the whole idea, in one line
The VPN lives on a travel router — never on your work laptop.
Your laptop's only connection to the world is an ethernet cable. It never touches local WiFi in its life.
That single rule kills the three things that actually catch people: the VPN app running on the work machine, the WiFi it scans to figure out where you are, and the local network quietly logging you. Instead, the laptop plugs into a little router over ethernet, the router carries the encrypted tunnel, and your work traffic comes out somewhere you chose in advance. That's the whole trick — everything below is just the parts that make that one box work.
part 1 · the router
Buy one of these two. Skip the cheap one.
You want a GL.iNet travel router — palm-sized, powered over USB-C, with WireGuard and a kill-switch built right in and VPN obfuscation in the current firmware. Two of them are worth your money. The third one isn't, at least not as the router you actually work off of.
-
GL.iNet Beryl AX (GL-MT3000)~$90
buy this one
This is the one I'd hand you today. It runs Wi-Fi 6, joins hotel and cafe WiFi in repeater mode, has a real kill-switch, and does obfuscation on the 4.x firmware — all from something that fits in your palm and runs off a USB-C cable. Unless you've got a specific reason to reach for more, this is the answer.
-
GL.iNet Slate 7 (GL-BE3600)~$120–150
buy this if you want future-proof
The flagship. It runs Wi-Fi 7 and pushes WireGuard at around 900 Mbps, so the tunnel is never the thing slowing you down. Worth it if you'd rather pay more now and not think about speed for the next few years.
-
GL.iNet Opal (GL-SFT1200)~$40
skip it as your main
The cheap one can't keep up. Its processor chokes trying to push the VPN and your speeds fall through the floor. Keep one in the bag as a dead-simple backup if you like, but don't make it the machine you rely on. The old subreddit guides still point people here — they're a couple of hardware generations out of date.
If you'd rather not set it up yourself, FlashedRouter sells these already configured. It's cheaper to do it yourself, and the firmware genuinely walks you through it — but the shortcut is there if you want it.
part 2 · the vpn — read this twice
Where your traffic comes out is the whole ballgame.
Your work traffic has to exit the internet somewhere, and wherever that is becomes what your employer sees. Every other decision on this page hangs off this one.
So here's the honest ranking — and I'm going to tell you what I actually did, not the textbook ideal, because the textbook ideal isn't what carried me through most of those countries.
Your own line at home — the cleanest option.
The best setup is a real internet line at your own place, or a trusted relative's, sitting in the city your employer thinks you live in. It reads as an ordinary home connection and sails through every check that lights other setups up — half the time it isn't even obvious you're on a VPN at all. I stood mine up from my house in Pennsylvania. The catch is that it's more work, and it's fragile in one specific way: if the power flickers at home while you're 8,000 miles away, your connection goes down with it.
A good commercial VPN — what I actually ran most of the time.
I'll be straight with you: I ended up using ExpressVPN more than my own server, simply because it always worked and it was easy. Running it on the router with the kill-switch on is a real setup, not the amateur move — the amateur move is putting the app on the laptop. The tradeoff is that a commercial endpoint can look like one: employers now buy services like Focsec, Spur, and MaxMind that flag an IP as is_vpn or is_datacenter. Your location stays hidden, but a curious IT person can tell you're hiding something. On a don't-ask-don't-tell job, that's usually fine. On a hostile one, it isn't.
Whatever you pick, carry a backup.
The tunnel will fail on you eventually, always at the worst possible moment. Mine did — ExpressVPN wouldn't connect from a hotel in Barcelona right before a work call, so I pulled up a NordVPN config and had it running from the lobby in about ten minutes. Save a second provider's config before you leave. This one isn't optional.
Whatever you run, turn the kill-switch on so nothing leaks the instant the tunnel drops. It's the single most important switch on the device, and it's the one every person who gets caught forgot to flip. And if you're headed somewhere that actively blocks VPNs, switch on obfuscation (AmneziaWG) — it strips WireGuard's fingerprint so deep-packet inspection just sees anonymous traffic it can't identify.
part 3 · the leak you forgot about
Your personal phone is the informant.
