A travel router turns hostile hotel Wi-Fi into a private network with one login, cloned MAC address, and a persistent VPN back home. The catch is that none of that happens through the router’s tiny reset button. It happens through an Android app, and picking the wrong one leaves you SSHing into a headless box from the departure lounge.
We looked at the eight apps travellers actually keep on their phones for a GL.iNet Slate, a TP-Link Nano, a Netgear Nighthawk M-series, or an OpenWrt build. The list covers first-party router control, network scanning, VPN clients, mesh overlays, and the SSH client you reach for when LuCI stops responding on airport Wi-Fi. If you want the best apps for travel router setup that work at 3 a.m. in a hotel bathroom, start here.
What to look for in a travel router app
A few things separate a useful travel router app from a device-shaped placeholder:
- First-party router support for your exact model, not just the flagship SKU
- MAC address cloning so hotels with one-device Wi-Fi caps see one MAC across your laptop, phone, tablet, and Chromecast
- A VPN client that survives sleep, doze mode, and Wi-Fi handoffs
- Per-SSID or per-client policy, so guest gadgets skip the tunnel while your laptop stays inside it
- Firmware and package updates over cellular, since hotel Wi-Fi will not let you
opkg update - A network scanner to audit whatever else is on the hotel’s captive network before you connect
- Speedtest and bandwidth logging that tells you when to switch to your own 5G modem
If an app cannot do the first three, treat it as monitoring only and pair it with something that can.
Quick comparison
| App | Best for | Free plan | Paid tier | Rating |
|---|---|---|---|---|
| GL.iNet | GL-MT300N, Slate, Beryl, Mudi | Yes, full features | None | 4.1 |
| TP-Link Tether | TL-WR902AC, Roam AX1500, Roam 7 | Yes, full features | None | 4.2 |
| NETGEAR Nighthawk | M1, M5, M6, MR1100 hotspots | Yes | Nighthawk subscription | 4.0 |
| Fing | Auditing hotel Wi-Fi | Yes | Fingbox from about 6 USD/mo | 4.6 |
| WireGuard | Tunnelling the router back home | Free, open source | None | 4.5 |
| Tailscale | Zero-config exit node routing | 3 users, 100 devices | 6 USD/user/mo | 4.4 |
| Speedtest by Ookla | Triaging hotel bandwidth | Yes, ad supported | 5 USD/yr for ad removal | 4.6 |
| JuiceSSH | SSH into OpenWrt and LuCI hosts | Yes | Pro from 5 USD one-off | 4.5 |
The apps
1. GL.iNet, best overall for travel routers
GL.iNet is the reason most people bought their Slate AX, Beryl AX, or Mudi in the first place. The Android app pairs with the router over Bluetooth or the router’s own SSID, walks you through admin password setup, and drops you into the same dashboard you get in a desktop browser. WireGuard and OpenVPN profiles import from a text file, per-client policy is a checkbox rather than a shell command, and firmware updates run over your phone’s cellular link when the hotel captive portal is being difficult.
It also handles the MAC address cloning trick cleanly. Set the WAN MAC to your laptop’s, complete the hotel portal once, and every device behind the router looks like that one laptop to the front desk. Adblock via AdGuard Home is toggled from the app on newer firmware, so ad filtering can run at the router before the DNS query ever leaves the room.
Where it falls short: The app only works with GL.iNet routers. It also occasionally loses discovery on hotel networks that block mDNS, in which case you fall back to the router’s local IP in a browser.
Pricing:
- Free with any GL.iNet router
- No subscription tier
Platforms: Android, iOS
Bottom line: If you own a GL.iNet router, this is the app. Skip it only if you refuse to install anything and prefer LuCI in a browser.
2. TP-Link Tether, best for the Nano and Roam line
TP-Link Tether is the companion for the TL-WR902AC Nano, the Roam AX1500, and the Roam 7 Wi-Fi 7 model. Setup is a QR code scan followed by picking WISP, hotspot, or router mode from a drop-down. The Wi-Fi 6 and Wi-Fi 7 models expose EasyMesh from the app, so a second Nano at the far end of a long-stay Airbnb pairs with a single tap.
Where Tether earns its place is guest-network scheduling. Hotel Wi-Fi tends to boot idle clients, and Tether will bounce the WAN and reauthenticate on a schedule to keep sessions alive. Parental controls and per-device time limits work on any device that connects, which matters if a family shares one hotel-Wi-Fi seat.
Where it falls short: VPN client support is basic. Tether will run OpenVPN in client mode on the Roam 7, but not the older Nano series, and there is no in-app WireGuard on any current model.
Pricing:
- Free with any TP-Link router
- HomeShield security add-on from about 6 USD/mo
Platforms: Android, iOS
Bottom line: The right pick for TP-Link Nano and Roam owners. Buy a GL.iNet instead if you need serious VPN work at the router.
3. NETGEAR Nighthawk, best for M-series mobile hotspots
NETGEAR Nighthawk is the control surface for the M1, M5, M6, M6 Pro, and MR1100 mobile hotspots that a lot of long-haul travellers pair with a local eSIM. From the app you switch between physical SIM and eSIM profiles, view data usage per SIM, and change the APN when the auto-detect gets a foreign carrier wrong.
