I better use a traditional VPN or Tailscale?
It does NOT by default route all your internet traffic through one of its servers in order to hide it from your ISP, like the type of VPN you might be thinking of (Mullvad, ProtonVPN etc.).
Though you CAN make it route all the traffic from one of your devices through another, which they call an 'Exit Node'. They also have an integration with Mullvad, which allows you to use Mullvad servers as an exit node. Doing that would be identical to just using Mullvad though.
A system by wich you can expose things on your private network (e.g. your home lan) so you can selectively and securely make them accesible from other places (e.g. over the Internet). You can do all this without tailscale by just configuring secure encrypted tunnels (wireshark, traefic, ...) yourself, but services like tailscale provide you with easy gui configuration for that.
For me: it's a way to access services I host on my homelab LAN from 3000 miles away. Having a router that automatically logs into that and routes TS addresses properly allows you to use all your devices connected to that router to access TS services with no further configuration. I host Kiwix, Copyparty, Llama.cpp, FreshRSS, and a bunch of other services on my homelab, and being able to access all of those remotely is convenient.
It's a cryptographic key exchange system that allows nodes to open Wireguard tunnels between each other. They have a nice product, but I don't like how it spies on your “private” network by default: https://tailscale.com/kb/1011/log-mesh-traffic
You don't need to get too far down the page to see "VPN", which is what it is. But on top of that primitive, it's also a bunch of software and networking niceties.
We’re from the US but were recently in Germany. Sometimes we were completely exhausted after a long day and just wanted to rest in our room a little before going to sleep. Our motel had like 2 English speaking channels and both sucked. We watched a lot of German TV because it was interesting, even if we could barely understand what was going on. After some time doing that, it was a pleasure watching some Hulu, courtesy of connecting to WireGuard back at our house in California so that we had an American IP.
I did the same thing recently while visiting family in SE Asia. I wanted to watch my team's bowl game but American college football is unknown in that part of the world. A Wireguard connection back to my home router gave me the ESPN access I pay for in the US.
A few services didn't work because they required my mobile device's location services (which still showed my in Asia). I'm sure I could have found a workaround for that but wasn't properly motivated to put in the effort for a short visit.
In a similar vein, I was able to troubleshoot a problem with our NAS from a cellular connection on a boat near Bali a couple years ago. My son needed access to some files for his college homework but couldn't access it remotely. I was able to access it and reconfigure a setting that had changed during an update and restore his access.
If Tailscale is installed on your router, then any client will also be able to connect to Tailscale networks.
Fo example, if you have a default route back to your home network on the router, any client will also connect through that tunnel back through your home. This assumes you are using your travel router to connect your laptop as opposed to say the hotel wifi. (In this scenario, your travel router is connected to both the hotel wifi as an uplink and Tailscale.)
You only need separate users if you want to restrict certain features (devices, apps, etc.) to only certain users (i.e., it's more of a business thing). My wife's machines all use my username because... she lives with me; if she wanted suddenly to learn networking and computers and hack all our stuff, she could do it anyway since she has physical access.
So pretty much anyone you would trust on your LAN can be trusted with your Tailscale user. You can just log yourself into Tailscale on the kids' devices and then use the admin console to make those devices' logins never expire. They can use all the features, but they don't know your authentication method and thus can't get admin access themselves. About the only situation in which the typical home user would need multiple accounts would be if someone was physically away from you and had a new device they needed to connect to your tailnet (their term for your collection of devices, services, etc.) but you didn't want to share your password with them. If they're physically near you, you just authenticate their device and hand it back to them.
For what it's worth, you get 100 devices total, regardless of number of user accounts. If you don't need the permissions granularity that individual accounts have, consider only having an "admin" and "untrusted" account... or a single account, and pinky promise your family not to play with it.
These are neat in that you can jump on and extend existing wifi infra, but it'd be nice if they also included 5G. I want a product that does both.
It's cool to have your own network in a hotel. But it'd be nice to be able to do that on the road, away from public wifi, internationally, whenever - which hotspots do. But at the same time, it'd be nice to be able to do the WiFi thing too to cut back on data usage. I frequently blow through my hotspot data.
I'd rather this be in one device instead of two. Beggars can't be choosers, though, I suppose?
I’m using a GLinet GL-XE3000 for that and it’s great. Initial setup of the 5G eSIM on a physical SIM took a little searching but it’s been rock solid and having consistent access on the road and hotels has been great for family travel. It has a built-in battery, but I’ve never really tested the duration (I suspect it’s 3-6 hours) as I put it on its AC adapter in the hotel and the n a cigarette lighter adapter in the car, so the battery gets used 15-45 minutes at a time to bridge between those two places.
I like it enough that I might buy a second, more compact unit for when space is more a premium, but I’ve been really happy with this one.
I bought that specific model to provide connectivity for our robotics team’s pit computers. For this need, good antenna performance is key, since different venues differ wildly in WiFi and cell coverage and when we setup the evening before comps, I want the best chance of getting a solid connection and offering it to the pit LAN.
But now that I have it, the device is handy for family travel as well. Put an unlimited data eSIM in the device and everyone has “unlimited” data n the road and when we arrive at a hotel or AirBnB, one person signs it on to wifi and everyone is connected, including tailscale connections to home.
If I was doing personal and work travel only, I’d look for a smaller unit, but still with a decent battery.
I do want to point out that dumping all of your traffic through a home/office network is not always a good idea. YMMV, but if you are in, say, LA, and pushed your 0.0.0.0 traffic through your home in NY, you just added quite a bit of latency.
This is great for keeping things in a LAN, but make sure you use your network rules correctly and don’t dump everything to your home network unless you need to.
(I too have a gli slate, but I use UI at home so will consider this when it comes out)
I disagree. DNS is generally unencrypted and leaking that over whatever open wifi you're on is generally worse from a privacy perspective than the latency you add bouncing through your home where you probably have encrypted DNS setup.
Even if you don't visit any http sites, you never know what might phone home over http, so an OS level VPN provides foolproof privacy at the cost of a tiny bit of latency.
Using encrypted DNS doesn't necessitate routing all your traffic through your home network. You can still encrypt all your traffic by using an encrypted DNS service or, if you really want to, a VPN service. But moving everything through your home network is not necessary, especially if you have any kind of usage caps.
And to further reinforce this point, one of the basic config variables for wireguard is your dns servers. You could literally send no traffic but your dns queries to the wg tunnel.
Is this any better than just doing Hotspot with wifi bridge? I just have my hotspot on my pixel for my devices to connect to. Pixel itself is connected to whatever
"public wifi" is there.
Your hotspot just makes the untrusted hotel wifi available via your phone wifi. The networks between your computer and your target services can still inspect and alter your data. Tailscale, or more specifically the Wireshark underneat, sets up an encrypted tunnel so those "untrusted" intermediate networks can't do that.
Yes, but it wont work for sharing mobile internet because VPN doee not apply to tethering unless you have root. On Android there is also WiFi direct, but it's not very reliable and require proxy / not work for everything.
Unfortunately, iPhone can't bridge wifi networks, which makes travel routers particularly useful if you have an iphone, and a laptop, and are staying at a hotel with wifi.
It's my understanding that personal hotspot can only utilize the cellular connection for the internet side since the wifi connection is being used to connect clientside. If one is hoping to use hotel wifi rather than their cellular plan data, Apple's solution won't work.
Yes, it has actually worked starting with the Pixel 3.
It's called Dual-Band Simultaneous or "STA+AP" (Station + Access Point) concurrency that can bridge an existing wifi connection to an access point to other devices via a hotspot.
In my experience hotels throttle wifi connection per device (IP/Mac address or whatever) and so you'd be better off using something that can use the wired connection in your room (which is usually unthrottled or has higher bandwidth) and be an AP for your personal devices.
If you don't have a wired connection then this wouldn't be any better, except for any connectivity features it might offer (probably some vpn capability).
I have a gl-inet device and it does pretty much all I need whenever I travel.
Hotels in Las Vegas typically charge around $15/day per connected device. Want to download a new book on your Kobo and play Diablo for a few minutes? That’ll be $30, please!
Heartily seconded! A friend recommended I get one and now I push all my other technical friends to buy one, too.
My wife and I traveled a bit this year and it was great having all our gadgets connecting to a single AP under our control. It’s easily paid for itself by avoiding ludicrous per-device daily charges.
I think most travel APs can generally do this, but the feature that makes GL.iNet products popular is: extensibility. I'm not sure why this is so hard to understand for manufacturers, but making products useful via extensibility is a sure fire way to open your target market directly up to prosumers. And those are the buyers that will find you.
I own two of their products, one of them I bought in 2019 and can still run what I need to on it.
My wife’s work WiFi is handled by a gl.inet 150 (https://www.gl-inet.com/products/gl-ar150/) which is tucked behind her desk since at least 2019. Vanilla openwrt on it, provides WiFi from an Ethernet slot in the wall.
Uptime is in years, it’s invisible and chugs along without visible power draw. All her devices connect to it, including her Cisco voip phone. It autossh to my ovh server with remote port forward for remote admin. Cost me 15€ in 2016.
>> I'm not sure why this is so hard to understand for manufacturers
> My wife’s work WiFi is handled by a gl.inet 150 (...) since at least 2019. All her devices connect to it (...) Cost me 15€ in 2016.
I think this answers GP's question as (yet another) solid reason why manufacturers "can't understand" prosumer needs - it's because targeting prosumers, or generally making products that "just works", is very bad for sales down the line.
Hehe. Bought TP LINK TL-WR1043ND (one of the first models of affordable home routers with integrated gigabit switch) in 2012 for $40 (maybe $50, but not more), flashed OpenWrt and still using to this day.
Some companies aren't very big, and neither are their budgets. And of course, it might be said that there is no solution more permanent than a temporary one.
We've got a large-ish color laser printer (IIRC, an HP 4600) at one of our locations. It's not a big place; it has only had as many as 3 people working there regularly and has been normally staffed by exactly 1 person for the last several years.
When we moved into that building, a missing link was noticed: The printer did not feature wifi, and there was no way to get a clean ethernet drop to it without visible external conduit. The boss man didn't like the idea of conduit.
To get it working for now, I went over to Wal-Mart and bought whatever the current rev of Linksys WRT54G was. I put some iteration of Tomato on it so it could operate in station mode and graft the printer into the wifi network.
I plugged that blue Linksys box in back in 2007; it turned 18 years old this year.
It's pretty little slow by modern wifi standards, and the 2.4GHz band is much more congested than it used to be, but: It still works, and nobody seems motivated to spend money to implement a better solution... so it remains.
Readers of HN will value flexibility and extensibility, but the other 99% of the folks there are fine with totally locked-down devices because it’s the only thing they know of. The lack of extensibility likely doesn’t affect sales/profit in any significant proportion.
You have roaming but sometimes it’s less data than at home. And you can’t use it for months on end. I have multiple sims from various EU countries. When I visit I top up.
UK is not included, but most UK mobile networks have chosen to pretend the UK hasn't to their customers, and offer similar amounts of voice and data in the EEA, so it still mostly works "one way".
I'm not using it for travel, but I got a GL-BE3600 recently and it's surprisingly decent as a home router for my very specific needs.
I wired the desktop PCs in the house, so the only Wi-Fi users are mobiles, a smart TV, and a laptop. Everything else is already hanging off 2.5G wired switches. Pretty light duty, and I just wanted something that would provide robust routing and placeholder Wi-Fi. This does exactly that, and since it's OpenWRT based, it's probably marginally less terrible than whatever TP-Link was offering in the same price range.
It does run annoyingly hot, but I should just buy a little USB desk fan and point it at the router :P
I've had very impressive success running upstream OpenWRT on TP-Link hardware: I have Archer C7 access points running with literally years of uptime.
That being said, for any new application, I suggest using at least an 802.11ax AP, because cheap 2.4GHz devices that support 802.11ax are becoming common and using an 802.11ac router means that your 2.4GHz devices will be stuck with 802.11n, which is quite a bit less efficient. Even if you don't need any appreciable speed, it's preferable to use a more efficient protocol that uses less airtime.
Ditto, the TP-Link's Archer A7 firmware is a security nightmare [1] but with DD-WRT installed it is very stable and reliable.
[1] Daughter invited ~10 classmates to prepare for a science competition, and one of them had a virus (I assume) that hacked TP-Link's firmware to draft it into a botnet. WAN connection would drop every hour for a few minutes, plus unexplained internet traffic while nobody was using it. Resetting firmware did not help, installing DD-WRT fixed it once and for all.
I think I actually retired an Archer C7 for this. The goal was something 2.5G ready because the city has systematically rolled out fibre to every neghbourhood around here and I'm just waiting for the knock.
Honestly if you're not invested in maybe Ruckus or Aruba, I don't think there's much better than OpenWRT on a decently supported AP. I had a bunch of the C7s with OpenWRT and they've been totally bulletproof. I only upgraded to R650s recently and it's not clear beyond maybe the antenna setup and the fact that it's ax now that it's much better.
This rarely works. The TV network is usually access controlled, so you either won't get an IP or you simply won't have internet access.
Some hotel rooms (particularly older business hotels) will have an ethernet port for the guest. These work maybe 50% of the time these days. Sometimes you can find a Ruckus AP in your room at outlet level, and these usually have several ethernet ports on the bottom. These also have a working port around 30% of the time.
So, TL;DR: various ethernet ports in hotel rooms work less than half the time these days.
How’s that access control handled? Very easy to spoof the MAC of the TV or setup some SNI spoofing proxy server, NGFWs with TLS Active Probing are probably harder to deal with but do hotels really have that?
I could never figure out which gl-inet to get, since some of the newer products seemed less powerful than older ones depending on the product family or something...
> some of the newer products seemed less powerful than older ones
Cynic in me thinks it's because they don't want you to buy one product and be set for a decade, like HN-er here: https://news.ycombinator.com/item?id=46373387. Older products might've been too good.
While on a scuba diving trip in Thailand a couple months ago we could position the router slightly outside our hotel room to be able to be able to strongly connect to the very dodgy hotel wifi so my girlfriend could do her work calls.
It would also automatically log into the captive wifi which seemed to require a login every hour or so.
Another time we Ethernet into it using the cable in another hotel to bypass some ridiculous speed limitations on their access point.
I'm considering getting their model which can take SIM cards, so that we can also failover to mobile networks wherever we are.
I was thinking of using that in combination with Beelink ME Mini N150 with proxmox installed on it and host different net tools, git, etc that’s available on the go. I might be overthinking the setup
Run one wireguard server in your home and one client instance on this router and now all of your devices can share the same residential VPN connection. No fraud blocks or extra verifications from your banking apps, no million suspicious login detected from all your social accounts, use your home netflix account, etc. All without your individual devices running a VPN app.
> Run one wireguard server in your home and one client instance on this router and now all of your devices can share the same residential VPN connection.
You don't need a "travel router" for this. My phone is permanently connected to my server via Wireguard (so that I can access my files from anywhere). Adding another device just requires adding a peer in the server's config file and can be accomplished very quickly. It's not clear what problem the travel router solves, unless perhaps you travel with dozens of devices.
> no million suspicious login detected from all your social accounts,
Why do you need to config wireguard on each device? Connect your phone to your vpn and share the wifi. Works on my android. Struggling to see the value proposition for this device.
Do you have a pixel? On Samsung you cannot share WiFi, Hotspot only works with mobile connections. I learners above that this is possible with pixel phones, makes me want to get one...
Yes, Pixels can definitely do that (I use Graphene). It’s incredible that iPhones are so expensive and yet so limited (can’t share WiFi, terrible file browser…)
Your comment explains why we want a travel router. I have a wire guard setup for my servers.
I'm entirely comfortable with setting that up.
But I value my time enough that I don't want the hassle of that for the various devices my family uses when I can just preconfigure and plug in a tiny device and not have them depend on me being in the same location all the time.
> Adding another device just requires adding a peer in the server's config file and can be accomplished very quickly
Do you need a client to be running on each device?
Even regardless "I just need to edit a config file real quick" is... Way more work than I want to do. Works for someone on hn but I'm imagining trying to show my dad how to do that.
They're suggesting just running off your data plan which works for domestic travel (at least to urban areas with good cell service) and can work for international if you go through getting a data eSim.
chromecast - godsend on long hotel stays. need to dial in through my home (wireguard) so no license issues with streamers and once I connect my GL.iNet GL-MT300N-V2 to hotel wifi instant bubble of safe wifi for all my devices! weighs nothing, been using for 8 years rock solid.
