527 lines
18 KiB
Markdown
527 lines
18 KiB
Markdown
# 🌐 GL.iNet Travel Networking Infrastructure
|
|
|
|
**🟡 Intermediate Guide**
|
|
|
|
This guide covers the complete GL.iNet travel networking setup, including travel routers, IoT gateway, and remote KVM for secure mobile connectivity and remote management.
|
|
|
|
---
|
|
|
|
## 🎒 GL.iNet Device Portfolio
|
|
|
|
### **GL.iNet Comet (GL-RM1) - Remote KVM**
|
|
|
|
#### **Hardware Specifications**
|
|
- **Model**: GL-RM1 Remote KVM over IP
|
|
- **Purpose**: Remote server management and troubleshooting
|
|
- **Video**: Up to 1920x1200@60Hz resolution
|
|
- **USB**: Virtual keyboard and mouse support
|
|
- **Network**: Ethernet connection for remote access
|
|
- **Power**: USB-C powered, low power consumption
|
|
- **Form Factor**: Compact, portable design
|
|
|
|
#### **Use Cases**
|
|
- **Remote Server Management**: Access BIOS, boot sequences, OS installation
|
|
- **Headless System Control**: Manage servers without physical access
|
|
- **Emergency Recovery**: Fix systems when SSH/network is down
|
|
- **Travel Troubleshooting**: Diagnose homelab issues from anywhere
|
|
- **Secure Access**: Out-of-band management independent of OS
|
|
|
|
#### **Integration with Homelab**
|
|
```
|
|
Homelab Server → GL-RM1 KVM → Network → Tailscale → Travel Device
|
|
```
|
|
|
|
---
|
|
|
|
### **GL.iNet Slate 7 (GL-BE3600) - Wi-Fi 7 Travel Router**
|
|
|
|
#### **Hardware Specifications**
|
|
- **Model**: GL-BE3600 Dual-Band Wi-Fi 7 Travel Router
|
|
- **Wi-Fi Standard**: Wi-Fi 7 (802.11be)
|
|
- **Speed**: Up to 3.6 Gbps total throughput
|
|
- **Bands**: Dual-band (2.4GHz + 5GHz)
|
|
- **Ports**: 1x Gigabit WAN, 1x Gigabit LAN
|
|
- **CPU**: Quad-core ARM processor
|
|
- **RAM**: 1GB DDR4
|
|
- **Storage**: 256MB flash storage
|
|
- **Power**: USB-C, portable battery support
|
|
- **VPN**: Built-in OpenVPN, WireGuard support
|
|
|
|
#### **Key Features**
|
|
- **Wi-Fi 7 Technology**: Latest wireless standard for maximum performance
|
|
- **Travel-Optimized**: Compact form factor, battery operation
|
|
- **VPN Client/Server**: Secure tunnel back to homelab
|
|
- **Captive Portal Bypass**: Automatic hotel/airport Wi-Fi connection
|
|
- **Dual WAN**: Ethernet + Wi-Fi uplink for redundancy
|
|
- **Guest Network**: Isolated network for untrusted devices
|
|
|
|
---
|
|
|
|
### **GL.iNet Beryl AX (GL-MT3000) - Wi-Fi 6 Pocket Router**
|
|
|
|
#### **Hardware Specifications**
|
|
- **Model**: GL-MT3000 Pocket-Sized Wi-Fi 6 Router
|
|
- **Wi-Fi Standard**: Wi-Fi 6 (802.11ax)
|
|
- **Speed**: Up to 2.4 Gbps total throughput
|
|
- **Bands**: Dual-band (2.4GHz + 5GHz)
|
|
- **Ports**: 1x Gigabit WAN/LAN
|
|
- **CPU**: Dual-core ARM Cortex-A53
|
|
- **RAM**: 512MB DDR4
|
|
- **Storage**: 128MB flash storage
|
|
- **Power**: USB-C, ultra-portable
|
|
- **Battery**: Optional external battery pack
|
|
|
|
#### **Use Cases**
|
|
- **Ultra-Portable Networking**: Smallest form factor for minimal travel
|
|
- **Hotel Room Setup**: Instant secure Wi-Fi in accommodations
|
|