The app is also the fastest way to tether a Nighthawk to a GL.iNet or TP-Link travel router. Set the M-series unit to Wi-Fi Offload mode, hand out its SSID from the app, and treat it like a WISP uplink on the downstream router. If you need battery status, temperature warnings, and per-app data throttling on the cellular side, this app is where they live.
Where it falls short: Only works with NETGEAR hardware. Firmware updates over cellular chew data on the M6 Pro, so schedule them for a coffee-shop Wi-Fi window instead.
Pricing:
- Free with a NETGEAR mobile hotspot
- NETGEAR Armor security subscription from 4 USD/mo, optional
Platforms: Android, iOS
Bottom line: Essential if a Nighthawk M-series is your uplink. Not useful for anyone else.
4. Fing, best for auditing hotel Wi-Fi before you connect
Fing is the network scanner every travel router owner should install. Point it at the hotel SSID and Fing lists every device on that subnet: other guests’ laptops, the front desk printer, the smart TV in your room, and, occasionally, cameras that were not on the room description. Doing that scan before you route your work traffic through the network is a five-minute audit that shows you exactly what environment your router is joining.
Behind your own travel router, Fing is faster than the router’s client list for finding a rogue device or a Chromecast that will not pair. Vulnerability alerts flag exposed services on your local network, which comes in handy when a rental apartment’s smart lock exposes its config port.
Where it falls short: Deep features like intrusion detection and internet outage alerts require Fingbox, a paid subscription. The free app is powerful, but the aggressive upsell on the home screen wears thin.
Pricing:
- Free with unlimited scans
- Fing Premium from about 3 USD/mo, Fingbox hardware and service around 6 USD/mo
Platforms: Android, iOS, Windows, macOS, Linux
Bottom line: Free tier is worth installing before every trip. Pay only if you want continuous alerting.
5. WireGuard, best for tunnelling the router back home
WireGuard’s Android app is small, fast, and has one job: hold a config file and connect. On a travel router it plays two roles. First, you install it on your phone so hotel Wi-Fi is encrypted end to end before it hits the router. Second, and more useful, you paste the same config into your travel router so every device behind the router routes through home. Your Chromecast plays region-locked content, your work laptop hits internal endpoints, and your smart plug still reaches its cloud from a New Delhi coffee shop.
Config files are plain text. Export from your home router, drop into the app, done. The tunnel survives Wi-Fi switching between the hotel SSID and your own travel router SSID better than commercial VPN clients do.
Where it falls short: No server-side component here, you need something running WireGuard on the other end, whether that is a Raspberry Pi at home, a Mullvad account, or your GL.iNet’s built-in server. Split tunneling exists but is per-app and cannot be scheduled.
Pricing:
- Free and open source
- No paid tier
Platforms: Android, iOS, Windows, macOS, Linux, OpenWrt, most routers
Bottom line: Install even if your router already runs WireGuard. Config portability across phone and router is worth the 5 MB.
6. Tailscale, best for zero-config exit-node routing
Tailscale turns the whole tunnel-back-home problem into a mesh membership problem. Install it on your phone, on your travel router if it runs OpenWrt or GL.iNet firmware 4.x, and on any machine at home, and every device talks to every device without opening a single port. Set the home machine as an exit node, flip a toggle in the app, and all traffic from your travel setup routes through your home IP.
For families or teams sharing a travel router, subnet routes and ACLs replace the usual VPN config gymnastics. You can also share a single device with a colleague from the app without giving up any credentials. Latency depends on your home upload speed, so this is not a substitute for a paid VPN if you need to appear in Frankfurt from Sao Paulo.
Where it falls short: The mesh is only as useful as its slowest node, and residential ISPs cap upload. It also depends on Tailscale’s coordination servers, which are not self-hosted by default. Headscale exists if you need that.
Pricing:
- Free for 3 users and 100 devices
- Personal Plus from about 5 USD/mo, Team from 6 USD/user/mo
Platforms: Android, iOS, Windows, macOS, Linux, OpenWrt
Bottom line: The lowest-effort way to make your travel router act like it is at home. Skip only if you already run a Headscale or WireGuard mesh you like.
7. Speedtest by Ookla, best for triaging hotel bandwidth
Speedtest by Ookla is the app that decides whether you use the hotel Wi-Fi at all. Run one on the hotel SSID directly and one through your travel router with the VPN active, and the delta tells you whether the router-plus-VPN is worth the latency. It also flags when you should pull the eSIM out of the M-series unit instead.
Server selection matters here. Pick a server in the country you are actually appearing from, otherwise a well-configured VPN reads as slow when the reality is a bad server pick. Speedtest for Android also stores history, so you can prove to a hotel that “fast fiber” is measurably not.
Where it falls short: Ads on the free tier are heavy. The results include a video ad on some builds, which delays your test by a few seconds.