Usually you connect your laptop/phone to the portable router network, which then just pulls up the captive portal. Once you auth from one device, any device behind the router is authed with the portal. This is because the hotel network just sees your router's IP/MAC.
Connect on your phone or other device. Connect to travel router. Clone the mac address of your device. Connect router to wifi. Adjust device to not auto login. Good to go.
GL.iNet routers don't even need this. It has an option to pass through captive portals. So you connect to your GL.iNet AP, then you set it up for the hotel WiFi, tick the option for passing through (it essentially disables VPN, AdGuard Home and other things if enabled), it will then link you to the captive portal where you can log in as you would otherwise.
Once the internet is active, the GL.iNet router will then re-enable things like VPN and AdGuard Home.
Since these devices are OpenWrt underneath with a pretier ui, I presume this is all possible on any OpenWrt device.
The Beryl AX is going for cheaper ($70) on Amazon right now vs the UniFi Travel Router ($80). Better bang for the buck on both hardware and software without needing specific Ubiquiti anything.
The UniFi router depends on you already having a UniFi environment. If you do, it's a good option, but the GL would work with any heterogeneous network
When you are some place with a captive network and want to use devices that don’t have a browser. You connect the router to the WiFi network that has internet access and you connect the other WiFi network to a device with a browser like your phone. Every device looks like one device to the captive network and you can use them all.
Second use case, I now live in a place with a shared internet access that is shared between all of the units. Anyone can broadcast to and control our Roku device and there is no way to block it from the Roku.
One is actually usable wifi at hotels with ethernet cables available. I don't use that device, but a DIY version that also acts as a portable media server while traveling. We can tunnel back to our home network, but often stay places with very bad reception and or internet access. Also helps keep the kids entertained on longer road trips. They can connect their devices to the router as we travel and have full access to the cached media.
I always travel with my GL.iNet GL-MT3000 (Beryl AX) and this is what I use it for:
- My wife and I travel with multiple devices (laptops, phones, Chromecast...) and when we get to a hotel/Airbnb, I simply connect my Beryl AX to their network (it deals with captive portals btw) and all of our devices automatically connect.
- I changed the `/etc/hosts` directly in the router, meaning I can test my local servers under custom domains easily on my other devices like phones/tablets without apps like SquidMan.
- I route specific domains through specific VPNs. Government websites, streaming websites, AWS services, etc.
- I can plug in a 4G USB modem into it and it can automatically fallback to it if the main connection drops.
When I travel, I like carrying as little as possible. These comments are fascinating to me, people are brining more devices than I have in my whole house and needing to make a LAN for them.
Personally I just connect my phone to WiFi and then use Tailscale and call it a day.
It's really dependent upon the expected downtime at the hotel for me. I do about 150 nights in hotels a year.
Some of those trips I'll have extended time of 18+ hours of not really doing anything outside of the hotel other than grabbing dinner. For those types of trips I'm definitely more apt to bring additional devices like my GLinet travel router and MAYBE a streaming stick. I've also brought RPis or MCUs for tinkering during my downtime.
However, other trips I'm with you. I bring my phone, laptop, iPad (required for job), and chargers and that's about it for devices. I really try to limit my packing to things I know I will use and honestly for probably 50% of my travel that's clean clothes, toothbrush, phone, and wallet.
My travel I describe above is solo, work related. When the family comes we tend to tow a 9,000 lbs condo on wheels, so literally the "kitchen sink".
Over time, I've taken less and less stuff. I still take my iPad in a keyboard case for longer trips, and as a backup for 2FA incase something happens to my phone, but now I mostly feel like my phone alone is "good enough." Doomscrolling on the phone works just as well on the road as at home :).
I do load my phone up with eBooks for unexpected downtime, and I do have an emulator on it. I would not chose to use my phone for reading or gaming normally, but on the road it's "good enough" - jack of all trades, master of none.
Of course if I'm traveling for work my work laptop comes, but I never put personal accounts on it.
The only trips I've been on with 18+ hours of down time were due to weather events (getting snowed in on a ski trip). That was with a big group. We just played card games, cooked, talked, and consumed copious amounts of alcohol to pass the time ¯\_(ツ)_/¯.
For me, I can't remember the last time I used a hotel TV. When I travel, I want to do stuff at the place I'm visiting, the hotel room is just a place to sleep and shower.
If I do want to watch something, I much prefer the experience of my much nicer TV and surround sound system at home. That said, I don't watch much TV, so maybe this is easier for me.
If I have downtime when I travel, I tend to just read, or do the same thing I do at home - doomscrolling news, reddit, HN :)
> For me, I can't remember the last time I used a hotel TV. When I travel, I want to do stuff at the place I'm visiting, the hotel room is just a place to sleep and shower.
Again, really depends on what kind of travel you’re doing. What you’re describing sounds like leisure travel, which is awesome. But travel for work is often very different. You’re exhausted from a days work and you’re also often staying in very uninspiring places with little to explore.
I've certainly had work trips like this, and if bringing more devices helps you through it more power to you! This whole thread is kind of fascinating to see how people cope with having their normal day-to-day upended by travel.
For me, even in the boring towns, I've had good luck finding at least restaurants and breweries to explore. Sometimes I do end up falling back to reading books or playing old games on an emulator on my phone. For me, I'm willing to take the compromises of the phone-based entertainment for traveling lighter.
My "family" is multiple devices. M networks (hotel, airport, lounge) and N devices means O(M * N) wifi setups, so carrying a known 200g router means I only have to do O(M+N) setups.
But yeah I also have P family so O(M * P * N) would be a headache.
If your home WiFi uses PSK auth like 99.223% of all homes, you can get to 0 setups by using the same WiFi SSID+PSK on your travel router as the one on your home network.
I have a dedicated travel AppleTV for this. AppleTV is great at hotel captive portals (forwarding the web page to your phone). I am already logged into all my streaming apps, including my home DVR (ChannelsDVR).
Depends a lot on the travel, yes? If I’m going to be out on the town a lot for a couple of days, I’m traveling light. If I’m going to be somewhere for a week and know I’m going to need a lot of decompression time playing Animal Crossing back at the motel, I’ll pack for that instead.
I'm not sure there's a dichotomy. I travel for a week at a time across the country, and bring only a backpack that fits under the seat on the airplane. But there's a GL.iNet router in that bag, since it gives all my devices Mullvad + Tailscale. Good use of space in my opinion, since I can access all the services I host from my home 3000 miles away with zero extra config.
As a someone who has traveled for work more days in the year than not, I'd much rather not require yet another device to carry and deploy in an ever changing network environment.
The multi-uplink is intriguing. While on the surface it seems that an ostensibly 'plug and play' carrier aggregation dongle (no idea if this is actually a feature) would be a easy solution to smooth out poor connections, many networking hiccups encountered during travel just boil down to impossibly terrible RF environments, regardless of the spectrum or protocol.
I did 82 days last year. Everyone travels different, but for me I feel like any time I spend watching TV in the hotel is wasted time - I'm in a whole other city, surely there's something I can do? The hotel is just somewhere to take a shower and sleep. I don't watch much TV in general though so I guess it's easier for me.
If I'm traveling for work, I'm working all day. At the end of the day I often just want to rest in the hotel room, especially if I take my dinner in a restaurant.
Typically I don't watch the hotel TV though, as I don't want to figure out what channels are on it and I probably wouldn't want to watch them anyway. If I watch anything it will be on my iPad.
It really depends. I have a friend who works in hospitality. She travels to some of the nicest hotels in world-class cities. Most of my friends who travel for work are staying in a chain hotel near an office park 25 miles outside the core city they are ostensibly traveling to.
Completely different experiences when it comes to experiencing/exploring the city.
I’m with you, I just turn on Bloomberg and leave it there. When I travel for work, I work all day (some client meetings ant night) and either work out at night or in the morning depending on time zone. Then I enjoy just walking around the city a bit and then sleep.
If this thing can circumvent the China firewall reliably and broadcast non-firewalled Wi-Fi in my hotel room for all my devices so that I don't have to set up VPN on each one, they absolutely have my business.
However I don't think Unifi's default protocols are useful for that. To get reliable performance over China's firewall, you need plausibly-deniable obfuscated protocols, e.g. encoding all your packets inside a stream of requests of JPEGs of cat pictures over HTTP port 80 or some such.
I used to have a UniFi gateway for the nice traffic visualization but Ubiquiti lost my trust when they started running telemetry without consent and I’ve gone back to an OpenBSD’s box as router, thus this device does little for me.
I’m looking forward to the GL.Inet MUDI 7, their first 5G hotspot, which should be running an open-source and hackable OS unlike most hotspots:
To all the commenters who asked if it's worth it? IMO it's super worth it if you have more than one wifi access point and it gets more and more worth it as your network gets more complicated.
I upgraded to homogenous ubiquiti/unifi when I set up a point to multi-point on my farm because I thought it would make that part easier. Surprisingly, those links aren't really baked in to the rest of it, but the router and wifi antennas that I've installed around those links "just work" with a private, protected, and guest network.
I used to have to update two different routers with the same SSID, username and password to make "hopping" from one to the next "seamless" and, now that I've got 8 wifi antennas in a mesh with a single UI to configure them all, I can't even imagine how I'd do it with the hodge-podge of gear I used to work with.
And I'm probably going to buy a travel router, but I'm wondering, if I use it connect to the hotel wifi, will I be able to use the thing as a wifi hotspot as well or do I have to use an ethernet point because the wifi is "taken"?
So… hear me out. Could I connect this to an airline’s paid in-flight WiFi network, and then broadcast an open network to effectively open up access to all other passengers for free? If enough WiFi pirates do this on flights perhaps it would kill paid WiFi entirely (just need enough Good Samaritans)
(And yes I know there are other bypasses you can do like spoofing MAC addresses to get around some device count restrictions)
Is it though? It genuinely looks like you might get caught doing this, and I'm sure you are at least breaking airline policy, even if you're not charging money; not to mention if you charge.
The throttling is "per device", not "per type of device". If you connect 1 travel router and use it to share internet with >1 user, those users are sharing the capped capacity the plane gives to "one connected device".
“Soon”? Why would they give up that money though? I feel like there’s so little competition they aren’t feeling the pressure. Otherwise everyone else would have been hurting 15+ years ago when JetBlue started their free Wi-Fi.
Why? Because Starlink. Starlink requires airlines to offer it for free (apparently, for now), and the airlines that have started offering it are making a big deal out of it because it's actually usable compared to a lot of the LEO- or ground-based offerings before.
United was looking to have its regional fleet done by end of this week, Qatar has finished their 777s; Hawaiian's entire fleet is done, so is airBaltic's. WestJet are also close.
British Airways is starting the rollout now, so are SAS, Air France and a few others.
Maybe. And then get throttled or banned for using too much bandwidth. You don't need this product to do this though, you can do the same thing with a laptop and your phone
Is it? I can’t picture a real situation where other devices would prefer connecting to mine, running down its battery, instead of directly to the wifi it’s broadcasting.
Besides, at least where I live, 5G/4G is often faster than shared wifi. I’d be surprised if this is used by more than 0.1% of all users.
The situation is almost always “weird networking.” A WiFi hotspot too new for a device you have. Captive authentication you can’t solve on your e-reader (this was the case for me at college). Or, as I’m using one right now, as a simple booster (with a battery plugged in).
Given that this has been available on Android for years, I do not consider it an overly difficult feature for Apple
to implement.
Why would this kill paid wifi? A bunch of airlines are already switching to free wifi anyways, but the ones that aren't seem unlikely to just kick back as an army of easily-identifiable tech bros attempt to defraud them. It's a bit like trying to steal money from the bank after you've handed them your ID and debit card.
This is brilliant, actually very innovative product by Unifi. It's interesting because it seems they do what Apple does: they can add new products and features only because all the devices work together in an ecosystem.
The way it automatically connects to your home and presents to your devices as part of your home WiFi. So you bring that device with you and everything else works like you're back home.
I use OPNSense and OpenWRT myself and there's no way you can make travel routers this convenient with them.
Tailscale running in subnet router mode on a GL.iNet router comes close. You can setup Tailscale through the GL.iNet GUI but to have it also route traffic for everything over to your Tailnet you need to flip one setting via an ssh command.
Not as convenient as this travel router sounds though, but comes close-ish for techies. (wish it didn't require that tweak via SSH. Maybe it'll be added)
I wish Eero offered this feature. I bring three eeros to Airbnb’s to replace their crappy WiFi with my same SID, but it would be nice if it connected back through the home internet.
hah, 2nd time in the last couple months I've been compared to that LEGENDARY Dropbox comment...
In my defense, I'd argue that the average Tailscale user would be comfortable running an SSH command! And GL.iNet is just one very minor tweak away to making this entirely possible from the GUI. (though they might be intentionally avoiding it because of the support burden of quirks caused by Tailscale acting as a subnet router...)
Although it does sound really nice from a user experience perspective I'm really hesitant with carrying a device with me that without any (additional) authentication would gain access to my home network wherever you plug it in. Would hate losing it or have it be taken from me.
Why would you assume there's no additional authentication imposed? You definitely need to establish a connection wherever you are, and most likely you do using a dedicated and pre-authenticated app on your phone.
Why do you think this would be difficult to do using openwrt? Wouldn't you just set up the travel router to have the same ssid and password as your home network and configure a wireguard tunnel from the travel router to your home network (that is if you want to be in your home network)
Because manually configuring wireguard tunnels on random devices is a simple task for most people lol. Unifi’s whole stack is all about making powerful tools easier to use for people who don’t want to fuck around with networking.
Agreed. I use Tailscale (which the gl.inet devices support, because they're basically a pretty front end for OpenWRT, and it supports Tailscale) for my stuff, because I can do it and it's not a real pain to do, but you do have to know a bit at least about networking. This thing looks extremely promising for the "I know this should be possible and I want to do it but have no idea how" level of knowledge as well as the "I want to spend as little time as possible on configuring things" people.
But you don't need to configure wireguard on the individual devices just on the openwrt router. That's one device and you can keep that on permanently.
Except that sometimes you can’t. I don’t know if the Unifi router checks for this, but I’ve run into more than one network where the VPN conflicted with either the captive portal or the wireless network itself (and at least one in the DFW Admiral’s club that had draconian blocking)
In a 1 bit environment (==single SSID visible), sure. But most of the time multiple SSIDs are visible, and correlate to each, making detection of abnormalities easier. And the lat/long is also visible to help disambiguate.
It probably needs a panic/border mode to disable all home access in the event of an emergency. You don't want to be crossing borders and give customs officials full access to your home network.
But Unifi should be able to implement this with zero extra hardware, just with VPN-style clients on phones and laptops?
I'm just surprised this needs an extra device. It would make sense if the device provided its own connectivity (with global wireless service, say), but this doesn't seem to be the case here. It still needs an uplink.
I run OpnSense, Wireguard, hooked up to third party WiFi access points, and I had to do a lot of configuration and work that I wouldn't have had to do if I had just bought Ubiquiti equipment.
I did save money, a really significant amount of money.
Obviously, yes, I am capable of going through the work that eliminates my need for this product. I have no trouble configuring Wireguard and setting it up on my client devices and running through all that.
But it was a lot of work to get to this point and I had to spend a lot of time learning how to do that, even as a person who is already technical. Wireguard in particular took me a solid half a day to build understanding and get it configured.
If I was a little bit richer and I went back in time I'd probably just buy all Unifi. Actually if I went back in time I think with my same levels of wealth I'd probably just buy Unifi and save some precious time.
This specific device does seem like a really nice extension of their product line.
The catch is figuring out what's going to stick around and what won't.
I have a Ubiquiti EdgeRouter Lite that's a little over ten years old. At the time, it was revolutionary in its ability to pump a whole lot of data over a cheap device with a lot of features - but a lot of those features weren't available in the GUI at all; you had to go CLI and learn Vyatta (of which it was a fork) to do them. It's been updated over the years and is now much easier to use as the web interface exposes a lot more functionality, but it's not part of Unifi (and never will be).
Early on, I looked at and even tried one of their AP's. 100 Mbps wired uplinks for N wireless? No thanks. Even the one that I got to test with had absolutely abysmal range. Say what you will about TP-LINK generally, but their Omada unified control system had AP's that actually worked in my house. So the early Unifi stuff wasn't anything special, and based on how they had dropped the ball on so much of their early hardware (the EdgeRouter Lite had its software on an internal USB drive that, out of warranty, failed in a way that I was only able to diagnose with a serial console cable - at least it had a port so I could monitor it during boot, and searching for the error messages found a way to replace the thumbdrive and reload the software) I had no reason to go with them.
