Every person who downloads a VPN, books a one-way flight, and thinks they cracked it — they're the ones who get the dreaded email six weeks in. "We need you back in the country by Monday."
The VPN isn't hiding you. The VPN is the flare. Companies now buy tools — Focsec, MaxMind, Spur — that flag the VPN itself: your login IP comes back is_vpn=true, is_datacenter=true, and a bored IT guy reads it in a log. The bored ones are the ones who go looking. So we're not going to rely on a VPN. We're going to build a box.
Part 1
The setup — what to buy, how to build it.
The whole trick is one idea: the VPN lives on a travel router, never on your work laptop. The laptop never touches local WiFi. Ever. It only ever sees an ethernet cable.
That kills the three things that catch people — the VPN on the work machine, the WiFi it scans to geolocate you, and the local network it logs.
What to buy
-
GL.iNet Beryl AX (GL-MT3000)~$90
This is THE one. Wi-Fi 6, built-in WireGuard client, Repeater/WISP mode to ride hotel and cafe WiFi, a VPN kill-switch, obfuscation in the 4.x firmware, runs off USB-C, fits in your palm. Buy this unless you have a reason not to.
-
GL.iNet Slate 7 (GL-BE3600)~$120–150
The flagship. Wi-Fi 7, WireGuard speeds around 900 Mbps so the tunnel is never your bottleneck. Buy it if you want future-proof and don't mind paying more.
-
Skip the cheap GL.iNet Opal as your daily driver—
The weak CPU chokes the VPN. Fine as a backup in the bag, not the main.
Want the full parts list — cables, adapters, power — and the phone side broken out? That's The Gear List.
The build
- Decide your exit IP before you leave — this is the whole ballgame.
Your work traffic has to come OUT of somewhere, and that somewhere is what your employer sees. Here's the honest version, from what I actually ran:
Your own line at home. The cleanest bet.
A real internet line at your actual home — your own router, in the city they think you live in. It reads as a normal home ISP and clears every check that lights other people up. It won't even be obvious you're using a VPN. I set mine up from my house in Pennsylvania. A rented "residential IP" is not the same bet — half come out of proxy pools that Focsec and Spur increasingly flag; if you rent one, it has to be static and dedicated to you, never shared.
A good commercial VPN. What carried me most of the miles.
I'll be honest with you: I used ExpressVPN more than my own server, because it just worked and it was simple. On a router with the kill-switch on, that's a real setup — the amateur move is the app on the laptop, not the app on the router. The tradeoff is a commercial endpoint can read as one. For a don't-ask-don't-tell job, it holds nine times out of ten. For a hostile one, stand up your own exit.
Carry a backup config. Not optional.
The tunnel will fail somewhere at the worst possible moment. Mine did — ExpressVPN wouldn't connect in a Barcelona hotel and I had a call. I pulled a NordVPN config and stood it up from the lobby in ten minutes. Have a second provider's config saved before you go.
- Buy the router and update the firmware first thing.
Before anything else.
- Load your VPN config onto the router. Turn the kill-switch ON
so nothing leaks if the tunnel drops. This is the single most important switch on the device — it's the one everybody who gets caught forgot. Heading somewhere that blocks VPNs? Turn on obfuscation (AmneziaWG) — it strips WireGuard's fingerprint so deep-packet inspection just reads unidentifiable UDP traffic.
- Set the router's uplink to the venue WiFi in Repeater/WISP mode.
It joins the hotel WiFi, clears the captive portal once, then broadcasts your own private network. Power it off a power bank or a high-power USB-C port — under VPN and obfuscation load a random laptop USB port can starve it and drop your WiFi mid-call.
- Prep the laptop ONE time:
WiFi radio OFF and leave it off forever. Location Services OFF. Set the timezone MANUALLY to your claimed city and kill auto-timezone. Delete every saved foreign network. I mean forever — see the callout below for why.
- Connect the laptop to the router by ETHERNET ONLY
(USB-C or USB-A ethernet adapter). Its only path to the internet is: ethernet → router → tunnel → your exit. It never sees a local SSID, so it can never report one.