- **Conference Networking**: Secure connection at events
|
|
- **Backup Connectivity**: Secondary router for redundancy
|
|
- **IoT Device Management**: Isolated network for smart devices
|
|
|
|
---
|
|
|
|
### **GL.iNet Mango (GL-MT300N-V2) - Compact Travel Router**
|
|
|
|
#### **Hardware Specifications**
|
|
- **Model**: GL-MT300N-V2 Mini Travel Router
|
|
- **Wi-Fi Standard**: Wi-Fi 4 (802.11n)
|
|
- **Speed**: Up to 300 Mbps
|
|
- **Band**: Single-band (2.4GHz)
|
|
- **Ports**: 1x Fast Ethernet WAN/LAN
|
|
- **CPU**: Single-core MIPS processor
|
|
- **RAM**: 128MB DDR2
|
|
- **Storage**: 16MB flash storage
|
|
- **Power**: Micro-USB, very low power
|
|
- **Size**: Ultra-compact, credit card sized
|
|
|
|
#### **Use Cases**
|
|
- **Emergency Connectivity**: Basic internet access when needed
|
|
- **Legacy Device Support**: Connect older devices to modern networks
|
|
- **IoT Prototyping**: Simple network for development projects
|
|
- **Backup Router**: Ultra-portable emergency networking
|
|
- **Budget Travel**: Cost-effective secure connectivity
|
|
|
|
---
|
|
|
|
### **GL.iNet S200 - Multi-Protocol IoT Gateway**
|
|
|
|
#### **Hardware Specifications**
|
|
- **Model**: GL-S200 Multi-Protocol IoT Gateway
|
|
- **Protocols**: Thread, Zigbee, Matter, Wi-Fi
|
|
- **Thread**: Thread Border Router functionality
|
|
- **Zigbee**: Zigbee 3.0 coordinator support
|
|
- **Matter**: Matter over Thread/Wi-Fi support
|
|
- **CPU**: ARM Cortex-A7 processor
|
|
- **RAM**: 256MB DDR3
|
|
- **Storage**: 128MB flash storage
|
|
- **Network**: Ethernet, Wi-Fi connectivity
|
|
- **Power**: USB-C powered
|
|
|
|
#### **IoT Integration**
|
|
- **Smart Home Hub**: Central control for IoT devices
|
|
- **Protocol Translation**: Bridge between different IoT standards
|
|
- **Remote Management**: Control IoT devices via Tailscale
|
|
- **Travel IoT**: Portable smart home setup for extended stays
|
|
- **Development Platform**: IoT protocol testing and development
|
|
|
|
---
|
|
|
|
## 🗺️ Travel Networking Architecture
|
|
|
|
### **Multi-Layer Connectivity Strategy**
|
|
```
|
|
Internet (Hotel/Airport/Cellular)
|
|
│
|
|
├── GL-BE3600 (Primary Wi-Fi 7 Router)
|
|
│ ├── Secure Tunnel → Tailscale → Homelab
|
|
│ ├── Guest Network (Untrusted devices)
|
|
│ └── Private Network (Trusted devices)
|
|
│
|
|
├── GL-MT3000 (Backup Wi-Fi 6 Router)
|
|
│ └── Secondary VPN Connection
|
|
│
|
|
├── GL-MT300N-V2 (Emergency Router)
|
|
│ └── Basic connectivity fallback
|
|
│
|
|
└── GL-S200 (IoT Gateway)
|
|
└── Smart device management
|
|
```
|
|
|
|
### **Redundancy & Failover**
|
|
- **Primary**: GL-BE3600 with Wi-Fi 7 for maximum performance
|
|
- **Secondary**: GL-MT3000 for backup connectivity
|
|
- **Emergency**: GL-MT300N-V2 for basic internet access
|
|
- **Specialized**: GL-S200 for IoT device management
|
|
|
|
---
|
|
|
|
## 🏠 Current Homelab Deployment
|
|
|
|
Both GL-MT3000 and GL-BE3600 are deployed as **permanent infrastructure** in the homelab (not travel use), connected to Headscale and providing subnet routing.