If I were setting someone up today, with all new gear, I might go Unifi, but I have no reason to spend any time at all replacing a system that works just fine.
What I didn’t like about TP-Link Omada was their weird requirement for a separate controller hardware thing, or running a controller server thing. If I remember right.
I ended up with the OpnSense box plus Zyxel APs. The Nebula cloud offering has been surprisingly good for me: it offers plenty of features in the free tier and the APs don’t actually need the cloud service to be configured if it were to be discontinued.
They phrase it oddly, I think to try to get people to buy a controller, but you only need it for setup, and the free software controller works fine for that. You only really need a hardware controller for a business environment where you expect to manage multiple sites remotely (it can be done remotely but isn’t worth the $80 you save vs having a hardware controller on site). Once configured, the devices will keep on doing their thing after reboots. You will have to fire it up for upgrading devices, but that’s no different from running Unifi without a controller with only AP’s - there has to be a provisioning controller somewhere to get them to work as a true network with seamless handoffs and the like. Otherwise, running in standalone mode, they are just like running consumer AP’s individually.
I have a hardware controller, but I will probably end up putting it in my in-laws’ house because software is fine for where I live. I actually set the whole thing up via software controller and transferred the config when it was all set and I would only be making small changes.
I’m in the market for a solid travel router, and my home network is all Unifi gear. This is a no brainer, especially with the built-in Teleport support.
Not to take away from this device, I think it’s pretty neat. But you can run tailscale on anything, even Apple TVs. If you have a Unifi network odds are that you have at least one spare computing device that can run tailscale.
Problem is that I think my Apple TV goes into some sort of deep idle mode where tailscale stops working. So it’s been effectively useless for me when I travel.
Check the Tailscale blog and docs for AppleTV. ISTR reading about an issue like this popping up and they had a workaround of some sort. Never happened to me.
Wifi 5 for an $80 router in 2026 (I mean we're almost there) is pretty disappointing. I get that its mostly going to be used on crappy hotel networks and the crappy hotel network will often be the bottleneck but $80 looks to be roughly twice the price of the typical travel wifi 5 travel router, about equal to the price of a typical wifi 6 travel router, and only $30-40 cheaper than a typical wifi 7 travel router.
I don't mind a unifi premium for the integration but they should at least have a $50 wifi 5 version and a $100 wifi 6 "pro" version
I don't think they necessarily compete for the same market as some of these other routers. This seems way more compact than many of the other options on the market. I just briefly looked around on Amazon and even many other wifi 5 routers look to be about 2x or thicker than this one. Compared to the GL.inet Opal for example, it's about 20mm smaller in each dimension: 118 x 85 x 30mm (Opal) vs. 95.95 x 65 x 12.5 mm (Unifi). The Unifi is pretty close to a tiny 5000 mAh portable battery.
Now what I'd be really more interested in a Pro version, more so than wifi 6, would be a built-in modem with SIM/eSIM.
Wonder how this will work to connect into hotel networks - on my glinet I have to clone my iPhone MAC address so I basically have to connect to the WiFi, do the with authentication enter room number and last name, then disconnect and boot up the router.
Is there a better way to get these connected to a WiFi for relaying where the Ethernet isn't an option?
I have a gl.Inet and it's very rare that I have to do anything special to get on a captive portal. I just connect to the travel router AP, then connect the travel router to the hotel's WiFi, and browse neverssl.com to get the captive portal.
A $40 router with WiFi to WiFi bridge support like the TP-Link AC750. You connect the router to the captive network and you connect your phone to the router. Connect everything else to the router.
I really like “bring your home everywhere aspect”. I can be a pain connecting my whole family devices to another SSID. If it can do WiFi repeating (as in login to a single hotel account and stream to rest of device), I would absolutely get one. If not, GL inet is still the way to go
Can confirm. It also has a mode to jump through the captive portal. I just set it up with the same SSID and PSK as my home wifi and everything we bring connects automatically. It also routes everything through Tailscale.
Yep, I have the same set up. Use GL router to connect to the hotel wifi, and all devices are automatically connected, without captive portal on each one.
Added bonus that I can use tailscale on the GL router to route remote traffic through my tailnet -- including devices where I can't install tailscale client (e.g. corp laptop).
If you have an Android phone you can connect a USB-C to Ethernet dongle (the same one as you have for your laptop) and get tethering via Ethernet out of it. It works really well.
2 - without prior config only a bunch can do it, like pixels
3 - there's a difference - you can configure wg/ts on a single device(router) and it's done, or you need to do it on 5X+ devices, phones and laptops and fix the configs on all if something changes
Maybe with newer models it's easier, but older ones you needed to go in some advanced settings to allow sharing the wifi, otherwise it'll disable your wifi connection. For pixels it was enough to just enable it from quick menu
I wish one of these devices would have an internal battery again like the old HooToo Tripmates. Using it with a power bank doesn't feel quite the same.
Have Ubiquiti/Unifi firmware/devices ever been subject to independent, third-party security testing? Surely a company charging such a premium for high-end devices has invested in such processes and is proud to showcase them ...
As much I love Unifi products I dislike their privacy policy:
> Usage Data. We may collect certain information about your devices, your network, your system and third party devices connected to your network or system when you use the Services ("Usage Data"), including but not limited to device data, performance data, sensor data, motion data, temperature data, power usage data, device signals, device parameters, device identifiers that may uniquely identify the devices, including mobile devices, web request, Internet Protocol address, location information (including latitude and longitude), browser type, browser language, referring/exit pages and URLs, platform type, the date and time of your request, and one or more cookies, web beacons and JavaScript that may uniquely identify your devices or browser.
Much less expensive (barring diy and print-a-case-yourself), and most importantly to certain people, easily available in the US from Amazon. (Jetkvm also suffers from unclear import costs and delays)
I clone my home WiFi SSID with my travel router so when we arrive at the hotel all of our devices auto connect without having to configure the consent / captive WiFi screen.
It’s also nice to control VPN and DNS from one place , in case the hotel is doing DNS or IP filtering.
And quite a few hotels still offer wired Ethernet , which helps performance.
Hotel wifi is often hilariously slow compared to plugging my travel router into an in-room ethernet socket. From spotty <10mbps to often a full uncontended gigabit.
Makes video conferencing and large downloads usable.
Please also consider the GL-iNEt Puli (XE300):
- 5V 2A USB C connector and a 5000mAh battery
- SIM and [not tested by myself] eSIM support.
- Tailscale and Nebula available as a plug-in.
- Main network and guest network can be set.
- OpenWRT if you want the GL-iNET firmware.
I am running a Netgear Nighthawk when I am on the road. But the Mubi7 looks interesting - I would not want to go back from 5G to a slower networks, sorry :)
"To connect the UniFi Travel Router to a guest network, open the UniFi Mobile App and select a nearby wireless network. If the network has a captive portal, it will automatically forward to your mobile device for login."
It likely relies on the travel router cloning the MAC address of your phone or whatever you use to authenticate. That way the hotel just thinks the travel router is your phone.
Took my PS5 Pro on a work trip. Was livid to find out the horrific 'browser' on the PS5 wasn't able to handle the captive portal login page. $700 gaming rig and it can't load a simple HTML page so I can enter my name and room number?! Ridiculous.
Thought about it for a few minutes and realized that the portal was likely just doing mac filtering. So I adjusted my MacBook Pro's MAC address to be the same as the PS5, went through the portal login and then powered down the MBP. Booted up the PS5 and I was online.
This is brilliant, especially if you are already invested in the Ubiquiti/UniFi Ecosystem. There was a UniFi Teleport, and I think that function is now part of this Travel Router. From the video and the images, I believe this can also be added to a car act as a family wi-fi on the move.
I’ve always had a Pocket Travel Router (along with a thin but long enough RJ45 cable) with me while traveling, starting with the D-Link AC750 Travel Router. It does away with Wi-Fi Change, and all of your devices just continue to work, no worry about syncing, file-transfers, etc. A travel router becomes even more convenient when traveling with the family.
Don't need to do anything specific, doing this with my openwrt router in uni dorm. Router to upstream, phone to router, captive portal shows up on phone just have to login and all devices on router are logged in (and most importantly only count as 1 device)
Details are scarce right now, but they say that via the UniFi mobile you'll authenticate yourself onto the captive portal and the travel router will use that. Guessing it'll clone your phone's MAC?
This won’t replace my GL-AXT1800 which offers a lot more flexibility.
Unifi shipping without eSIM support is a big mistake imo.
I don’t want to have a 5g router(which are insanely expensive) or a second smartphone with 5G.
This is a travel router without a modem. It would be super inconvenient if you bought an eSIM for a device that does not have a modem. You might as well by an eSIM for your toothbrush when you are traveling abroad, it would equally "convenient."
It makes more sense if you are used to Ubiquiti ecosystem. Basically they assume you have Ubiquiti-based home/office network (they call it site). Then this device binds to this site and VPNs to it over Teleport (kinda similar thing to Tailscale, also built on top of wireguard). I would assume you can also configure Wireguard/Open VPN/IPsec manually as this is pretty standard in their ecosystem.
I guess it's nice if you are in Ubiquiti ecosystem already and want as little friction as possible. Otherwise it's probably similar to any travel router.
You don't need this. Strictly speaking, we don't need much.
But a travel router can be nice to have.
I bring some tech with me when I travel.
Obviously a phone, but also a decent-sounding smart speaker with long battery life so I can hear some music of my choosing in decent fidelity without using Bluetooth [bonus: battery-backed alarm clock!], a laptop for computing, a streaming box for plugging into the TV, maybe some manner of SBC to futz with if I'm bored and can't sleep during downtime.
All of this stuff really wants to have a [wifi] connection to a local area network, like it has when I'm at home.
A travel router (this one, or something from any other vendor mentioned in these threads, or just about anything that can run openwrt well) solves that problem.
All I have to do is get the router connected to the Internet however I do that (maybe there's ethernet, decent wifi, or maybe my phone hotspot or USB tethering is the order of the day), and then everything else Just Works as soon as it is unpacked and switched on.
And it all works togetherly, on my own wireless LAN -- just as those things also work at home.
Bonus nachos: With some manner of VPN like Tailscale configured in the router, or the automagic stuff this UBNT device is claimed to be able to do, a person can bring their home LAN with them, too -- without individual devices being configured to do that.
I think travel routers are pretty great, myself.
(But using Ubiquiti gear makes me feel filthy for reasons that I can't properly articulate, so I stick with things like Latvian-built Mikrotik hardware or something running OpenWRT for my own travel router uses.)
In my opinion, you only need this if you don't like connecting to unknown (insecure or suspect) network to get access to the internet. Ideally, you would configure this kind of router to connect to a VPN so that as soon as it connects to the internet, it immediately logins to the VPN and reroutes all your network traffic through it. This makes it more difficult for someone to hijack your connection or crack it. From the comments it also appears that some people use it to connect to their home network, either to access their home server or to use as VPN (this can help you get around geo-fence and unnecessary additional authentications that some services require for fraud prevention). Some travel routers can also combine 2 or more internet connections (public WiFi + mobile data) to provide you a more stable internet connection, which is often desirable.
You have a workplace that insists you are working from your home while you travel.
It has limits, like the amazon hardware keypress thingy with north korea showed recently, but unless your working at superbigtech or defense contractor it would probably work.
connect screenless devices, e.g., Echo Dot
extend weak wireless range in hotel
screen share or network between multiple devices eg travel with two laptops and can virtual KVM
only have to do the captive device on one - many hotels limit number of devices
extra security buffer
phone can't bridge wifi for headless like this
etc etc
All the videos I've seen show it adopted by an existing UniFi site, I wonder if I can still set it up as a standalone device? Hopefully even set up the VPN functionality to some WireGuard server (which was implied somewhere where it listed OpenVPN & WireGuard, can't find it now).
Im their target audience for sure but I’m not sure I need all of the same features my home network has. Really my travel router is just used to share a paid connection and run AdGuard network wide.
I built my Unifi system around my Tailscale network, so I get basically the same benefits for free. I guess you either put in the admin effort up front, or pay the appliance tax on the back. What am I missing?
I’ve been using a travel router with a battery last few years, so if I get internet on a plane, all of our devices get online access vs just one single phone.
I need something like this to share a single wifi connection among devices on a cruise. I don't care about the home network access though. Any recommendations?
You can search for "travel router" on youtube, buy a router like in the videos and done. However, a lot of cruise ships forbid travel routers, so you might need to buy a router which you can take the antenna out (keep the router in one luggage, the antenna in another luggage :-) ). I never did that though.
There are variants of this kind that double as and look like a battery charger (which you should claim) but can also repeat and NAT a wireless signal (which you should helpfully omit). Rumor says mudiv2 but I've never used that so can't confirm.
been using a gl.inet axt1800 for travel and it's been amazing. mainly for hotel wifi where you can login once and all your devices connect automatically. curious how this compares - the unifi ecosystem integration could be nice but gl.inet is way more hackable
UniFi website and marketing is just really really bad. They have amazing products but for some reason they don't really care about consumers and don't really know how to market to consumers. Just look at their website, it's impossible to find anything other than some super super specific networking stuff that you probably need a CCNP to even begin to understand
as a frequent traveler, most of my setup time were spent on captive portal. so unless Unifi changes that dramatically, otherwise the time cost is more of less the same.
No it's provided as part of the Android OS. Very simple and intuitive to use and has been for the past 10 years since I started using it. The only thing that was annoying initially was that you couldn't pass through the WiFi that your phone is connected to but I think that was corrected in later versions of Android. For a time I was using one of my older Pixel phones as a WiFi extender to improve signal in my home's basement. Worked like a charm. I'm honestly surprised this isn't available on iOS.
You are in a hotel, you have a wife two kids. So assume 4 phones, 3 laptops, an ipad, and maybe a chromecast. It is faster and easier and more private to use a travel router, connect to wifi, and create a private network than tp connect and authenticate (and possible pay fees) for every device.
I never travel without my GL-AXT1800. Saved me so many times: https://www.gl-inet.com/products/gl-axt1800/ I’m actually on it right now.
Same! And the best thing is that you can install Tailscale, so you can connect to your tailnet, and exit all traffic through one of your nodes (e.g., your home/office network).
It's incredibly useful, with the added bonus that you don't need to install tailscale client in any of your travel devices (phone, tablet, work computer, etc).
I’m seeing a lot of this same comment here, so I went to check out this tailscale thing, which clearly I must need.
Can anybody explain what Tailscale is, does, or why everybody seems to have it?
Looking at their website, it’s just a huge wall of business jargon. Really! Read it. It’s nothing but a list of enterprise terminology. There’s a “how it works “ page full of more (different) jargon, acronyms and buzzwords, but no simple explanation of why everybody on this thread seems to be paying money for this thing?
Any help? Should I just pay them my $6/month and hope I figure it out at some point?
It's a wrapper around Wireguard that lets you use common SSO providers (Apple ID, Google, etc) to manage access.
It also handles looking up the IP address of your "nodes" through their servers, so you don't need to host a domain/dns to find the WAN IP of your home network when you're external to it (this is assuming you don't pay for a fixed IP).
Most people put an instance of it on a home server or NAS, and then they can use the very well designed and easy to use iOS/mac/etc client to access their home network when away.
You can route all traffic through it, so basically your device operates as if you're on your home network.
You can accomplish all of this stuff (setting up a VPN to your home network, DNS lookup to your home network) without Tailscale, but it makes it so much easier.
TS makes it super easy to use a VPC I have in the US as my VPN exit while I live in other parts of the world. Apps that work on phones, computers, and my AppleTV are big pluses over Wireguard which I have also used.
I was still completely mystified until your last sentence. And now I'm just mostly mystified. I, too, keep hearing Tailscale Tailscale Tailscale from HN commenters but have no idea why I'd need it. For anything I need to access on (or from) my home network I just use a VPN I've hosted in my home for the last decade or so.
If you've already got a VPN solution your happy with, Tailscale probably adds very little value for you. It's just basically the easiest / most user friendly way to setup a VPN to your home network.
It can do way more than just being a VPN-to-home, but that's how most users use the free part.
It's still valuable. You can access your server with your own VPN set up, but what if you want to share a server to a friend or a family member (examples includes VaultWarden/Bitwarden, Plex, Jellyfin)?
If this is on Tailscale, you can just ask people to install tailscale client and login using one of the IdP, then ask them to accept the node you shared to them, and they can immediately access the server.