Pricing:
- Free with ads
- Ad-free upgrade around 5 USD/yr
Platforms: Android, iOS, Windows, macOS
Bottom line: Free and universal. Only skip if you already use fast.com or a router-side latency test.
8. JuiceSSH, best for the OpenWrt LuCI power user
JuiceSSH is what you reach for when LuCI in a browser stops loading and you need to fix your travel router from the phone in your pocket. It handles SSH, Mosh, Telnet, and local shell sessions, saves identity keys for passwordless login into an OpenWrt box, and stores every hotel router’s IP as a labelled connection so you never confuse Slate one from Slate two.
The reason it lands in a travel router list rather than a generic SSH list is the tap-to-command shortcuts. Save opkg update, wifi down, wifi up, logread -f, and the four other commands you actually run on the road, and running them on the OpenWrt box behind you is a single tap from a stuck airport gate.
Where it falls short: Free tier disables port forwarding and requires a Pro upgrade for team key sync. Interface is dense on a small phone screen, particularly the plugin manager.
Pricing:
- Free with ads
- Pro upgrade around 5 USD as a one-off in-app purchase
Platforms: Android
Bottom line: Buy the Pro upgrade if you run OpenWrt on any travel gear. Skip entirely if you never leave the vendor GUI.
The four travel router tricks these apps unlock
Once the apps above are on your phone, four setups make a travel router earn its slot in your bag:
- One MAC to rule them all. Hotels that limit Wi-Fi to one device per room count MAC addresses. Set the WAN MAC on the GL.iNet or TP-Link router to your laptop’s MAC, complete the captive portal once from the laptop, and every phone, watch, and Chromecast behind the router presents that same MAC to the hotel. One paid seat, up to twenty devices.
- VPN chaining. Run WireGuard on the router, connected to your home network, and set an app-based Tailscale or Mullvad client on the phone for the traffic that should exit somewhere else. The router handles bulk device coverage. The phone handles selective geo-shifting.
- Always-on adblock DNS. Point the router’s DNS to NextDNS, AdGuard DNS, or an on-router AdGuard Home instance from GL.iNet’s app. Every device on the travel SSID gets ad and tracker blocking, including the smart TV in the hotel room. No per-device install.
- Working IoT from hotels. Point smart plugs, Chromecasts, and Home mini units at your travel router’s SSID, which you name identically to your home Wi-Fi. Devices join without repairing. If they need multicast, GL.iNet firmware exposes an “IoT mode” toggle that fixes mDNS across the WireGuard tunnel back home.
How to pick the right one
If you want the simplest option: GL.iNet paired with Tailscale. Two apps, two toggles, and hotel Wi-Fi looks like your living room.
If you need TP-Link support: TP-Link Tether, then add WireGuard on the phone for privacy the Nano cannot enforce itself.
If your uplink is a mobile hotspot: NETGEAR Nighthawk for the M-series, then GL.iNet or TP-Link Tether downstream for MAC cloning and adblock DNS.
If you are on a budget: The stack of WireGuard, Fing, and Speedtest costs nothing and covers most of what a paid VPN app would give you, provided you own the endpoint at home.
If you are a power user with OpenWrt on your travel router: JuiceSSH with saved snippets, WireGuard in kernel mode, and Tailscale as the fallback overlay. LuCI stays in a browser tab.
If you tried a commercial VPN app and hated the disconnects: WireGuard with a paid endpoint like Mullvad or IVPN. Handoffs are near-instant, sessions survive doze mode.
FAQ
What is the best Android app to set up a GL.iNet travel router?
The official GL.iNet app is the best pick. It discovers Slate, Beryl, Mudi, and Puli units over Bluetooth or Wi-Fi, imports WireGuard and OpenVPN configs from a file, and controls MAC cloning, adblock DNS, and per-client VPN policy from one screen.
Can I use one hotel Wi-Fi login for all my devices?
Yes. Set your travel router’s WAN MAC address to your laptop’s MAC in the GL.iNet or TP-Link Tether app, complete the hotel captive portal once, then connect every other device to the travel router’s SSID. The hotel sees one MAC and one billed device.
Do I need a VPN if I use a travel router?
Only if the travel router does not run one. Most GL.iNet and OpenWrt-based travel routers run WireGuard or OpenVPN at the router level, which covers every device behind it. If you use a TP-Link Nano, run the WireGuard Android app on each phone or laptop for the same effect.
Is Fing safe to run on hotel Wi-Fi?
Fing scans the local subnet using standard ARP and ICMP requests, the same traffic your laptop already sends. It does not attempt exploits or connections to services it finds. Some hotels flag scanners, so use it briefly to audit and disconnect before staying online.
What is the best free travel router app?
WireGuard for VPN work, Fing for network auditing, and Speedtest by Ookla for bandwidth are all free. Combined with your router vendor’s free management app, they cover the full setup and management workflow without a subscription.
Can I run adblock on a travel router?
Yes. GL.iNet firmware ships AdGuard Home behind a toggle, and OpenWrt supports adguard-home and https-dns-proxy packages. On TP-Link Nano units, set the router’s DNS to NextDNS or AdGuard DNS from the Tether app and every downstream device inherits ad blocking.