You can build the laptop side flawlessly and still get made — by the phone sitting in your pocket.
Every work app on your personal phone — Outlook, Teams, Slack, an MDM profile — checks in from your real local network. Your laptop swears you're in Austin while your phone quietly tells them you're in Bali, and nobody had to go digging to notice the two stories don't line up. Here's how to close that gap, cleanest option first.
Best: keep work off the personal phone entirely
The simplest fix is also the strongest one — no Outlook, no Teams, no MDM, nothing work-related on your personal phone at all. If work only ever lives on the work devices, the phone has nothing to report. This is the wall the people who never get caught actually keep.
If you can't: put it behind the same tunnel
If you have to keep work apps on it, at least connect the phone to your router's WiFi so it exits where the laptop does. Even then, turn cellular data off, because roaming and local carriers give up your real location the moment the WiFi hiccups. Kill location services and forget every foreign network while you're at it.
The number itself
Your phone number is its own leak. A roaming SIM will hand your location to anyone who asks the carrier for it — they sell that data. If you've given that number out widely, think about leaving the physical SIM at home and receiving your calls and texts through a forwarding or web setup instead.
part 4 · prove it's working before you log in
Two free tools, thirty seconds, every single time.
Before you open a single work app — every session, not just the first day — run these two checks.
Shows you where your public IP geolocates, and whether it reads as a residential connection or a datacenter/VPN. You want residential, in the city you're claiming.
Confirms your DNS requests aren't sneaking out around the tunnel. Every result should land near your exit location, never your real one. While you're at it, turn off IPv6 on the laptop — it leaks, and your VPN will warn you it does.
a real one — this is why "close enough" isn't
I had the whole thing built perfectly once and still nearly torched it — all because I left the laptop's WiFi radio on. It never connected to anything. But a system update rebooted the machine, the radio came back up, and it quietly scanned the network names around me. The second the router handed it internet, those names went home — and my laptop geolocated its real spot and set the clock to a country I was standing in but very much not supposed to be.
Nobody ever said a word. But the IP was flawless the entire time — a radio I forgot to kill is what almost ended it. Which is exactly why the next rule isn't negotiable: on the work laptop, WiFi and Bluetooth go off, for good. Ethernet only. Set the timezone by hand, kill auto-timezone, and delete every saved foreign network.
the whole box
The shopping list.
What actually goes in the bag
- GL.iNet Beryl AX (GL-MT3000) — the router~$90
- USB-C ethernet adapter (laptop → router)~$15–25
- A powered USB-C hub or high-output port, so the router doesn't starve under load~$20–35
- A power bank that can actually drive it~$30–50
- ExpressVPN (or your pick) plus a second provider's backup config~$8–13/mo
- Short ethernet cable~$8
Call it ~$175–200 up front, plus the VPN subscription. That's the price of not getting the dreaded email — and the alternative costs a whole paycheck.
The Letters
I write a letter most mornings. Escapes, systems, the life after.
The first one lands today. Then most mornings.
Here's the one thing a gear list can't do for you
The router you should buy actually comes down to something this page can't see: your employer's setup. If they force you onto a corporate VPN that inspects traffic, run MDM that streams GPS, require hardware attestation, or geofence every login, this box doesn't beat any of that — and no shopping list can tell you which of those buckets your job falls into. That's a read on your exact situation, and your exact situation is where people get caught.
And if you don't have the remote job yet, don't buy any of this. Grab the Offer Accelerator first — the whole job-search automation system, normally $97, but I'm feeling generous, so it's yours free.
The Jailbreak · one sitting
One hour on your exact situation. We read your employer's stack, pick the gear for your job, build your exit the clean way, and flag the tax and visa lines before they bite. You walk away with the whole thing planned and your Escape File in hand — not another checklist to interpret on your own.
Not sure where you are? Take the Escape Map →
See the Jailbreak
40+ countries, multiple corporate paychecks, zero detections — the method, pointed straight at your box.