The alternative would be 1) sending VPN configs over and maybe also configure their VPN client for them, or 2) expose the service on the Internet protected by some OAuth proxy which really only works for web apps. Neither is easy/trivial.
I'd guess a plurality of people are only sharing Plex with family members, and nothing else. If you only care about sharing Plex, you don't need Tailscale to give a family member access, assuming you have Plex Pass, since Plex does a proxy as you describe.
Basically it is managed Wireguard. Tailscale does say it, but it is buried under marketing speak.
It's also P2P mesh rather than hub and spoke which is quite important
It’s worth pointing out that it can be both. The hub and spoke model, relays, is often used for cloud setups where the overhead of installing clients on nodes is not worth the tradeoff
This. People are doing the same thing that OP mentioned in this thread.
Basic version is it's a sort of developer focused zero trust network service.
Encrypted overlay network based on wireguard tunnels, with network ACLs based around identity, and with lots of nice quality-of-life features, like DNS that just works and a bunch of other stuff.
(Other stuff = internet egress from your tailscale network ('tailnet') through any chosen node, or feeding inbound traffic from a public IP to a chosen node, SSH tied into the network authentication.
There is also https://github.com/juanfont/headscale - which is a open source implementation of some of tailscale's server side stuff, compatible with the normal tailscale clients.
(And there are clients for a very wide range of stuff).
I can’t tell if you’re trying to help, or just getting into the spirit of the website’s “how it works (using ten pages of terminology and acronyms we just made up)” page.
None of the terminology or acronyms that user used were made up or unique to this. I think you are blaming other people for your unfamiliarity with this kind of tech.
It is simply a managed service that lets you hook devices up to an overlay network, in which they can communicate easily with each other just as though they were on a LAN even if they are far apart.
For example, if you have a server you'd like to be able to SSH into on your home network, but you don't want to expose it to the internet, you can add both it and your laptop to a Tailscale network and then your laptop can connect directly to it over the Tailscale network no different than if you were at home.
Sorry if I appeared rude. That was very much tongue in cheek.
But notice how you just did a much better job of explaining what this thing does without using any jargon at all. The jargon helps if everyone already knows what you’re talking about. It hurts if anyone doesn’t.
That’s what I’m poking fun at. There’s a trait in lots of engineers I’ve worked with over the years to be almost afraid to talk about tech stuff in layman terms. Like they’re worried that someone will think less of them because they used words instead of an acronym. Like they won’t get credit for knowing what a zero trust network is if they describe the concept in a way that regular people might understand.
One of those guys was certainly in charge of this company’s website copy.
Perhaps if we were on Reddit, and also on a general subreddit, then people would speak in less technical terms.
Since this is HN, it’s almost expected the participants here would either know the terms, or at the very least be able to find out what they mean on their own and realize it’s not made up jargon but rather common industry terms.
Tailscale is not trying to sell to the average buyer, it’s trying to sell to a specific audience.
> But notice how you just did a much better job of explaining what this thing does without using any jargon at all.
There was plenty of jargon and acronyms like LAN and SSH. You're just used to those ones.
> Like they won’t get credit for knowing what a zero trust network is if they describe the concept in a way that regular people might understand.
I've been trying to get a definition of zero trust at $client from the security people who are pushing tools onto our platform, so we can have an honest conversation around threats and risks, and finding the best balance of tools, techniques and processes to achieve their desired outcomes.
Unfortunately, it seems like everybody just want "zero trust" because a vendor sold them on that idea and they gave money to the vendor, so now there's the need to justify that expense and "extract value" from the tool - even if it may in fact be worse than the controls that are already in place.
Your ignorance of the topic is no excuse to be rude to someone who's trying to help you.
That's just networking jargon
It’s Wireguard for lazy people
I don't think you need to pay $6 a month to try it out.
Install it on all the machines you want. When you are running it on the machine, it is networked to the other machines that are running it. Now make an 'exit node' on one of those machines by selecting it in the UI, and all your gear can access the internet via that exit node. Your phone can run it. Your apple tv can run it. You can have multiple exit nodes. So you can have a worldwide network and not once did you have to open ports in firewalls etc.
How does it compare to Zerotier? The way I understand it it's kind of overlapping functionality but not necessarily everything. What I want from Zerotier is basically what you described about Tailscale.
The two problems I have with zerotier are:
1) It's supposed to let a mobile device like an Android tablet route its traffic through zerotier (functioning as a VPN to my home site, in this case). However, I've never got that to work. It's running, but doesn't affect anything network-wise for the other applications (unlike running e.g. openvpn on it)
2) On a couple of computers with specific routing set up to various destinations, when Zerotier runs it simply blocks all of that and there's no way for me to continue accessing anything else than the Zerotier network. No fiddling with routing tables etc. changes any of that. On other computers, also some running OpenVPN, Zerotier does not interfere. I've never figured out what causes this.
So, in short, I'm pondering if I should ditch Zerotier and try Tailscale instead. If it does the same - I simply want a way to connect my devices, but I also don't want to lose total control over routing. For mobile devices I would want full VPN, for computers I don't. Edit: So, I'm both after connecting my multiple networks, as well as VPN'ing certain things or devices through another location.
Thanks for any input on this.
Having tried both Zerotier and Tailscale, I found Tailscale to be a significant improvement. Tailscale uses Wireguard as the base encrypted protocol instead of a semi-homebrew protocol Zerotier came up with that notably lacks things like ephemeral keys/perfect forward secrecy. Tailscale also has a faster pace of improvement and is responsive to customer asks, regularly rolling out new features, improving performance, or fixing bugs. Zerotier by contrast seems to move slower, regularly promising improvements for years that never materialize (e.g. fixing the lack of PFS).
My last gripe is more niche, but I found Zerotier's single threaded performance to be abysmal, making it basically unusable for small single core VMs. My searching at the time suggested this was a known bug, but not one that was fixed before I switched to Tailscale. Not impossible to work around, but also the kind of issue that didn't endear the product to me or inspire confidence.
It's been a minute since I ran ZeroTier, so my memory is fuzzy.
Tailscale and ZT are not the same. ZT can do certain things that TS can't. One example is acting as a layer 2 bridge. Or a layer 3 bridge. TS can do neither. It can achieve mostly similar results though.
ZT can be a pain to setup. TS is a breeze. ZT's raw performance is quite poor. TS's is usually very good.
If I understood you correctly, you want both a way to access your home LAN when you're out - this is easy. Set up a node with NICs on the LAN subnets you want access to (I run it on my router), and configure the TS node to announce routes to those subnets. Install the TS client on your laptop and mobile and accept those routes. Job done.
If you also want to mask your egress - i.e. reach the Internet via your home network as if you were there - then you need a node (can be the same as above) configured to act as an Exit Node. When you want one of your devices to use this, just select the appropriate exit node. Job done.
So, somewhere on that website, there’s a free version that can be downloaded onto a desktop and run without signing up for their service?
I think I understand what it does now. So, basically you leave a computer running at home, and this thing lets you pretend to be running your internet stuff through it while you’re on the road?
> So, somewhere on that website, there’s a free version that can be downloaded onto a desktop and run without signing up for their service?
If you go to https://tailscale.com/pricing?plan=personal
The first plan on the left called 'Personal' is free.
It uses a central orchestrator which is what requires you to sign up. If you prefer to self host your orchestrator you can look into Headscale, an alternative that seeks to be compatible with the clients.
> So, basically you leave a computer running at home, and this thing lets you pretend to be running your internet stuff through it while you’re on the road?
That's one thing you can do with it, yes. You can also run custom DNS entries across it, ACLs, it is very flexible.
Ugh. On mobile, the first plan on the pricing page is “ starter” for $6. The plan to the right is partly visible, indicating that you can scroll that way. There’s nothing to indicate that you can scroll left.
A less hostile website design would have (again) saved me a question.
It seems like it defaults to Business, which is paid. If you tap "Personal" you'll see the free plan.
Sorry, but try a little harder. Tailscale isn't hostile, but it seems you are -- you claim to think you need it, but don't know what it does and can't put in the effort to determine and foist those inabilities on Tailscale?
I've been using Tailscale for many years now and they have a terrific product.
Tailscale is one of the simplest, most useful things I use. I only use the personal plan, but I keep toying with signing up for paid because it’s a damn good product.
The service is free up to certain amount of connected people and devices. You most likely don't need to pay for it. I am pretty heavy user and don't. It is virtual private network orchestrator. It allows you to connect to other devices that you add to your network as long as they are connected to the internet. So your office computer, home server or NAS. If you have some home automation like home assistant you can connect to it from anywhere. That kind of stuff.
You can run it on a capable router or on a RPi, or on your NAS. It's especially useful if you want to self-host (e.g. Immich). You can use it to authenticate for ssh if you like, or simply give you an IP you can ssh to.
It's especially handy if you want a secondary way in, in case you have problems connecting using wireguard, since it supports using a relay if you're stuck in a hotel with a heavily restricted connection.
If you run DNS at home, you can even configure it to use your home DNS and route to your home subnet(s).
Sign up for free using Google Sign In.
Install the tailscale client on each of your devices.
Each device will get an IP address from Tailscale. Think about that like a new LAN address.
When you're away from home, you can access your home devices using the Tailscale IP addresses.
So basically wireguard, but you have to pay for it, and you have create an account through Google/Apple/Microsoft/whatever.
Wireguard is not that hard to set up manually. If you've added SSH keys to your Github account, it's pretty much the same thing. Find a youtube video or something, and you're good. You might not even need to install a wireguard server yourself, as some routers have that built in (like my Ubiquity EdgeRouter)
It's not really "basically wireguard" and you don't have to pay for it for personal use. Wireguard is indeed pretty easy to set up, but basic Wireguard doesn't get you the two most significant features of Tailscale, mesh connections and access controls.
Tailscale does use Wireguard, but it establishes connections between each of your devices, in many cases these will be direct connections even if the devices in question are behind NAT or firewalls. Not every use-case benefits from this over a more traditional hub and spoke VPN model, but for those that do, it would be much more complicated to roll your own version of this. The built-in access controls are also something you could roll your own version of on top of Wireguard, but certainly not as easily as Tailscale makes it.
There's also a third major "feature" that is really just an amalgamation of everything Tailscale builds in and how it's intended to be used, which is that your network works and looks the same even as devices move around if you fully set up your environment to be Tailscale based. Again not everyone needs this, but it can be useful for those that do, and it's not something you get from vanilla Wireguard without additional effort.
I guess I'm still not following. Is there an example thing that you can do with Tailscale that you can't do with Wireguard? "Establishes connections between each of your devices" is pretty vague. The Internet can already do that.
I install tailscale on my laptop. I then install tailscale on a desktop PC I have stashed in a closet at my parents. If they are both logged in to the same tailnet, I can access that desktop PC from my home without any addition network config (no port forwarding on my parents router, UPNP, etc. etc).
I like to think of it as a software defined LAN.
Wireguard is just the transport protocol but all the device management and clever firewall/NAT traversal stuff is the real special sauce.
> software defined LAN
That’s such an elegant way of putting it that they should use it in their marketing.
You can run two nodes both behind restrictive full cone NATs and have them establish an encrypted connection between each other. You can configure your devices to act as exit nodes, allowing other devices on your "tailnet" to use them to reach the internet. You can set up ACLs and share access to specific devices and ports with other users. If you pay a bit more, you can also use any Mullvad VPN node as an exit point.
Tailscale is "just" managed Wireguard, with some very smart network people doing everything they can to make it go point-to-point even with bad NATs, and offering a free fallback trustless relay layer (called DERP) that will act as a transit provider of last resort.
Tailscale is free for pretty much everything you'd want to do as a home user.
It also doesn't constantly try and ram any paid offerings down your throat.
I was originally put off by how much Tailscale is evangelised here, but after trying it, I can see why it's so popular.
I have my Ubuntu server acting as a Tailscale exit node.
I can route any of my devices through it when I'm away from home (e.g. phone, tablet, laptop).
It works like a VPN in that regard.
Last year, I was on a plane and happened to sit next to an employee of Tailscale.
I told him that I thought his product was cool (and had used it throughout the flight to route my in-flight Wi-fi traffic back to the UK) but that I had no need to pay for it!
They still tie you to Google?
Microsoft, Github, and Apple login are the other options if you don't want to use Google.
One of the things keeping me from adopting Tailscale is that I need to sign up with one service, but I can't add multiple services as login options in case one of those SSO providers lock me out, like what happened to Dr Paris Buttfield-Addison with Apple.
Add a second user to your network?
What am I missing?
> Add a second user to your network?
I checked, and Tailscale only allows a single Owner [1], so it would still be pretty disastrous if the Owner account was suspended by the single sign-on organisation.
[1] https://tailscale.com/kb/1138/user-roles#owner
Got it.
So almost like SSO being the paywall for some enterprise apps.
Great, yet another opportunity for Big Tech to track people. I’ll stick to my Wireguard setup, I have a fixed IP and would rather have full control of what is happening by setting up the keys myself than trust a third party.
So zero options that will not tie their service to some other service still.
So much for resilience.
You can self host with Headscale.
You can also use passkeys so you aren't tied to a centralized SSO provider.
... after i sign up for the service with a google/microsoft/whatever account, i suppose.
Not sure if anybody gives you the answer to "what is tailscale?". So, this is my answer (hopefully it's correct and simple enough to understand).
Tailscale allows devices that can access the Internet (no matter how they access the Internet) to see each other.
To do that, you create a tailscale network for yourself, then connect your devices to that network, then your devices can see each other. Other devices that are connecting to the Internet but not to our tailscale network won't see your devices.
AI might explain it better :-) Don't know why I wanted to explain it.
So a VPN?
A multipoint VPN that punches through NAT and can be configured to do a lot of neat things besides.
Nothing that a network guru or even a sufficiently motivated hacker couldn’t do on their own, except that the maintenance is practically zero for the personal user and it’s actually easy enough for a very nontechnical person to use (not necessarily to set up, but to use), perhaps with a bit of coaching over the phone. Want to use a different exit point for your traffic? It’s a dropdown list. Share a file? Requires one config step on the client for macOS, once, and then it’s just in the share menu. Windows, Android, iOS are ready to go without that. Share whole directories? Going to require some command-line setup once per shared directory, but not after that.
There are features that are much more enterprise-focused and not as useful for personal stuff, but everything above is in the free version.
I’m not in tech at all, professionally, and never have been. I’m savvy for an end user - I can install Linux or a BSD, I can set up a network, I can install a VPN myself to get back to my home network - but I would never, ever call myself anything more than an interested layman. I probably could figure most of this out on my own, if I had to. Thing is, I don’t have to. It’s more than just Wireguard in a pretty wrapper.
Try it. It won’t take long to figure out why so many people here like it, even if you may not want to use it.
Extending the question:
In my mind Tailscale was primarily to expose local services but answers here sound a bit as if people used it as a VpN replacement.
If I do not want to expose local services but only protect me and hide from untrusted WiFi, would I better use a traditional VPN or Tailscale?
My thinking is that Tailscale could be the better VPN because they have a clean business model while pure VPN companies are all shady.
Tailscale can tunnel all your traffic through a chosen exit node so you browse the web and whatnot as if you were at home (or wherever the exit node is), so in this way it's a bit like a VPN from a VPN company, but it doesn't give you a list of countries to select from.
VPN companies aren't really in the business of selling VPNs. They sell proxies, especially proxies that let you appear to come from some country, and you typically connect to the proxy using the VPN functionality (particularly if you're using a consumer device instead of a laptop), but often you can use SOCKS5 instead.
Tailscale isn't in the business of selling proxies.
> In my mind Tailscale was primarily to expose local services
You might be thinking of tailscale funnel:
https://tailscale.com/kb/1223/funnel
Which is nice, but still a beta feature. Tailscale itself is indeed a mesh VPN that lets you connect all your devices together.
> If I do not want to expose local services but only protect me and hide from untrusted WiFi, would I better use a traditional VPN or Tailscale?
It does NOT by default route all your internet traffic through one of its servers in order to hide it from your ISP, like the type of VPN you might be thinking of (Mullvad, ProtonVPN etc.).
Though you CAN make it route all the traffic from one of your devices through another, which they call an 'Exit Node'. They also have an integration with Mullvad, which allows you to use Mullvad servers as an exit node. Doing that would be identical to just using Mullvad though.
Tailscale is an enterprise vpn, connecting multiple of your networks, where as consumer vpns just make your network traffic exit from their network.
I run a tailscale exit node on an anonymous vps provider to give me a similar experience to a consumer vpn.