|
|
|
|
### GL-MT3000 — IoT/HA Gateway
|
|
|
|
| Property | Value |
|
|
|----------|-------|
|
|
| **Role** | Gateway for jellyfish + Home Assistant |
|
|
| **LAN** | `192.168.12.0/24` (gateway: `192.168.12.1`) |
|
|
| **WAN** | Separate uplink (`76.93.214.253`) — not on home LAN |
|
|
| **Tailscale IP** | `100.126.243.15` |
|
|
| **Tailscale version** | `1.92.5-tiny` (GL-inet custom build) |
|
|
| **Subnet route** | `192.168.12.0/24` (approved in Headscale) |
|
|
| **SSH** | `ssh gl-mt3000` (dropbear, key auth) |
|
|
|
|
Devices on `192.168.12.0/24` accessible via Tailscale:
|
|
- `jellyfish` (`100.69.121.120`) — jump host / device
|
|
- `homeassistant` (`100.112.186.90`) — Home Assistant OS
|
|
|
|
### GL-BE3600 — Wi-Fi Repeater
|
|
|
|
| Property | Value |
|
|
|----------|-------|
|
|
| **Role** | Wi-Fi repeater on home network |
|
|
| **Management IP** | `192.168.68.53` (upstream LAN) |
|
|
| **Own LAN** | `192.168.8.0/24` (gateway: `192.168.8.1`) |
|
|
| **Tailscale IP** | `100.105.59.123` |
|
|
| **Tailscale version** | `1.90.9-tiny` (GL-inet custom build) |
|
|
| **Subnet route** | `192.168.8.0/24` (approved in Headscale) |
|
|
| **SSH** | `ssh gl-be3600` (dropbear, key auth) |
|
|
|
|
> **Note**: GL-BE3600 ports are filtered from homelab VM (`192.168.0.210`) and NUC (`192.168.68.x`). It is only directly reachable from its own `192.168.8.x` LAN — or via its Tailscale IP (`100.105.59.123`).
|
|
|
|
---
|
|
|
|
## 🔑 SSH Access
|
|
|
|
Both routers use **dropbear SSH** (not OpenSSH). Authorized keys are stored at `/etc/dropbear/authorized_keys`.
|
|
|
|
```bash
|
|
# Connect via Tailscale (preferred)
|
|
ssh gl-mt3000 # 100.126.243.15, root
|
|
ssh gl-be3600 # 100.105.59.123, root
|
|
|
|
# Add a new SSH key manually (from the router shell)
|
|
echo "ssh-ed25519 AAAA... your-key-comment" >> /etc/dropbear/authorized_keys
|
|
```
|
|
|
|
SSH config entries (in `~/.ssh/config` on homelab VM):
|
|
```
|
|
Host gl-mt3000
|
|
HostName 100.126.243.15
|
|
User root
|
|
|
|
Host gl-be3600
|
|
HostName 100.105.59.123
|
|
User root
|
|
```
|
|
|
|
---
|
|
|
|
## 📡 Headscale / Tailscale Setup on GL-inet Routers
|
|
|
|
GL-inet routers ship with a custom Tailscale build (`tailscale-tiny`). The standard install script does not work — use the GL-inet package manager or the pre-installed binary.
|
|
|
|
### Joining Headscale
|
|
|
|
```bash
|
|
# 1. Generate a pre-auth key on the Headscale server
|
|
ssh calypso
|
|
sudo /usr/local/bin/docker exec headscale headscale preauthkeys create --user <numeric-user-id> --expiration 1h
|
|
# Note: --user requires numeric ID in Headscale v0.28, not username
|
|
# Find ID with: sudo /usr/local/bin/docker exec headscale headscale users list
|
|
|
|
# 2. On the GL-inet router shell:
|
|
tailscale up --login-server=https://headscale.vish.gg:8443 --authkey=<preauthkey> --accept-routes --advertise-routes=192.168.X.0/24 --advertise-exit-node --hostname=gl-<model>
|
|
|
|
# 3. Approve the subnet route and exit node on Headscale:
|
|
sudo /usr/local/bin/docker exec headscale headscale nodes list # get node ID
|
|
sudo /usr/local/bin/docker exec headscale headscale nodes approve-routes -i <ID> -r '0.0.0.0/0,::/0,192.168.X.0/24'
|
|
```
|
|
|
|
### Tailscale Status
|
|
|
|
```bash
|
|
# Check status on the router
|
|
ssh gl-mt3000 "tailscale status"
|
|
ssh gl-be3600 "tailscale status"
|
|
|
|
# Check from Headscale
|
|
ssh calypso "sudo /usr/local/bin/docker exec headscale headscale nodes list"
|
|
```
|
|
|
|
### Headscale v0.28 Command Reference
|
|
|
|
| Old command | New command |
|
|
|-------------|-------------|
|
|
| `headscale routes list` | `headscale nodes list-routes --identifier <ID>` |
|
|
| `headscale routes enable -r <ID>` | `headscale nodes approve-routes --identifier <ID> --routes <CIDR>` |
|
|
| `headscale preauthkeys create --user <name>` | `headscale preauthkeys create --user <numeric-id>` |
|
|
|
|
---
|
|
|
|
## 🔄 Tailscale Autostart on Boot
|
|
|
|
### How GL-inet Manages Tailscale
|
|
|
|
GL-inet routers use a custom wrapper script `/usr/bin/gl_tailscale` that is called on boot by the `tailscale` init service. This wrapper reads UCI config from `/etc/config/tailscale` and constructs the `tailscale up` command automatically.