- Before you log into a single work system, verify three things:
your public IP geolocates to your claimed city, it reads as residential (not datacenter/VPN), and there are no DNS or IPv6 leaks. Free tools, thirty seconds, every session — the exact ones are on The Gear List. THEN you work.
why "WiFi off forever" is rule zero — a real one
I built the whole box perfectly once and still nearly torched a corporate job — because I left the laptop's WiFi radio on. It never connected to anything. But a system update rebooted the machine, the radio came back up, and it silently scanned the network names around me. The moment the router handed it internet, those SSIDs went home — and my laptop geolocated its real spot and set the clock to a country I was standing in and not supposed to be in.
I lost a weekend to it and half-planned a flight back to the States for cover. Nobody ever said a word — but the IP was flawless the whole time. A radio I forgot to kill is what almost ended it. That's why the WiFi doesn't get turned on "just this once."
Follow that and you're already ahead of 95% of the people out there "using a VPN." Now the part that actually decides whether you keep the job.
Part 2
The diagnostic — everything you don't know you don't know.
Run this honestly. Check the boxes you've actually got handled. The blanks are the risk.
Detection — the stuff past the IP
- A residential IP can still sit on a known-VPN blocklist. Do you know how to check yours is clean?
- Log in from home at 9am and abroad at 9pm and Microsoft or Okta fires an "impossible travel" alert on its own — no human required. Did you know that runs by default?
- Your personal phone is the leak you forgot about. Every company app on it logs in from your REAL local network. Do those two stories match?
- Your latency on a screenshare gives you away if you routed the long way around. Did you keep the hop short?
- Developers: your Git commits leak your timezone. Handled? MFA apps can pull GPS for conditional access — what's your move when they do?
- Do you know exactly which signals YOUR specific laptop and MDM agent are streaming home?
Tax & legal — "under 183 days" is not the shield you think
- The 183-day rule is a TAX test. It has nothing to do with whether the work is legal on a tourist visa — a completely different question. Did you know that?
- The center-of-vital-interests test can make you tax-resident somewhere fast, and the burden of proof is on YOU.
- Your working abroad can create a tax mess for your EMPLOYER — which gets you fired for a reason that has nothing to do with "getting caught."
- At the border: "How are you affording to stay here?" Do you have an answer that doesn't end in deported and banned for life?
Which job — not every remote job can go stealth
- Forced corporate-VPN-in with inspection, MDM that streams GPS/cell, hardware attestation, per-login geofencing — this method does NOT beat those. Do you know which bucket your job is in?
- Read your offer letter and handbook: is there a clause requiring you to work from an approved location? Breaking that is fireable cause — no detective work needed.
- Do you ask HR / global mobility, or stay silent? Asking can out you. Which is right for YOUR company?
- Are you screening the job BEFORE you rely on any of this — or after?
Runway — the money you're underestimating
- Do you know your real monthly number abroad — reliable wifi, a real workspace, a health budget — not the fantasy budget?
- Is your rent under a third of your income, or are you about to be broke somewhere prettier?
- Healthcare, retirement, social security — what happens to those while you're gone? And do you have a buffer for when it goes wrong?
The trap nobody markets against
- Burnout hits nomads harder. Once you've told everyone you escaped the rat race, you can't admit you're struggling. Who do you actually talk to when it's hard?
- Are you running toward a life — or away from one?
If you just hit a stack of blank boxes — good. Every blank is a way this ends badly that you didn't know existed sixty seconds ago. Most people meet these the expensive way: from the border agent, the tax letter, or the email that ends the whole thing.
Want this as its own honest, scored self-check to sit with? That's The 5-Gap Diagnostic.
The Letters
I write a letter most mornings. Escapes, systems, the life after.
The first one lands today. Then most mornings.
If you want someone to make sure it's YOU who doesn't get caught
This kit is the skeleton. What it can't do is screen YOUR job, read YOUR contract, or build YOUR exit for YOUR home setup — and specific is exactly where people get caught. Every blank box up there is a specific, and the specifics are what a free guide can never fill in.
No remote job yet? Don't build any of this — get the Offer Accelerator first — the whole job-search automation system, normally $97, but I'm feeling generous, so it's yours free. Build the career, THEN become the nomad.
The Jailbreak · one sitting
One session — we go through your exact job, your exact laptop, your exact situation. Whether your role is even stealth-able, your exit IP built the clean way, the tax and visa lines flagged, and if you're not in a stealth-capable job yet, the plan to land one. One conversation standing between you and the dreaded email. You leave with your Escape File in hand.
Not sure where you are? Take the Escape Map →
Book the Jailbreak
You don't owe corporate anything. 40+ countries, undetected — the method, pointed at your setup.