A system by wich you can expose things on your private network (e.g. your home lan) so you can selectively and securely make them accesible from other places (e.g. over the Internet). You can do all this without tailscale by just configuring secure encrypted tunnels (wireshark, traefic, ...) yourself, but services like tailscale provide you with easy gui configuration for that.
I personally use Pangolin, which is similar https://github.com/fosrl/pangolin
For me: it's a way to access services I host on my homelab LAN from 3000 miles away. Having a router that automatically logs into that and routes TS addresses properly allows you to use all your devices connected to that router to access TS services with no further configuration. I host Kiwix, Copyparty, Llama.cpp, FreshRSS, and a bunch of other services on my homelab, and being able to access all of those remotely is convenient.
It's a virtual network switch/router with DHCP, DNS, and lots more enterprisey features on top. You 'plug' devices into it using a VPN connection.
It's a cryptographic key exchange system that allows nodes to open Wireguard tunnels between each other. They have a nice product, but I don't like how it spies on your “private” network by default: https://tailscale.com/kb/1011/log-mesh-traffic
If you want to self-host, use NetBird instead.
Where spies == logging and they tell you, and provide clear opt out instructions
Imagine thinking most people read Knowledge Base articles and don't just take the defaults.
They even manage to squeeze some FUD into the opt-out toggle's name.
they have an excellent set of short intro videos [0] on youtube, that's what I used to get an overview and get set up.
[0] https://youtu.be/sPdvyR7bLqI?si=2kIpHtNuJ52jEdmm
Also the free tier is sufficient for basically anything non power-user or enterprice.
You don't need to get too far down the page to see "VPN", which is what it is. But on top of that primitive, it's also a bunch of software and networking niceties.
It’s a point to point vpn that works between devices even without a direct network connection.
Their personal free plan is more than enough.
Open their GitHub page?
It just virtual private network.
We’re from the US but were recently in Germany. Sometimes we were completely exhausted after a long day and just wanted to rest in our room a little before going to sleep. Our motel had like 2 English speaking channels and both sucked. We watched a lot of German TV because it was interesting, even if we could barely understand what was going on. After some time doing that, it was a pleasure watching some Hulu, courtesy of connecting to WireGuard back at our house in California so that we had an American IP.
I did the same thing recently while visiting family in SE Asia. I wanted to watch my team's bowl game but American college football is unknown in that part of the world. A Wireguard connection back to my home router gave me the ESPN access I pay for in the US.
A few services didn't work because they required my mobile device's location services (which still showed my in Asia). I'm sure I could have found a workaround for that but wasn't properly motivated to put in the effort for a short visit.
In a similar vein, I was able to troubleshoot a problem with our NAS from a cellular connection on a boat near Bali a couple years ago. My son needed access to some files for his college homework but couldn't access it remotely. I was able to access it and reconfigure a setting that had changed during an update and restore his access.
The internet feels like magic sometimes.
> with the added bonus that you don't need to install tailscale client in any of your travel devices (phone, tablet, work computer, etc).
I am sorry, this confuses me. If I don't have a lclient, for example in my laptop, how does my laptop uses Tailscale then?
Also, TailScale Personal says 3 users. Is that a problem for as we are 4? (me, wife, son, doughter).
If Tailscale is installed on your router, then any client will also be able to connect to Tailscale networks.
Fo example, if you have a default route back to your home network on the router, any client will also connect through that tunnel back through your home. This assumes you are using your travel router to connect your laptop as opposed to say the hotel wifi. (In this scenario, your travel router is connected to both the hotel wifi as an uplink and Tailscale.)
Oh, got it.
What about the users? Do I need 4 for my family of 4? Or are the 3 users included in the free plan just admin users?
You only need separate users if you want to restrict certain features (devices, apps, etc.) to only certain users (i.e., it's more of a business thing). My wife's machines all use my username because... she lives with me; if she wanted suddenly to learn networking and computers and hack all our stuff, she could do it anyway since she has physical access.
So pretty much anyone you would trust on your LAN can be trusted with your Tailscale user. You can just log yourself into Tailscale on the kids' devices and then use the admin console to make those devices' logins never expire. They can use all the features, but they don't know your authentication method and thus can't get admin access themselves. About the only situation in which the typical home user would need multiple accounts would be if someone was physically away from you and had a new device they needed to connect to your tailnet (their term for your collection of devices, services, etc.) but you didn't want to share your password with them. If they're physically near you, you just authenticate their device and hand it back to them.
For what it's worth, you get 100 devices total, regardless of number of user accounts. If you don't need the permissions granularity that individual accounts have, consider only having an "admin" and "untrusted" account... or a single account, and pinky promise your family not to play with it.
These are neat in that you can jump on and extend existing wifi infra, but it'd be nice if they also included 5G. I want a product that does both.
It's cool to have your own network in a hotel. But it'd be nice to be able to do that on the road, away from public wifi, internationally, whenever - which hotspots do. But at the same time, it'd be nice to be able to do the WiFi thing too to cut back on data usage. I frequently blow through my hotspot data.
I'd rather this be in one device instead of two. Beggars can't be choosers, though, I suppose?
I’m using a GLinet GL-XE3000 for that and it’s great. Initial setup of the 5G eSIM on a physical SIM took a little searching but it’s been rock solid and having consistent access on the road and hotels has been great for family travel. It has a built-in battery, but I’ve never really tested the duration (I suspect it’s 3-6 hours) as I put it on its AC adapter in the hotel and the n a cigarette lighter adapter in the car, so the battery gets used 15-45 minutes at a time to bridge between those two places.
I like it enough that I might buy a second, more compact unit for when space is more a premium, but I’ve been really happy with this one.
What is your usage scenario for this device? It's $400 and 3/4 kg.
I bought that specific model to provide connectivity for our robotics team’s pit computers. For this need, good antenna performance is key, since different venues differ wildly in WiFi and cell coverage and when we setup the evening before comps, I want the best chance of getting a solid connection and offering it to the pit LAN.
But now that I have it, the device is handy for family travel as well. Put an unlimited data eSIM in the device and everyone has “unlimited” data n the road and when we arrive at a hotel or AirBnB, one person signs it on to wifi and everyone is connected, including tailscale connections to home.
If I was doing personal and work travel only, I’d look for a smaller unit, but still with a decent battery.
According to their website, it weighs 761g.
Right, 3/4 kg is 750 g.
Oh wow, I got completely confused by this usage, and thought it meant 3 to 4 kilograms :)
I will use ¾ next time)
I do want to point out that dumping all of your traffic through a home/office network is not always a good idea. YMMV, but if you are in, say, LA, and pushed your 0.0.0.0 traffic through your home in NY, you just added quite a bit of latency.
This is great for keeping things in a LAN, but make sure you use your network rules correctly and don’t dump everything to your home network unless you need to.
(I too have a gli slate, but I use UI at home so will consider this when it comes out)
I disagree. DNS is generally unencrypted and leaking that over whatever open wifi you're on is generally worse from a privacy perspective than the latency you add bouncing through your home where you probably have encrypted DNS setup.
Even if you don't visit any http sites, you never know what might phone home over http, so an OS level VPN provides foolproof privacy at the cost of a tiny bit of latency.
Using encrypted DNS doesn't necessitate routing all your traffic through your home network. You can still encrypt all your traffic by using an encrypted DNS service or, if you really want to, a VPN service. But moving everything through your home network is not necessary, especially if you have any kind of usage caps.
And to further reinforce this point, one of the basic config variables for wireguard is your dns servers. You could literally send no traffic but your dns queries to the wg tunnel.
DNS is just one example. Like I said on my post you never know what data might be sent home in plaintext
Is this any better than just doing Hotspot with wifi bridge? I just have my hotspot on my pixel for my devices to connect to. Pixel itself is connected to whatever "public wifi" is there.
Your hotspot just makes the untrusted hotel wifi available via your phone wifi. The networks between your computer and your target services can still inspect and alter your data. Tailscale, or more specifically the Wireshark underneat, sets up an encrypted tunnel so those "untrusted" intermediate networks can't do that.
If my phone has a VPN to my home server, then it should all be encrypted.
Yes, but it wont work for sharing mobile internet because VPN doee not apply to tethering unless you have root. On Android there is also WiFi direct, but it's not very reliable and require proxy / not work for everything.
s/Wireshark/wireguard
Does that actually work? I don't think you can both have hotspot on and be connected to another network.
Most newer (or at least new + expensive) phones can share their wifi connection via hotspot. 2.4gh only though I think.
Do you know what’s the technical term to search if a phone has that capability? Asking for an iPhone
Unfortunately, iPhone can't bridge wifi networks, which makes travel routers particularly useful if you have an iphone, and a laptop, and are staying at a hotel with wifi.
Like WiFi tethering?
My iPhone calls it personal hotspot.
It's my understanding that personal hotspot can only utilize the cellular connection for the internet side since the wifi connection is being used to connect clientside. If one is hoping to use hotel wifi rather than their cellular plan data, Apple's solution won't work.
I'd be happy to be proven wrong on this however.
Not only new and expensive, my 5 year old budget phone could do it (a vivo).
Budget Chinese phones often have features that only expensive American or Korean phones have.
Yes, it has actually worked starting with the Pixel 3.
It's called Dual-Band Simultaneous or "STA+AP" (Station + Access Point) concurrency that can bridge an existing wifi connection to an access point to other devices via a hotspot.
Yes it works. Now you can also tether via USB. Both of them have worked flawlessly for me recently.
It seems to be only on certain devices feature(?): on my Pixel it worked, Samsung phone just says "sorry, can't do that".
Works fine, yup.
In my experience hotels throttle wifi connection per device (IP/Mac address or whatever) and so you'd be better off using something that can use the wired connection in your room (which is usually unthrottled or has higher bandwidth) and be an AP for your personal devices.
If you don't have a wired connection then this wouldn't be any better, except for any connectivity features it might offer (probably some vpn capability).
I have a gl-inet device and it does pretty much all I need whenever I travel.
Hotels in Las Vegas typically charge around $15/day per connected device. Want to download a new book on your Kobo and play Diablo for a few minutes? That’ll be $30, please!
That’s the real win of a travel router, IMO.
Is this a common occurrence in the US? It sounds worse than tipping culture.
Nah just Vegas being Vegas. The whole area is designed to squeeze every dollar out of you.
Good to know, in some bizarre way. Thank you!
Huge plus one. Useful to bridge hotel wifi so all my devices connect automatically, also useful as an ad-hoc router that fits into my travel pack.
Heartily seconded! A friend recommended I get one and now I push all my other technical friends to buy one, too.
My wife and I traveled a bit this year and it was great having all our gadgets connecting to a single AP under our control. It’s easily paid for itself by avoiding ludicrous per-device daily charges.
I think most travel APs can generally do this, but the feature that makes GL.iNet products popular is: extensibility. I'm not sure why this is so hard to understand for manufacturers, but making products useful via extensibility is a sure fire way to open your target market directly up to prosumers. And those are the buyers that will find you.
I own two of their products, one of them I bought in 2019 and can still run what I need to on it.
My wife’s work WiFi is handled by a gl.inet 150 (https://www.gl-inet.com/products/gl-ar150/) which is tucked behind her desk since at least 2019. Vanilla openwrt on it, provides WiFi from an Ethernet slot in the wall.
Uptime is in years, it’s invisible and chugs along without visible power draw. All her devices connect to it, including her Cisco voip phone. It autossh to my ovh server with remote port forward for remote admin. Cost me 15€ in 2016.
>> I'm not sure why this is so hard to understand for manufacturers
> My wife’s work WiFi is handled by a gl.inet 150 (...) since at least 2019. All her devices connect to it (...) Cost me 15€ in 2016.
I think this answers GP's question as (yet another) solid reason why manufacturers "can't understand" prosumer needs - it's because targeting prosumers, or generally making products that "just works", is very bad for sales down the line.
Hehe. Bought TP LINK TL-WR1043ND (one of the first models of affordable home routers with integrated gigabit switch) in 2012 for $40 (maybe $50, but not more), flashed OpenWrt and still using to this day.
Isn't this considered to be "shadow IT"? and some enterprise networking devices have automated detection for such setups, I believe (?)
She's her own boss and shares her office space with 4 other people in medical space, no shadow IT there.
Since her desk is far from the internet router, I added this little guy for her to have less cables and allow more connectivity.
Maybe, maybe not.
Some companies aren't very big, and neither are their budgets. And of course, it might be said that there is no solution more permanent than a temporary one.
We've got a large-ish color laser printer (IIRC, an HP 4600) at one of our locations. It's not a big place; it has only had as many as 3 people working there regularly and has been normally staffed by exactly 1 person for the last several years.
When we moved into that building, a missing link was noticed: The printer did not feature wifi, and there was no way to get a clean ethernet drop to it without visible external conduit. The boss man didn't like the idea of conduit.
To get it working for now, I went over to Wal-Mart and bought whatever the current rev of Linksys WRT54G was. I put some iteration of Tomato on it so it could operate in station mode and graft the printer into the wifi network.
I plugged that blue Linksys box in back in 2007; it turned 18 years old this year.
It's pretty little slow by modern wifi standards, and the 2.4GHz band is much more congested than it used to be, but: It still works, and nobody seems motivated to spend money to implement a better solution... so it remains.
Readers of HN will value flexibility and extensibility, but the other 99% of the folks there are fine with totally locked-down devices because it’s the only thing they know of. The lack of extensibility likely doesn’t affect sales/profit in any significant proportion.
Where do you travel that you need wifi?
I’ve been getting SIM cards for over a decade, now even eSIMs are cheap enough for casual use.
I can’t put a SIM in my ereader or Switch or iPad.
Convenient to connect all devices to one WiFi. E.g. baby camera is on same WiFi as laptop etc.
Changing countries a lot reduces this option a bit.
I’m sure I could find a good all Europe card, but I need my number for work calls.
In Europe you have free roaming so it (almost?) never makes sense to get a new sim per country.
You have roaming but sometimes it’s less data than at home. And you can’t use it for months on end. I have multiple sims from various EU countries. When I visit I top up.
To be clear. Within the EU. Not Europe.
EEA, not EU. I had to check as I thought UK was also included. Seems like they left?
UK is not included, but most UK mobile networks have chosen to pretend the UK hasn't to their customers, and offer similar amounts of voice and data in the EEA, so it still mostly works "one way".
I think it's the other way around? Most UK networks seem to charge charge now (the big ones anyway, EE, Vodafone etc.).
At least in Germany, none of our networks do.
I'm with O2 and most certainly does not get charged extra when travelling within the EEA.
They're the last large one that does not charge.
I'm not using it for travel, but I got a GL-BE3600 recently and it's surprisingly decent as a home router for my very specific needs.
I wired the desktop PCs in the house, so the only Wi-Fi users are mobiles, a smart TV, and a laptop. Everything else is already hanging off 2.5G wired switches. Pretty light duty, and I just wanted something that would provide robust routing and placeholder Wi-Fi. This does exactly that, and since it's OpenWRT based, it's probably marginally less terrible than whatever TP-Link was offering in the same price range.
It does run annoyingly hot, but I should just buy a little USB desk fan and point it at the router :P
I've had very impressive success running upstream OpenWRT on TP-Link hardware: I have Archer C7 access points running with literally years of uptime.
That being said, for any new application, I suggest using at least an 802.11ax AP, because cheap 2.4GHz devices that support 802.11ax are becoming common and using an 802.11ac router means that your 2.4GHz devices will be stuck with 802.11n, which is quite a bit less efficient. Even if you don't need any appreciable speed, it's preferable to use a more efficient protocol that uses less airtime.
Ditto, the TP-Link's Archer A7 firmware is a security nightmare [1] but with DD-WRT installed it is very stable and reliable.
[1] Daughter invited ~10 classmates to prepare for a science competition, and one of them had a virus (I assume) that hacked TP-Link's firmware to draft it into a botnet. WAN connection would drop every hour for a few minutes, plus unexplained internet traffic while nobody was using it. Resetting firmware did not help, installing DD-WRT fixed it once and for all.
I think I actually retired an Archer C7 for this. The goal was something 2.5G ready because the city has systematically rolled out fibre to every neghbourhood around here and I'm just waiting for the knock.
Honestly if you're not invested in maybe Ruckus or Aruba, I don't think there's much better than OpenWRT on a decently supported AP. I had a bunch of the C7s with OpenWRT and they've been totally bulletproof. I only upgraded to R650s recently and it's not clear beyond maybe the antenna setup and the fact that it's ax now that it's much better.