|
|
|
|
**Important**: The GL-inet wrapper calls `tailscale up --reset ...` on every boot, which wipes any flags set manually or stored in the state file. This means `--login-server`, `--advertise-exit-node`, and `--hostname` must be baked into the wrapper script itself — they cannot be set once and remembered.
|
|
|
|
### Current Configuration (both routers)
|
|
|
|
Both routers have been patched so `/usr/bin/gl_tailscale` always passes the correct flags on boot. The relevant line in the wrapper:
|
|
|
|
**gl-be3600:**
|
|
```sh
|
|
timeout 10 /usr/sbin/tailscale up --reset --accept-routes $param --timeout 3s \
|
|
--accept-dns=false \
|
|
--login-server=https://headscale.vish.gg:8443 \
|
|
--advertise-exit-node \
|
|
--hostname=gl-be3600 > /dev/null
|
|
```
|
|
|
|
**gl-mt3000:**
|
|
```sh
|
|
timeout 10 /usr/sbin/tailscale up --reset --accept-routes $param --timeout 3s \
|
|
--accept-dns=false \
|
|
--login-server=https://headscale.vish.gg:8443 \
|
|
--advertise-exit-node \
|
|
--hostname=gl-mt3000 > /dev/null
|
|
```
|
|
|
|
The `$param` variable is built by the wrapper from UCI settings and includes `--advertise-routes=192.168.X.0/24` automatically based on `lan_enabled=1` in `/etc/config/tailscale`.
|
|
|
|
### Persistence Across Firmware Upgrades
|
|
|
|
Both routers have `/etc/sysupgrade.conf` entries to preserve the patched files:
|
|
|
|
```
|
|
/usr/sbin/tailscale
|
|
/usr/sbin/tailscaled
|
|
/etc/config/tailscale
|
|
/usr/bin/gl_tailscale
|
|
/etc/init.d/tailscale-up
|
|
```
|
|
|
|
### Re-applying the Patch After Firmware Upgrade
|
|
|
|
If a firmware upgrade overwrites `/usr/bin/gl_tailscale` (check with `tailscale status` — if "Logged out", patch was lost):
|
|
|
|
```bash
|
|
# SSH to the router
|
|
ssh gl-be3600 # or gl-mt3000
|
|
|
|
# Edit the gl_tailscale wrapper
|
|
vi /usr/bin/gl_tailscale
|
|
|
|
# Find the tailscale up line (around line 226):
|
|
# timeout 10 /usr/sbin/tailscale up --reset --accept-routes $param --timeout 3s --accept-dns=false > /dev/null
|
|
# Change it to (for be3600):
|
|
# timeout 10 /usr/sbin/tailscale up --reset --accept-routes $param --timeout 3s --accept-dns=false --login-server=https://headscale.vish.gg:8443 --advertise-exit-node --hostname=gl-be3600 > /dev/null
|
|
|
|
# Or use sed:
|
|
sed -i 's|tailscale up --reset --accept-routes $param --timeout 3s --accept-dns=false|tailscale up --reset --accept-routes $param --timeout 3s --accept-dns=false --login-server=https://headscale.vish.gg:8443 --advertise-exit-node --hostname=gl-be3600|' /usr/bin/gl_tailscale
|
|
```
|
|
|
|
### update-tailscale.sh
|
|
|
|
There is a community script at `/root/update-tailscale.sh` on both routers — this is the [GL-inet Tailscale Updater by Admon](https://github.com/Admonstrator/glinet-tailscale-updater). It updates the `tailscale`/`tailscaled` binaries to a newer version than GL-inet ships in firmware. It also restores `/usr/bin/gl_tailscale` from `/rom` before patching for SSH support — **re-apply the headscale patch after running this script**.