I have the same router as the OP article - it ran at 72C until I did [this](https://phasefactor.dev/2024/01/15/glinet-fan.html#choosing-...). Currently running at 60C!
Have you tried hooking it up to an Ethernet port in a hotel room like the one that the TV uses?
This rarely works. The TV network is usually access controlled, so you either won't get an IP or you simply won't have internet access.
Some hotel rooms (particularly older business hotels) will have an ethernet port for the guest. These work maybe 50% of the time these days. Sometimes you can find a Ruckus AP in your room at outlet level, and these usually have several ethernet ports on the bottom. These also have a working port around 30% of the time.
So, TL;DR: various ethernet ports in hotel rooms work less than half the time these days.
How’s that access control handled? Very easy to spoof the MAC of the TV or setup some SNI spoofing proxy server, NGFWs with TLS Active Probing are probably harder to deal with but do hotels really have that?
> Very easy to spoof the MAC of the TV or setup some SNI spoofing proxy server
At that point you're in the 0.1% that the hotel does not really need to worry about. The other >99% will still need to pay for wifi.
it’s probably >0.1% here …
I've read the GL.inet can easily clone the TV Mac, pretty cool.
That won't help you if they use 802.1X.
I’ve never seen that in a motel. It’s a lot of extra network expense to cover something very few people would ever think about.
I've had success hooking it up to some Ethernet cables in hotels, but it's 50/50.
I could never figure out which gl-inet to get, since some of the newer products seemed less powerful than older ones depending on the product family or something...
> some of the newer products seemed less powerful than older ones
Cynic in me thinks it's because they don't want you to buy one product and be set for a decade, like HN-er here: https://news.ycombinator.com/item?id=46373387. Older products might've been too good.
Not sure if you're talking in the context of travel routers, but if you're not, the Flint 2 is always a solid pick.
I think the GL-X3000 could be the daddy for power users and any eventuality: https://www.gl-inet.com/products/gl-x3000/
I really like my GLi microrouter.
https://www.gl-inet.com/products/gl-usb150/
I bought it for my vacations, so I wouldn't have to configure my kid's gadgets, but it is really useful as a wifi adaptor too.
And you can run it from a powerbank.
Do you mind expounding on how it has saved you? I'd love to know the practical use cases.
While on a scuba diving trip in Thailand a couple months ago we could position the router slightly outside our hotel room to be able to be able to strongly connect to the very dodgy hotel wifi so my girlfriend could do her work calls.
It would also automatically log into the captive wifi which seemed to require a login every hour or so.
Another time we Ethernet into it using the cable in another hotel to bypass some ridiculous speed limitations on their access point.
I'm considering getting their model which can take SIM cards, so that we can also failover to mobile networks wherever we are.
I was thinking of using that in combination with Beelink ME Mini N150 with proxmox installed on it and host different net tools, git, etc that’s available on the go. I might be overthinking the setup
What is the benefit of this over, for example, an iPhone hotspot?
Run one wireguard server in your home and one client instance on this router and now all of your devices can share the same residential VPN connection. No fraud blocks or extra verifications from your banking apps, no million suspicious login detected from all your social accounts, use your home netflix account, etc. All without your individual devices running a VPN app.
> Run one wireguard server in your home and one client instance on this router and now all of your devices can share the same residential VPN connection.
You don't need a "travel router" for this. My phone is permanently connected to my server via Wireguard (so that I can access my files from anywhere). Adding another device just requires adding a peer in the server's config file and can be accomplished very quickly. It's not clear what problem the travel router solves, unless perhaps you travel with dozens of devices.
> no million suspicious login detected from all your social accounts,
I can personally do without those.
I can accomplish this via one access point instead of configuring wireguard on N*5 family devices.
Why do you need to config wireguard on each device? Connect your phone to your vpn and share the wifi. Works on my android. Struggling to see the value proposition for this device.
Do you have a pixel? On Samsung you cannot share WiFi, Hotspot only works with mobile connections. I learners above that this is possible with pixel phones, makes me want to get one...
Yes, Pixels can definitely do that (I use Graphene). It’s incredible that iPhones are so expensive and yet so limited (can’t share WiFi, terrible file browser…)
Same with iPhone, you can only share mobile connection.
Does it require specific VPN apps or root? I tried connecting laptop to phone hotspot and even though phone was connected to VPN, laptop wasn't.
So now your phone is a hot spot for your family and you can't leave the hotel room or go 2 hours without charging it?
Your comment explains why we want a travel router. I have a wire guard setup for my servers. I'm entirely comfortable with setting that up.
But I value my time enough that I don't want the hassle of that for the various devices my family uses when I can just preconfigure and plug in a tiny device and not have them depend on me being in the same location all the time.
> Adding another device just requires adding a peer in the server's config file and can be accomplished very quickly
Do you need a client to be running on each device?
Even regardless "I just need to edit a config file real quick" is... Way more work than I want to do. Works for someone on hn but I'm imagining trying to show my dad how to do that.
That's the benefit of a travel router.
An iPhone can't bridge a wifi network. So you need something like a travel router to share a wifi connection.
They're suggesting just running off your data plan which works for domestic travel (at least to urban areas with good cell service) and can work for international if you go through getting a data eSim.
chromecast - godsend on long hotel stays. need to dial in through my home (wireguard) so no license issues with streamers and once I connect my GL.iNet GL-MT300N-V2 to hotel wifi instant bubble of safe wifi for all my devices! weighs nothing, been using for 8 years rock solid.
If you’re using a VPN: iPhone won’t route hotspot clients over the VPN, so you need to set up VPN on all clients.
You can control it from the ground up, including installing alternate firmware. You can also use VPNs etc.
Husband can go pick up food order and baby cam still accessible from wife’s phone.
How do you handle captive portals in hotels ?
Usually you connect your laptop/phone to the portable router network, which then just pulls up the captive portal. Once you auth from one device, any device behind the router is authed with the portal. This is because the hotel network just sees your router's IP/MAC.
Connect on your phone or other device. Connect to travel router. Clone the mac address of your device. Connect router to wifi. Adjust device to not auto login. Good to go.
GL.iNet routers don't even need this. It has an option to pass through captive portals. So you connect to your GL.iNet AP, then you set it up for the hotel WiFi, tick the option for passing through (it essentially disables VPN, AdGuard Home and other things if enabled), it will then link you to the captive portal where you can log in as you would otherwise.
Once the internet is active, the GL.iNet router will then re-enable things like VPN and AdGuard Home.
Since these devices are OpenWrt underneath with a pretier ui, I presume this is all possible on any OpenWrt device.
Is this an annoying amount of steps? And do you have to do this on every expiry of your session on the portal?
Yes these are the way. Use them to get cheap anker security cams to work as baby monitors while we’re in hotel rooms
Is there a 5g dongle I can connect to it? I’ve been searching to no avail
What advantage does this have over the cheaper UniFi router in the OP?
The Beryl AX is going for cheaper ($70) on Amazon right now vs the UniFi Travel Router ($80). Better bang for the buck on both hardware and software without needing specific Ubiquiti anything.
The UniFi router depends on you already having a UniFi environment. If you do, it's a good option, but the GL would work with any heterogeneous network
Thanks! Thats helpful.
It's available right now, for one.
I carry my GL.iNet GL-E750V2 all over the world.
should I be concerned this is Chinese-made? And will the UniFi have similar feature set?
these are awesome, i just take my old wifi router tp-link, its big though. I might have to get one of these little guys.
What’s the use case exactly?
I have this.
TP-Link AC750
https://a.co/d/esxrRA4
When you are some place with a captive network and want to use devices that don’t have a browser. You connect the router to the WiFi network that has internet access and you connect the other WiFi network to a device with a browser like your phone. Every device looks like one device to the captive network and you can use them all.
Second use case, I now live in a place with a shared internet access that is shared between all of the units. Anyone can broadcast to and control our Roku device and there is no way to block it from the Roku.
We create a private network with the router
One is actually usable wifi at hotels with ethernet cables available. I don't use that device, but a DIY version that also acts as a portable media server while traveling. We can tunnel back to our home network, but often stay places with very bad reception and or internet access. Also helps keep the kids entertained on longer road trips. They can connect their devices to the router as we travel and have full access to the cached media.
I am apparently dumb. What benefit does this give you, other than a segregated network? Do us hotels typically have exposed Ethernet ports?
I always travel with my GL.iNet GL-MT3000 (Beryl AX) and this is what I use it for:
- My wife and I travel with multiple devices (laptops, phones, Chromecast...) and when we get to a hotel/Airbnb, I simply connect my Beryl AX to their network (it deals with captive portals btw) and all of our devices automatically connect.
- I changed the `/etc/hosts` directly in the router, meaning I can test my local servers under custom domains easily on my other devices like phones/tablets without apps like SquidMan.
- I route specific domains through specific VPNs. Government websites, streaming websites, AWS services, etc.
- I can plug in a 4G USB modem into it and it can automatically fallback to it if the main connection drops.
- It has built-in Tailscale support.
When I travel, I like carrying as little as possible. These comments are fascinating to me, people are brining more devices than I have in my whole house and needing to make a LAN for them.
Personally I just connect my phone to WiFi and then use Tailscale and call it a day.
It's really dependent upon the expected downtime at the hotel for me. I do about 150 nights in hotels a year.
Some of those trips I'll have extended time of 18+ hours of not really doing anything outside of the hotel other than grabbing dinner. For those types of trips I'm definitely more apt to bring additional devices like my GLinet travel router and MAYBE a streaming stick. I've also brought RPis or MCUs for tinkering during my downtime.
However, other trips I'm with you. I bring my phone, laptop, iPad (required for job), and chargers and that's about it for devices. I really try to limit my packing to things I know I will use and honestly for probably 50% of my travel that's clean clothes, toothbrush, phone, and wallet.
My travel I describe above is solo, work related. When the family comes we tend to tow a 9,000 lbs condo on wheels, so literally the "kitchen sink".
Over time, I've taken less and less stuff. I still take my iPad in a keyboard case for longer trips, and as a backup for 2FA incase something happens to my phone, but now I mostly feel like my phone alone is "good enough." Doomscrolling on the phone works just as well on the road as at home :).
I do load my phone up with eBooks for unexpected downtime, and I do have an emulator on it. I would not chose to use my phone for reading or gaming normally, but on the road it's "good enough" - jack of all trades, master of none.
Of course if I'm traveling for work my work laptop comes, but I never put personal accounts on it.
The only trips I've been on with 18+ hours of down time were due to weather events (getting snowed in on a ski trip). That was with a big group. We just played card games, cooked, talked, and consumed copious amounts of alcohol to pass the time ¯\_(ツ)_/¯.
Jesus, that's a lot of away time. What do you do?
Plenty of us travel with family!
I also think the variable state of hotel TVs is a factor even when travelling alone. Being able to plug your own device into the HDMI is valuable.
Fair enough, I get the TV for kids thing.
For me, I can't remember the last time I used a hotel TV. When I travel, I want to do stuff at the place I'm visiting, the hotel room is just a place to sleep and shower.
If I do want to watch something, I much prefer the experience of my much nicer TV and surround sound system at home. That said, I don't watch much TV, so maybe this is easier for me.
If I have downtime when I travel, I tend to just read, or do the same thing I do at home - doomscrolling news, reddit, HN :)
> For me, I can't remember the last time I used a hotel TV. When I travel, I want to do stuff at the place I'm visiting, the hotel room is just a place to sleep and shower.
Again, really depends on what kind of travel you’re doing. What you’re describing sounds like leisure travel, which is awesome. But travel for work is often very different. You’re exhausted from a days work and you’re also often staying in very uninspiring places with little to explore.
I've certainly had work trips like this, and if bringing more devices helps you through it more power to you! This whole thread is kind of fascinating to see how people cope with having their normal day-to-day upended by travel.
For me, even in the boring towns, I've had good luck finding at least restaurants and breweries to explore. Sometimes I do end up falling back to reading books or playing old games on an emulator on my phone. For me, I'm willing to take the compromises of the phone-based entertainment for traveling lighter.
My "family" is multiple devices. M networks (hotel, airport, lounge) and N devices means O(M * N) wifi setups, so carrying a known 200g router means I only have to do O(M+N) setups.
But yeah I also have P family so O(M * P * N) would be a headache.
If your home WiFi uses PSK auth like 99.223% of all homes, you can get to 0 setups by using the same WiFi SSID+PSK on your travel router as the one on your home network.
I have a dedicated travel AppleTV for this. AppleTV is great at hotel captive portals (forwarding the web page to your phone). I am already logged into all my streaming apps, including my home DVR (ChannelsDVR).
Sounds interesting but I assume only if you have an iPhone and both are tied to an account?
Yes
Depends a lot on the travel, yes? If I’m going to be out on the town a lot for a couple of days, I’m traveling light. If I’m going to be somewhere for a week and know I’m going to need a lot of decompression time playing Animal Crossing back at the motel, I’ll pack for that instead.
I'm not sure there's a dichotomy. I travel for a week at a time across the country, and bring only a backpack that fits under the seat on the airplane. But there's a GL.iNet router in that bag, since it gives all my devices Mullvad + Tailscale. Good use of space in my opinion, since I can access all the services I host from my home 3000 miles away with zero extra config.
Some people spend 100+ days a year in hotels.
As a someone who has traveled for work more days in the year than not, I'd much rather not require yet another device to carry and deploy in an ever changing network environment.
The multi-uplink is intriguing. While on the surface it seems that an ostensibly 'plug and play' carrier aggregation dongle (no idea if this is actually a feature) would be a easy solution to smooth out poor connections, many networking hiccups encountered during travel just boil down to impossibly terrible RF environments, regardless of the spectrum or protocol.
I did 82 days last year. Everyone travels different, but for me I feel like any time I spend watching TV in the hotel is wasted time - I'm in a whole other city, surely there's something I can do? The hotel is just somewhere to take a shower and sleep. I don't watch much TV in general though so I guess it's easier for me.
If I'm traveling for work, I'm working all day. At the end of the day I often just want to rest in the hotel room, especially if I take my dinner in a restaurant.
Typically I don't watch the hotel TV though, as I don't want to figure out what channels are on it and I probably wouldn't want to watch them anyway. If I watch anything it will be on my iPad.
It really depends. I have a friend who works in hospitality. She travels to some of the nicest hotels in world-class cities. Most of my friends who travel for work are staying in a chain hotel near an office park 25 miles outside the core city they are ostensibly traveling to.
Completely different experiences when it comes to experiencing/exploring the city.
I’m with you, I just turn on Bloomberg and leave it there. When I travel for work, I work all day (some client meetings ant night) and either work out at night or in the morning depending on time zone. Then I enjoy just walking around the city a bit and then sleep.
I spent about 30 days this year in hotels and don't envy these people at all.
Yeah same. It is borring, yet unfamiliar enough to chill. Same thing kind of applies to eating out for every meal.
I spend about 200 days in hotels and I don’t want the extra weight or deal with dns/paywall issues
If this thing can circumvent the China firewall reliably and broadcast non-firewalled Wi-Fi in my hotel room for all my devices so that I don't have to set up VPN on each one, they absolutely have my business.
However I don't think Unifi's default protocols are useful for that. To get reliable performance over China's firewall, you need plausibly-deniable obfuscated protocols, e.g. encoding all your packets inside a stream of requests of JPEGs of cat pictures over HTTP port 80 or some such.
I used to have a UniFi gateway for the nice traffic visualization but Ubiquiti lost my trust when they started running telemetry without consent and I’ve gone back to an OpenBSD’s box as router, thus this device does little for me.
I’m looking forward to the GL.Inet MUDI 7, their first 5G hotspot, which should be running an open-source and hackable OS unlike most hotspots:
https://www.gl-inet.com/products/gl-e5800/
I have a little WIFI-6 era GL.iNet travel router and it is fantastic, really like their software and hardware.
https://www.gl-inet.com/products/gl-axt1800/
For both home and travel routers OpenWRT is far and away superior to Unifi gear. Usability, configurability, and especially security.
What makes them more so secure? Configurability I can see, usability maybe, as Ubiquiti is all about simplification and ease of use.
- open source and auditable
- support modern VPN protocols like WireGuard and Tailscale
Open source and auditable I can see.
Ubiquti does support wireguard natively. And you can get Tailscale running if you manually install the package through the SSH CLI.
Ubiquidropped all cloud requirements, but I am not sure what you are referring too here.
I haven't paid attention for a while, but this definitely hurt their brand massively: https://www.theregister.com/2019/11/07/ubiquiti_networks_pho...
Pretty sure that's what OP is referring to.
Exactly.
I’ve been waiting for one of these with built in eSIM support
This one has eSIM and dual physical SIM support.
I’m really struggling to understand the SIM side, the page talks about 5G while tethered to a phone?
I think these models can act as router while leveraging RNDIS tethering if you don't have a separate sim card...
Zero mention of anything other than WiFi on its tech specs page :-/
https://store.ui.com/us/en/category/all-wifi/products/utr
This is incorrect. No sim support here, and no cellular modem either :-)
I was talking about the https://www.gl-inet.com/products/gl-e5800/, it in fact does have eSIM and 2 physical SIM slots.
To all the commenters who asked if it's worth it? IMO it's super worth it if you have more than one wifi access point and it gets more and more worth it as your network gets more complicated.
I upgraded to homogenous ubiquiti/unifi when I set up a point to multi-point on my farm because I thought it would make that part easier. Surprisingly, those links aren't really baked in to the rest of it, but the router and wifi antennas that I've installed around those links "just work" with a private, protected, and guest network.
I used to have to update two different routers with the same SSID, username and password to make "hopping" from one to the next "seamless" and, now that I've got 8 wifi antennas in a mesh with a single UI to configure them all, I can't even imagine how I'd do it with the hodge-podge of gear I used to work with.
And I'm probably going to buy a travel router, but I'm wondering, if I use it connect to the hotel wifi, will I be able to use the thing as a wifi hotspot as well or do I have to use an ethernet point because the wifi is "taken"?
You can connect a UTR to the hotel network, and also connect your devices via WiFi to it; works just like GL.iNet's Slate 7 in this regard.
So… hear me out. Could I connect this to an airline’s paid in-flight WiFi network, and then broadcast an open network to effectively open up access to all other passengers for free? If enough WiFi pirates do this on flights perhaps it would kill paid WiFi entirely (just need enough Good Samaritans)
(And yes I know there are other bypasses you can do like spoofing MAC addresses to get around some device count restrictions)
Really what you should be doing is setting the SSID to "$2 in flight WiFi!" and selling access.
You'll make tens of ... dollars every flight.
And get arrested to boot!
https://www.techradar.com/pro/security/man-arrested-for-sett...
Ok Lol but they got arrested for stealing others people data not for making a wifi on the flight. That's different.
>That's different.
Is it though? It genuinely looks like you might get caught doing this, and I'm sure you are at least breaking airline policy, even if you're not charging money; not to mention if you charge.
Airlines throttle per device, unfortunately.
These travel routers have an option to impersonate the device you are using to get round this.
The throttling is "per device", not "per type of device". If you connect 1 travel router and use it to share internet with >1 user, those users are sharing the capped capacity the plane gives to "one connected device".
That’s not going to be an issue at all domestically soon unless you fly one of the cheapest airlines.
Delta has had free WiFi for awhile now as does JetBlue and I believe Southwest. It’s coming soon to AA and United.
I fly Delta 99% of the time.
“Soon”? Why would they give up that money though? I feel like there’s so little competition they aren’t feeling the pressure. Otherwise everyone else would have been hurting 15+ years ago when JetBlue started their free Wi-Fi.
Why? Because Starlink. Starlink requires airlines to offer it for free (apparently, for now), and the airlines that have started offering it are making a big deal out of it because it's actually usable compared to a lot of the LEO- or ground-based offerings before.
United was looking to have its regional fleet done by end of this week, Qatar has finished their 777s; Hawaiian's entire fleet is done, so is airBaltic's. WestJet are also close.
British Airways is starting the rollout now, so are SAS, Air France and a few others.
>Starlink requires airlines to offer it for free
What's the catch?
Once one airline has it, the other airlines will have to buy it. But Delta is already using another satellites internet service.
Delta and America already are offering free wi-fi on most domestic routes.
Just got back from several flights with Hawaiian, free Starlink on every one.
Maybe. And then get throttled or banned for using too much bandwidth. You don't need this product to do this though, you can do the same thing with a laptop and your phone
They throttle.
Android phones can share their wifi connection like this.
(some android phones: my Pixel can, Samsung can't, although it seems that other Samsungs do have it.)
I installed another app on my S10 to enable this. It's called "Wi-Fi Hotspot" and it works pretty well
Insane to me that Apple still does not support this.
Not that surprising. Unless you’re going to sell access to that hotspot and give Apple a 30% cut, it really wouldn’t interest Tim Cook.
Is it? I can’t picture a real situation where other devices would prefer connecting to mine, running down its battery, instead of directly to the wifi it’s broadcasting.
Besides, at least where I live, 5G/4G is often faster than shared wifi. I’d be surprised if this is used by more than 0.1% of all users.
The situation is almost always “weird networking.” A WiFi hotspot too new for a device you have. Captive authentication you can’t solve on your e-reader (this was the case for me at college). Or, as I’m using one right now, as a simple booster (with a battery plugged in).
Given that this has been available on Android for years, I do not consider it an overly difficult feature for Apple to implement.
I carry a burner Android just for this feature. Great for sharing with my iPhone and iPad on a flight.
Playing with fire. It could be potentially construed as an attempt to steal personal info.
I’ve done this. Works fine. Issue in general is the airlines throttle the heck out of devices.
I basically do this so my gf and I can connect all of our phones and computers.
Probably. I do this with a GLinet and it works great.
Flight internet usually comes with a data quota.
Yes
Why would this kill paid wifi? A bunch of airlines are already switching to free wifi anyways, but the ones that aren't seem unlikely to just kick back as an army of easily-identifiable tech bros attempt to defraud them. It's a bit like trying to steal money from the bank after you've handed them your ID and debit card.
This is brilliant, actually very innovative product by Unifi. It's interesting because it seems they do what Apple does: they can add new products and features only because all the devices work together in an ecosystem.
They were founded by ex Apple employees, so there's that.
Innovative how? Many travel routers already exist and support similar features
The way it automatically connects to your home and presents to your devices as part of your home WiFi. So you bring that device with you and everything else works like you're back home.
I use OPNSense and OpenWRT myself and there's no way you can make travel routers this convenient with them.
Tailscale running in subnet router mode on a GL.iNet router comes close. You can setup Tailscale through the GL.iNet GUI but to have it also route traffic for everything over to your Tailnet you need to flip one setting via an ssh command.
Not as convenient as this travel router sounds though, but comes close-ish for techies. (wish it didn't require that tweak via SSH. Maybe it'll be added)
Something something dropbox is simple :) https://news.ycombinator.com/item?id=9224
I wish Eero offered this feature. I bring three eeros to Airbnb’s to replace their crappy WiFi with my same SID, but it would be nice if it connected back through the home internet.
hah, 2nd time in the last couple months I've been compared to that LEGENDARY Dropbox comment...
In my defense, I'd argue that the average Tailscale user would be comfortable running an SSH command! And GL.iNet is just one very minor tweak away to making this entirely possible from the GUI. (though they might be intentionally avoiding it because of the support burden of quirks caused by Tailscale acting as a subnet router...)
Although it does sound really nice from a user experience perspective I'm really hesitant with carrying a device with me that without any (additional) authentication would gain access to my home network wherever you plug it in. Would hate losing it or have it be taken from me.
Why would you assume there's no additional authentication imposed? You definitely need to establish a connection wherever you are, and most likely you do using a dedicated and pre-authenticated app on your phone.
Why do you think this would be difficult to do using openwrt? Wouldn't you just set up the travel router to have the same ssid and password as your home network and configure a wireguard tunnel from the travel router to your home network (that is if you want to be in your home network)
Because manually configuring wireguard tunnels on random devices is a simple task for most people lol. Unifi’s whole stack is all about making powerful tools easier to use for people who don’t want to fuck around with networking.
Agreed. I use Tailscale (which the gl.inet devices support, because they're basically a pretty front end for OpenWRT, and it supports Tailscale) for my stuff, because I can do it and it's not a real pain to do, but you do have to know a bit at least about networking. This thing looks extremely promising for the "I know this should be possible and I want to do it but have no idea how" level of knowledge as well as the "I want to spend as little time as possible on configuring things" people.
But you don't need to configure wireguard on the individual devices just on the openwrt router. That's one device and you can keep that on permanently.
Except that sometimes you can’t. I don’t know if the Unifi router checks for this, but I’ve run into more than one network where the VPN conflicted with either the captive portal or the wireless network itself (and at least one in the DFW Admiral’s club that had draconian blocking)
> presents to your devices as part of your home WiFi
That will be fun for browser geolocation based on WiFi name.
In a 1 bit environment (==single SSID visible), sure. But most of the time multiple SSIDs are visible, and correlate to each, making detection of abnormalities easier. And the lat/long is also visible to help disambiguate.
Would both the stationary and mobile instances of that SSID be visible on public databases like https://wigle.net?
I think OP meant the opposite issue of broadcasting "I live at 123 evergreen terrace" everywhere you go, because SSIDs are vaguely unique.
You’ve reminded me of a project I started and never got it working. A home network on a vpn to another location.
So the usually ssid is in my home country, and another ssid is based somewhere else geographically.
It probably needs a panic/border mode to disable all home access in the event of an emergency. You don't want to be crossing borders and give customs officials full access to your home network.
If you disable your password saving, I think it would prevent them somehow.
It seems like the main feature is being able to access your home network to watch netflix, access LAN devices, etc.
How is this different compared to running a tailscale exit node in your home network?
Is the benefit of this that you have a hardware device that you can connect to instead of needing software like tailscale?
I have a hard time believing anyone would actually use this versus self-hosting headscale in a discarded ThinkCentre and running it from a closet.
Not sure if you’re serious but reeks of “you can already build such a system yourself quite trivially”
Not serious, and you got it.
Obligatory: https://news.ycombinator.com/item?id=9224
But Unifi should be able to implement this with zero extra hardware, just with VPN-style clients on phones and laptops?
I'm just surprised this needs an extra device. It would make sense if the device provided its own connectivity (with global wireless service, say), but this doesn't seem to be the case here. It still needs an uplink.
That's already an option, too.
I run OpnSense, Wireguard, hooked up to third party WiFi access points, and I had to do a lot of configuration and work that I wouldn't have had to do if I had just bought Ubiquiti equipment.
I did save money, a really significant amount of money.
Obviously, yes, I am capable of going through the work that eliminates my need for this product. I have no trouble configuring Wireguard and setting it up on my client devices and running through all that.
But it was a lot of work to get to this point and I had to spend a lot of time learning how to do that, even as a person who is already technical. Wireguard in particular took me a solid half a day to build understanding and get it configured.
If I was a little bit richer and I went back in time I'd probably just buy all Unifi. Actually if I went back in time I think with my same levels of wealth I'd probably just buy Unifi and save some precious time.
This specific device does seem like a really nice extension of their product line.
The catch is figuring out what's going to stick around and what won't.
I have a Ubiquiti EdgeRouter Lite that's a little over ten years old. At the time, it was revolutionary in its ability to pump a whole lot of data over a cheap device with a lot of features - but a lot of those features weren't available in the GUI at all; you had to go CLI and learn Vyatta (of which it was a fork) to do them. It's been updated over the years and is now much easier to use as the web interface exposes a lot more functionality, but it's not part of Unifi (and never will be).
Early on, I looked at and even tried one of their AP's. 100 Mbps wired uplinks for N wireless? No thanks. Even the one that I got to test with had absolutely abysmal range. Say what you will about TP-LINK generally, but their Omada unified control system had AP's that actually worked in my house. So the early Unifi stuff wasn't anything special, and based on how they had dropped the ball on so much of their early hardware (the EdgeRouter Lite had its software on an internal USB drive that, out of warranty, failed in a way that I was only able to diagnose with a serial console cable - at least it had a port so I could monitor it during boot, and searching for the error messages found a way to replace the thumbdrive and reload the software) I had no reason to go with them.
If I were setting someone up today, with all new gear, I might go Unifi, but I have no reason to spend any time at all replacing a system that works just fine.
What I didn’t like about TP-Link Omada was their weird requirement for a separate controller hardware thing, or running a controller server thing. If I remember right.
I ended up with the OpnSense box plus Zyxel APs. The Nebula cloud offering has been surprisingly good for me: it offers plenty of features in the free tier and the APs don’t actually need the cloud service to be configured if it were to be discontinued.
They phrase it oddly, I think to try to get people to buy a controller, but you only need it for setup, and the free software controller works fine for that. You only really need a hardware controller for a business environment where you expect to manage multiple sites remotely (it can be done remotely but isn’t worth the $80 you save vs having a hardware controller on site). Once configured, the devices will keep on doing their thing after reboots. You will have to fire it up for upgrading devices, but that’s no different from running Unifi without a controller with only AP’s - there has to be a provisioning controller somewhere to get them to work as a true network with seamless handoffs and the like. Otherwise, running in standalone mode, they are just like running consumer AP’s individually.
I have a hardware controller, but I will probably end up putting it in my in-laws’ house because software is fine for where I live. I actually set the whole thing up via software controller and transferred the config when it was all set and I would only be making small changes.
Time is your most precious commodity.
I’m in the market for a solid travel router, and my home network is all Unifi gear. This is a no brainer, especially with the built-in Teleport support.
I think so: it looks like "UniFi Teleport" is also based on Wireguard.
You can also do this with a travel router like one of GL.iNet's and Tailscale subnet routers.
UniFi teleport is also very buggy with frequent disconnects. Tailscale and WireGuard proper don’t have those issues for me.
How would Tailscale run in your home network without a hardware device to connect to?
You can create a subnet router on tailscale and access any device on your local network, regardless of them having tailscale installed
Sure but you need a device on the local network to run Tailscale so it routes to that subnet no?
Not to take away from this device, I think it’s pretty neat. But you can run tailscale on anything, even Apple TVs. If you have a Unifi network odds are that you have at least one spare computing device that can run tailscale.
Problem is that I think my Apple TV goes into some sort of deep idle mode where tailscale stops working. So it’s been effectively useless for me when I travel.
Check the Tailscale blog and docs for AppleTV. ISTR reading about an issue like this popping up and they had a workaround of some sort. Never happened to me.
Never had that, and I use that feature often.
Available December 29th: https://store.ui.com/us/en/products/utr
Wifi 5 for an $80 router in 2026 (I mean we're almost there) is pretty disappointing. I get that its mostly going to be used on crappy hotel networks and the crappy hotel network will often be the bottleneck but $80 looks to be roughly twice the price of the typical travel wifi 5 travel router, about equal to the price of a typical wifi 6 travel router, and only $30-40 cheaper than a typical wifi 7 travel router.
I don't mind a unifi premium for the integration but they should at least have a $50 wifi 5 version and a $100 wifi 6 "pro" version
I'd pay $30 for the software alone that actually works.
I don't think they necessarily compete for the same market as some of these other routers. This seems way more compact than many of the other options on the market. I just briefly looked around on Amazon and even many other wifi 5 routers look to be about 2x or thicker than this one. Compared to the GL.inet Opal for example, it's about 20mm smaller in each dimension: 118 x 85 x 30mm (Opal) vs. 95.95 x 65 x 12.5 mm (Unifi). The Unifi is pretty close to a tiny 5000 mAh portable battery.
Now what I'd be really more interested in a Pro version, more so than wifi 6, would be a built-in modem with SIM/eSIM.
Is there really much difference between Wifi 5, 6, 7, especially when travelling given relatively limited speeds you might find yourself in?
I don't even know what is my Wifi "version" at none of the places I have my routers, things just work for all purposes (work, gaming, streaming).
I didn’t think there was much point in WiFi 6 unless you go 6e and get the 6Ghz frequency?
It’s wifi 5 but the most interesting part is it uses 5w of power max, I thought it’d be more.
That’s a lot of power for a radio you’re right next to. You don’t need 100W to stream Netflix.
Interesting, I was thinking of it more from a travel perspective of running it from a shared power supply or something but you make a valid point.
Based on unifis release schedule that means may 2026
Wonder how this will work to connect into hotel networks - on my glinet I have to clone my iPhone MAC address so I basically have to connect to the WiFi, do the with authentication enter room number and last name, then disconnect and boot up the router.
Is there a better way to get these connected to a WiFi for relaying where the Ethernet isn't an option?
This new Unifi device supports captive portal authentication flows, so you don't need to do that whole shuffle.
Source https://m.youtube.com/watch?v=Ruv550at3k8
I have a gl.Inet and it's very rare that I have to do anything special to get on a captive portal. I just connect to the travel router AP, then connect the travel router to the hotel's WiFi, and browse neverssl.com to get the captive portal.