|
|
|
|
---
|
|
|
|
## 🔧 Configuration & Setup
|
|
|
|
### **GL-BE3600 Primary Setup**
|
|
|
|
#### **Initial Configuration**
|
|
```bash
|
|
# Access router admin panel
|
|
http://192.168.8.1
|
|
|
|
# Configure WAN connection
|
|
- Set to DHCP for hotel/public Wi-Fi
|
|
- Configure static IP if needed
|
|
- Enable MAC address cloning for captive portals
|
|
|
|
# Configure VPN
|
|
- Enable WireGuard client
|
|
- Import Tailscale configuration
|
|
- Set auto-connect on boot
|
|
```
|
|
|
|
#### **Network Segmentation**
|
|
```bash
|
|
# Private Network (192.168.8.0/24)
|
|
- Trusted devices (laptop, phone, tablet)
|
|
- Full access to homelab via VPN
|
|
- Local device communication allowed
|
|
|
|
# Guest Network (192.168.9.0/24)
|
|
- Untrusted devices
|
|
- Internet-only access
|
|
- Isolated from private network
|
|
```
|
|
|
|
### **Remote KVM (GL-RM1) Setup**
|
|
|
|
#### **Physical Connection**
|
|
```bash
|
|
# Connect to target server
|
|
1. USB-A to server for keyboard/mouse emulation
|
|
2. HDMI/VGA to server for video capture
|
|
3. Ethernet to network for remote access
|
|
4. USB-C for power
|
|
|
|
# Network Configuration
|
|
- Assign static IP: 192.168.8.100
|
|
- Configure port forwarding: 8080 → 80
|
|
- Enable HTTPS for secure access
|
|
```
|
|
|
|
#### **Tailscale Integration**
|
|
```bash
|
|
# Install Tailscale on KVM device
|
|
curl -fsSL https://tailscale.com/install.sh | sh
|
|
sudo tailscale up --accept-routes
|
|
|
|
# Access via Tailscale
|
|
https://gl-rm1.tail.vish.gg
|
|
```
|
|
|
|
### **IoT Gateway (GL-S200) Configuration**
|
|
|
|
#### **Thread Border Router Setup**
|
|
```bash
|
|
# Enable Thread functionality
|
|
- Configure as Thread Border Router
|
|
- Set network credentials
|
|
- Enable Matter support
|
|
|
|
# Zigbee Coordinator Setup
|
|
- Configure Zigbee channel
|
|
- Set network key
|
|
- Enable device pairing mode
|
|
```
|
|
|
|
---
|
|
|
|
## 🛡️ Security Configuration
|
|
|
|
### **VPN Security**
|
|
- **WireGuard Tunnels**: All traffic encrypted back to homelab
|
|
- **Kill Switch**: Block internet if VPN disconnects
|
|
- **DNS Security**: Use homelab Pi-hole for ad blocking
|
|
- **Firewall Rules**: Strict ingress/egress filtering
|
|
|
|
### **Network Isolation**
|
|
- **Guest Network**: Completely isolated from private devices
|
|
- **IoT Segmentation**: Smart devices on separate VLAN
|
|
- **Management Network**: KVM and admin access isolated
|
|
- **Zero Trust**: All connections authenticated and encrypted
|
|
|
|
### **Access Control**
|
|
- **Strong Passwords**: Unique passwords for each device
|
|
- **SSH Keys**: Key-based authentication where possible
|
|
- **Regular Updates**: Firmware updates for security patches
|
|
- **Monitoring**: Log analysis for suspicious activity
|
|
|
|
---
|
|
|
|
## 📱 Mobile Device Integration
|
|
|
|
### **Seamless Connectivity**
|
|
```bash
|
|
# Device Auto-Connection Priority
|
|
1. GL-BE3600 (Primary Wi-Fi 7)
|
|
2. GL-MT3000 (Backup Wi-Fi 6)
|
|
3. GL-MT300N-V2 (Emergency)
|
|
4. Cellular (Last resort)
|
|
|
|
# Tailscale Configuration
|
|
- All devices connected to Tailscale mesh
|
|
- Automatic failover between networks
|
|
- Consistent homelab access regardless of uplink
|
|
```
|
|
|
|
### **Performance Optimization**
|
|
- **Wi-Fi 7**: Maximum throughput for data-intensive tasks
|
|
- **QoS**: Prioritize critical traffic (VPN, video calls)
|
|
- **Band Steering**: Automatic 2.4GHz/5GHz selection
|
|
- **Load Balancing**: Distribute devices across routers
|
|
|
|
---
|
|
|
|
## 🔍 Monitoring & Management
|
|
|
|
### **Remote Monitoring**
|
|
- **Router Status**: Monitor via web interface and mobile app
|
|
- **VPN Health**: Check tunnel status and throughput
|
|
- **Device Connectivity**: Track connected devices and usage
|
|
- **Performance Metrics**: Bandwidth, latency, packet loss
|
|
|
|
### **Troubleshooting Tools**
|
|
- **Network Diagnostics**: Built-in ping, traceroute, speed test
|
|
- **Log Analysis**: System logs for connection issues
|
|
- **Remote Access**: SSH access for advanced configuration
|
|
- **Factory Reset**: Hardware reset button for recovery
|
|
|
|
---
|
|
|
|
## 🎯 Use Case Scenarios
|
|
|
|
### **Business Travel**
|
|
1. **Hotel Setup**: GL-BE3600 for secure Wi-Fi, KVM for server access
|
|
2. **Conference**: GL-MT3000 for portable networking
|
|
3. **Emergency**: GL-MT300N-V2 for basic connectivity
|
|
4. **IoT Devices**: GL-S200 for smart device management
|
|
|
|
### **Extended Stay**
|
|
1. **Primary Network**: GL-BE3600 with full homelab access
|
|
2. **Smart Home**: GL-S200 for temporary IoT setup
|
|
3. **Backup Connectivity**: Multiple routers for redundancy
|
|
4. **Remote Management**: KVM for homelab troubleshooting
|
|
|
|
### **Digital Nomad**
|
|
1. **Mobile Office**: Secure, high-speed connectivity anywhere
|
|
2. **Content Creation**: High-bandwidth for video uploads
|
|
3. **Development Work**: Full access to homelab resources
|
|
4. **IoT Projects**: Portable development environment
|
|
|
|
---
|
|
|
|
## 📋 Maintenance & Updates
|
|
|
|
### **Regular Tasks**
|
|
- **Firmware Updates**: Monthly security and feature updates
|
|
- **Configuration Backup**: Export settings before changes
|
|
- **Performance Testing**: Regular speed and latency tests
|
|
- **Security Audit**: Review firewall rules and access logs
|
|
|
|
### **Travel Checklist**
|
|
- [ ] All devices charged and firmware updated
|
|
- [ ] VPN configurations tested and working
|
|
- [ ] Backup connectivity options verified
|
|
- [ ] Emergency contact information accessible
|
|
- [ ] Documentation and passwords secured
|
|
|
|
---
|
|
|
|
## 🔗 Integration with Homelab
|
|
|
|
### **Tailscale Mesh Network**
|
|
- **Seamless Access**: All GL.iNet devices join Tailscale mesh
|
|
- **Split-Brain DNS**: Local hostname resolution while traveling
|
|
- **Subnet Routing**: Access homelab subnets via travel routers
|
|
- **Exit Nodes**: Route internet traffic through homelab
|
|
|
|
### **Service Access**
|
|
- **Media Streaming**: Plex, Jellyfin via high-speed VPN
|
|
- **Development**: GitLab, Portainer, development environments
|
|
- **Productivity**: Paperless-NGX, Vaultwarden, file sync
|
|
- **Monitoring**: Grafana, Uptime Kuma for homelab status
|
|
|
|
---
|
|
|
|
*This GL.iNet travel networking infrastructure provides enterprise-level connectivity and security for mobile work, ensuring seamless access to homelab resources from anywhere in the world.*
|
|
|
|
*Last Updated*: 2026-03-11 (added Tailscale autostart section, gl_tailscale patch details, update-tailscale.sh note) |