A $40 router with WiFi to WiFi bridge support like the TP-Link AC750. You connect the router to the captive network and you connect your phone to the router. Connect everything else to the router.
I really like “bring your home everywhere aspect”. I can be a pain connecting my whole family devices to another SSID. If it can do WiFi repeating (as in login to a single hotel account and stream to rest of device), I would absolutely get one. If not, GL inet is still the way to go
Can GL inet not do that? Genuinely asking.
Can confirm. It also has a mode to jump through the captive portal. I just set it up with the same SSID and PSK as my home wifi and everything we bring connects automatically. It also routes everything through Tailscale.
Yep, I have the same set up. Use GL router to connect to the hotel wifi, and all devices are automatically connected, without captive portal on each one.
Added bonus that I can use tailscale on the GL router to route remote traffic through my tailnet -- including devices where I can't install tailscale client (e.g. corp laptop).
This Unifi device is primarily meant as an add-on to exising Unifi setups as it's all well integrated.
can do it
? You just need to set it up once and devices will auto reconnect by default
GL can absolutely do this already.
I never really understand why you'd rather have one of these over just enabling "hotspot" on your phone. Ethernet is the only reason I can think of
If you have an Android phone you can connect a USB-C to Ethernet dongle (the same one as you have for your laptop) and get tethering via Ethernet out of it. It works really well.
What if you want your kid(s) and/or partner(s) to stay connected after you leave the hotel room with your phone?
What if you want to use the hotel's internet connection instead of your roaming data?
What if you want to use wireguard or tailscale to funnel all traffic through your home network?
What if you want to enable your family's devices to connect to your self-hosted services?
1. Fair enough.
2. Most Android phones can do this.
3. Android phones can do this.
4. This is just the same question as 3.
2 - without prior config only a bunch can do it, like pixels 3 - there's a difference - you can configure wg/ts on a single device(router) and it's done, or you need to do it on 5X+ devices, phones and laptops and fix the configs on all if something changes
I've been able to do WiFi-WiFi connection sharing on my last four Samsung phones as well
Maybe with newer models it's easier, but older ones you needed to go in some advanced settings to allow sharing the wifi, otherwise it'll disable your wifi connection. For pixels it was enough to just enable it from quick menu
I think every single pixel I've ever had could share wifi or 4g/5g.
sharing 4g/5g can be done from almost any android phone, sharing current wifi connection through a hotspot isn't a widespread function
2,3 and 4 android can do. 1 is very fair but could be achieved with an old phone, maybe with a rubbish battery plugged in.
we take a webcam to keep eye on dogs sometimes. I use a travel router for that
This is a really fair example.
I wish one of these devices would have an internal battery again like the old HooToo Tripmates. Using it with a power bank doesn't feel quite the same.
GL-iNet’s Mudi product line has an internal battery and eSIM and physical SIM card support.
Mudi V2: https://www.gl-inet.com/products/gl-e750/
They have an upcoming 5G NR WiFi 7 version:
Mudi 7: https://www.gl-inet.com/products/gl-e5800/
Effectively nobody sells Wi-Fi 7 capable gear yet:
https://www.rtings.com/router/learn/research/wifi-7-mlo
Have Ubiquiti/Unifi firmware/devices ever been subject to independent, third-party security testing? Surely a company charging such a premium for high-end devices has invested in such processes and is proud to showcase them ...
As much I love Unifi products I dislike their privacy policy:
> Usage Data. We may collect certain information about your devices, your network, your system and third party devices connected to your network or system when you use the Services ("Usage Data"), including but not limited to device data, performance data, sensor data, motion data, temperature data, power usage data, device signals, device parameters, device identifiers that may uniquely identify the devices, including mobile devices, web request, Internet Protocol address, location information (including latitude and longitude), browser type, browser language, referring/exit pages and URLs, platform type, the date and time of your request, and one or more cookies, web beacons and JavaScript that may uniquely identify your devices or browser.
https://www.ui.com/legal/privacypolicy/#c1
you can disable it in settings https://help.ui.com/hc/en-us/articles/360042384093-Analytics...
You should overlay something else rather than rely on WiFi securiry. Tailscale or a vpn, private cloud or just tls, depending on your threat model.
None of those would not prevent someone owning your device because the firmware has vulnerabilities.
Related, the GLiNet Comet (remote KVM) are also excellent. Have bought one for every elderly family member so I can support them more easily.
This would’ve been great 15y ago, but today they all want help on their phone and there’s no good way of doing that.
Oh, that's tempting. Is there vanilla openwrt or any other all-FOSS firmware for it? I'm rather paranoid about this kind of appliance.
How does it compare to the PiKVM?
Much less expensive (barring diy and print-a-case-yourself), and most importantly to certain people, easily available in the US from Amazon. (Jetkvm also suffers from unclear import costs and delays)
I clone my home WiFi SSID with my travel router so when we arrive at the hotel all of our devices auto connect without having to configure the consent / captive WiFi screen.
It’s also nice to control VPN and DNS from one place , in case the hotel is doing DNS or IP filtering.
And quite a few hotels still offer wired Ethernet , which helps performance.
Hotel wifi is often hilariously slow compared to plugging my travel router into an in-room ethernet socket. From spotty <10mbps to often a full uncontended gigabit.
Makes video conferencing and large downloads usable.
I hadn't considered this advantage. Hotel wifi is indeed often crappy.
Please also consider the GL-iNEt Puli (XE300): - 5V 2A USB C connector and a 5000mAh battery - SIM and [not tested by myself] eSIM support. - Tailscale and Nebula available as a plug-in. - Main network and guest network can be set. - OpenWRT if you want the GL-iNET firmware.
I am running a Netgear Nighthawk when I am on the road. But the Mubi7 looks interesting - I would not want to go back from 5G to a slower networks, sorry :)
>while captive portal logins on hotel networks are handled quietly in the background.
Anyone know how it automagically sorts out connecting to the hotel WiFi?
Hotels often want some combination of my room number and surname I've found, or some combination of hotel name and floor password.
"To connect the UniFi Travel Router to a guest network, open the UniFi Mobile App and select a nearby wireless network. If the network has a captive portal, it will automatically forward to your mobile device for login."
from the FAQ https://store.ui.com/us/en/products/utr
It likely relies on the travel router cloning the MAC address of your phone or whatever you use to authenticate. That way the hotel just thinks the travel router is your phone.
It’s also (I’d hope) modifying the ttl as that’s used to detect travel routers.
It doesn't. You connect it to the hotel wifi and then complete the captive portal requirements on your phone, laptop, etc.
Took my PS5 Pro on a work trip. Was livid to find out the horrific 'browser' on the PS5 wasn't able to handle the captive portal login page. $700 gaming rig and it can't load a simple HTML page so I can enter my name and room number?! Ridiculous.
Thought about it for a few minutes and realized that the portal was likely just doing mac filtering. So I adjusted my MacBook Pro's MAC address to be the same as the PS5, went through the portal login and then powered down the MBP. Booted up the PS5 and I was online.
Damn it feels good to be a gangster.
Sometimes it's also possible to simply disconnect the hotel's SIP phone from the Ethernet jack and use that :)
This is the way. Nice job!
This is brilliant, especially if you are already invested in the Ubiquiti/UniFi Ecosystem. There was a UniFi Teleport, and I think that function is now part of this Travel Router. From the video and the images, I believe this can also be added to a car act as a family wi-fi on the move.
I’ve always had a Pocket Travel Router (along with a thin but long enough RJ45 cable) with me while traveling, starting with the D-Link AC750 Travel Router. It does away with Wi-Fi Change, and all of your devices just continue to work, no worry about syncing, file-transfers, etc. A travel router becomes even more convenient when traveling with the family.
> Automatic handling of captive portal authentication
Very curious about how they're pulling this off
Don't need to do anything specific, doing this with my openwrt router in uni dorm. Router to upstream, phone to router, captive portal shows up on phone just have to login and all devices on router are logged in (and most importantly only count as 1 device)
Details are scarce right now, but they say that via the UniFi mobile you'll authenticate yourself onto the captive portal and the travel router will use that. Guessing it'll clone your phone's MAC?
This won’t replace my GL-AXT1800 which offers a lot more flexibility.
Unifi shipping without eSIM support is a big mistake imo. I don’t want to have a 5g router(which are insanely expensive) or a second smartphone with 5G.
It doesn't have a modem. Why would it support eSIM?
It would be super convenient, given it's size, for me to purchase a eSim card abroad with unlimited data and not having to drain my phone battery.
This is a travel router.
This is a travel router without a modem. It would be super inconvenient if you bought an eSIM for a device that does not have a modem. You might as well by an eSIM for your toothbrush when you are traveling abroad, it would equally "convenient."
Tailscale? (I don't think it does)
WAN connectivity via USB tethering and ethernet, not just wifi?
The blog has almost no details, but the product page is also pretty light on technical details.
The competition (I use GL-MT3000) is pretty strong.
It makes more sense if you are used to Ubiquiti ecosystem. Basically they assume you have Ubiquiti-based home/office network (they call it site). Then this device binds to this site and VPNs to it over Teleport (kinda similar thing to Tailscale, also built on top of wireguard). I would assume you can also configure Wireguard/Open VPN/IPsec manually as this is pretty standard in their ecosystem.
I guess it's nice if you are in Ubiquiti ecosystem already and want as little friction as possible. Otherwise it's probably similar to any travel router.
I travel internationally all the time. Someone tell me why I need this.
You don't need this. Strictly speaking, we don't need much.
But a travel router can be nice to have.
I bring some tech with me when I travel.
Obviously a phone, but also a decent-sounding smart speaker with long battery life so I can hear some music of my choosing in decent fidelity without using Bluetooth [bonus: battery-backed alarm clock!], a laptop for computing, a streaming box for plugging into the TV, maybe some manner of SBC to futz with if I'm bored and can't sleep during downtime.
All of this stuff really wants to have a [wifi] connection to a local area network, like it has when I'm at home.
A travel router (this one, or something from any other vendor mentioned in these threads, or just about anything that can run openwrt well) solves that problem.
All I have to do is get the router connected to the Internet however I do that (maybe there's ethernet, decent wifi, or maybe my phone hotspot or USB tethering is the order of the day), and then everything else Just Works as soon as it is unpacked and switched on.
And it all works togetherly, on my own wireless LAN -- just as those things also work at home.
Bonus nachos: With some manner of VPN like Tailscale configured in the router, or the automagic stuff this UBNT device is claimed to be able to do, a person can bring their home LAN with them, too -- without individual devices being configured to do that.
I think travel routers are pretty great, myself.
(But using Ubiquiti gear makes me feel filthy for reasons that I can't properly articulate, so I stick with things like Latvian-built Mikrotik hardware or something running OpenWRT for my own travel router uses.)
In my opinion, you only need this if you don't like connecting to unknown (insecure or suspect) network to get access to the internet. Ideally, you would configure this kind of router to connect to a VPN so that as soon as it connects to the internet, it immediately logins to the VPN and reroutes all your network traffic through it. This makes it more difficult for someone to hijack your connection or crack it. From the comments it also appears that some people use it to connect to their home network, either to access their home server or to use as VPN (this can help you get around geo-fence and unnecessary additional authentications that some services require for fraud prevention). Some travel routers can also combine 2 or more internet connections (public WiFi + mobile data) to provide you a more stable internet connection, which is often desirable.
You have a workplace that insists you are working from your home while you travel.
It has limits, like the amazon hardware keypress thingy with north korea showed recently, but unless your working at superbigtech or defense contractor it would probably work.
connect screenless devices, e.g., Echo Dot extend weak wireless range in hotel screen share or network between multiple devices eg travel with two laptops and can virtual KVM only have to do the captive device on one - many hotels limit number of devices extra security buffer phone can't bridge wifi for headless like this etc etc
All the videos I've seen show it adopted by an existing UniFi site, I wonder if I can still set it up as a standalone device? Hopefully even set up the VPN functionality to some WireGuard server (which was implied somewhere where it listed OpenVPN & WireGuard, can't find it now).
You’re probably better off getting a GL device. They already have support.
Really wish their press Release / marketing want obviously llm generated.
Im their target audience for sure but I’m not sure I need all of the same features my home network has. Really my travel router is just used to share a paid connection and run AdGuard network wide.
I built my Unifi system around my Tailscale network, so I get basically the same benefits for free. I guess you either put in the admin effort up front, or pay the appliance tax on the back. What am I missing?
I’ve been using a travel router with a battery last few years, so if I get internet on a plane, all of our devices get online access vs just one single phone.
I don't understand this post. Is it an ad?
I have wireguard running on my home router. Why do I need a piece of hardware when my laptop already can connect to it from anywhere?
I've been to many hotels/apartments where you have to place the router on a very specific location because the Wifi/4G/5G coverage is super bad.
With Teltonica/GL.Inet you also can use small external antennas. Getting behind windows is often enough.
This is for those not aware of that setup lmao
I need something like this to share a single wifi connection among devices on a cruise. I don't care about the home network access though. Any recommendations?
You can search for "travel router" on youtube, buy a router like in the videos and done. However, a lot of cruise ships forbid travel routers, so you might need to buy a router which you can take the antenna out (keep the router in one luggage, the antenna in another luggage :-) ). I never did that though.
There are variants of this kind that double as and look like a battery charger (which you should claim) but can also repeat and NAT a wireless signal (which you should helpfully omit). Rumor says mudiv2 but I've never used that so can't confirm.
Does this also bridge L2 stuff so I am actually on my LAN?
Otherwise I don't really see the point to carry a specific hotspot device when my phone has one built in.
been using a gl.inet axt1800 for travel and it's been amazing. mainly for hotel wifi where you can login once and all your devices connect automatically. curious how this compares - the unifi ecosystem integration could be nice but gl.inet is way more hackable
If I want to run NixOS on a cheap travel router, what are my best options?
Ideally mainline Linux support.
Brief research suggests one of the NanoPis.
It reads "Tethered 5G", why would a high-end travel router not support sim/e-sims directly?!
Why would it? 5G modems are expensive. GL.iNet makes something like that, Puli AX — it usually goes for around $350 [1].
[1]: https://store.gl-inet.com/products/puli-ax-xe3000-wi-fi-6-5g...
79$ is not “high end”. 5G enabled router would cost twice as much - for a feature that not everybody will need.
If this has a wifi antenna port would be very useful for marina wifi if you’re sailing around.
The page doesn't even have a buy button. Why?
UniFi website and marketing is just really really bad. They have amazing products but for some reason they don't really care about consumers and don't really know how to market to consumers. Just look at their website, it's impossible to find anything other than some super super specific networking stuff that you probably need a CCNP to even begin to understand
Because it's not available until the 29th
Oh I thought one with 5g cellular connectivity
$79 is over priced, get a GL.iNet
Or just go Tailscale
$79 is so cheap that if it saves you 5 min in setup it pays for the difference to a GL.iNet/tailscale setup.
as a frequent traveler, most of my setup time were spent on captive portal. so unless Unifi changes that dramatically, otherwise the time cost is more of less the same.
it says travel but not supporting LTE/5G
Travel to a hotel.
Yea if this had 5g it would be worth it
Yeah you're not gonna get a cellular modem under $100 USD. Sorry
[dead]
whats the point of this? I got wireguard on my phone connected to my home network (also unifi).
If this device had a 5g sim slot, then I could see the point but it’s not that.
The main benefit of a travel router is creating a private network, and sharing a wifi connection. An iPhone can't do that, though Android phones can.
> though Android phones can
Interesting, as someone who has always used iPhones, wouldn't mind getting an Android phone for this.
Is there some app?
No it's provided as part of the Android OS. Very simple and intuitive to use and has been for the past 10 years since I started using it. The only thing that was annoying initially was that you couldn't pass through the WiFi that your phone is connected to but I think that was corrected in later versions of Android. For a time I was using one of my older Pixel phones as a WiFi extender to improve signal in my home's basement. Worked like a charm. I'm honestly surprised this isn't available on iOS.
Some third party WiFis limit the number of devices. This gets around that limit.
Sharing where? All my devices can connect directly thru to Wireguard vpn on my home network. Ipad, iphone, MBP, etc
A 5g phone tethering to your Wireguard connected MBP beats this out of the water
You are in a hotel, you have a wife two kids. So assume 4 phones, 3 laptops, an ipad, and maybe a chromecast. It is faster and easier and more private to use a travel router, connect to wifi, and create a private network than tp connect and authenticate (and possible pay fees) for every device.