Two different jobs
A VPN is software on your device (or router) that encrypts traffic to a VPN server and sends it out from there. A travel router is a small box that joins the hotel network once and then runs your own private Wi-Fi for your devices. One protects a path; the other gives you a network. You can have either, both, or neither.
This is a research guide from vendor and FTC documentation. We have not tested NordVPN, Proton VPN or any hotel network.
| Your situation | Choose | Skip |
|---|---|---|
| One laptop, hotel login works, you want a protected path | VPN app on the laptop (Proton Free is $0 for one device) | Travel router |
| Phone, laptop and tablet each need the hotel login every day | Travel router | Paying for VPN only for this reason |
| Several devices and every one should use a VPN | Travel router with VPN, or VPN apps on each device | Assuming one product does both |
| A wired device (console, desktop, streaming box) in the room | Travel router with a LAN port | VPN alone |
| Hotel login works and HTTPS is enough for you | Keep your current setup | Both |
What a VPN does and does not do on hotel Wi-Fi
The FTC's guidance is that most websites now use encryption, so public Wi-Fi is usually safe for those sites. A VPN goes further by wrapping all of your device's traffic, including apps and DNS lookups, in a tunnel to the VPN server. That matters most if your employer requires it, you use apps that might not encrypt everything, or you simply do not want the hotel network to see where you connect. [1]
What it does not do: complete the hotel login, add bandwidth the hotel lacks, or stop you typing a password into a convincing fake site. The FTC specifically warns that scam sites can be encrypted too. [1]
What a travel router does, and the login order
Your devices join the router's Wi-Fi; the router joins the hotel's. You log in once at the hotel's portal and every device behind the router shares that connection. It does not encrypt anything by itself. On GL.iNet routers, settings such as an active VPN, AdGuard Home or DNS rebinding protection can block the hotel portal. GL.iNet's fix is Public Hotspot Login Mode on firmware 4.6 or later, or disabling those settings, logging in, then turning them back on. [2]
Check that the hotel permits personal routers. If a hotel limits devices, ask staff; GL.iNet's documented options include asking them to whitelist the router's address. [2]
Cost: what each option actually charges
Proton prices were read from its USD pricing page on 29 October 2026, and only two-year figures were shown. A $3.49 monthly figure is still an $83.76 charge on day one. Opal's price is from GL.iNet's product page the same day. Taxes and promotions vary at checkout. [3][6]
| Option | Listed price (USD) | What the number means |
|---|---|---|
| Proton VPN Free | $0 | 1 device at a time, servers in 10 countries chosen at random, medium speed, no data limits per Proton's FAQ |
| Proton VPN Plus | $83.76 for the first 24 months ($3.49/month displayed) | Paid upfront; renews at $83.88 every 12 months; 10 devices; 30-day money-back guarantee |
| Proton Unlimited | $191.76 for the first 24 months ($7.99/month displayed) | Renews at $119.88 every 12 months; 30-day money-back guarantee |
| Opal travel router (GL-SFT1200) | $39.99 | One-time hardware; Wi-Fi 5; tax and shipping extra |
| NordVPN | Not rechecked for this update | Its pricing page could not be retrieved on 29 October 2026; check the current plan and renewal on the provider card and at checkout |
If you want both: where to run the VPN
Proton generates WireGuard configuration files for third-party clients, including routers; the free plan can create them with limited options. GL.iNet's firmware 4 documentation points Proton users to that export and then its standard WireGuard client setup. Proton itself recommends its apps where possible, because a bare configuration file lacks app features such as the kill switch and DNS leak protection. [4][5]
The speed trade-off is real on budget hardware. GL.iNet lists Opal's maximum VPN client throughput in a local test at 65 Mbps with WireGuard and 12 Mbps with OpenVPN. If the hotel line is faster than that and you mostly use one laptop, the app on the laptop is the simpler and faster choice. Use the router's VPN when devices that cannot run a VPN app need the tunnel. [6]
Worked example: one traveller, three devices
A consultant carries a laptop, phone and tablet and stays in hotels two weeks a month. The hotels log in per device, and the employer requires a VPN on the laptop only. Decision: a travel router to handle one login for all three, plus the employer's VPN on the laptop as before. No separate consumer VPN is needed for this job.
A second traveller carries only a laptop and the hotel login works fine. They want privacy from the hotel network. Decision: Proton VPN Free on the laptop at $0, then reassess Plus only if they need more devices or a chosen server country. No router. Both scenarios are illustrative.
Stop when the current setup already works
If the hotel login works on the devices you carry, you are comfortable relying on HTTPS, and your employer does not require a VPN, you do not need either purchase. Use the hotel Wi-Fi diagnostic log to record what actually fails before buying anything.
Watch demos / Official walkthroughs
See the hardware in action.
Videos load from YouTube only when you press play. These are provider videos, not our own product tests.
GL.iNet / Official video
Beryl AX (GL-MT3000) - Unboxing and Setup Guide
What to look for: Identify the hardware connections and setup steps for Beryl AX; other models can differ.
Watch on YouTubeQuestions before you decide
Is hotel Wi-Fi safe without a VPN?
The FTC says most websites now use encryption, so connecting through public Wi-Fi is usually safe for HTTPS sites. A VPN adds a protected tunnel for all of your device's traffic to the VPN server, which some people and employers still want. The FTC also warns that scam sites can use HTTPS too, so a padlock alone is not proof a site is genuine.
Can a VPN get me past the hotel login page?
No. The hotel's sign-in has to complete first. GL.iNet's own troubleshooting for routers is to disable VPN connections while logging in, then turn them back on. A VPN is not a way around a venue's access terms.
Is running the VPN on a cheap travel router slower?
It can be much slower. GL.iNet lists the Opal's maximum VPN client throughput, measured on a local network, at 65 Mbps for WireGuard and 12 Mbps for OpenVPN. Running the VPN app on a modern laptop avoids that router limit for that one device.
Sources & verification
Product details and prices can change. Check the linked provider before buying.
- FTC: Are public Wi-Fi networks safe? What you need to know Accessed 29 Oct 2026
- GL.iNet: Connect to a public hotspot with a captive portal Accessed 29 Oct 2026
- Proton VPN pricing (USD) Accessed 29 Oct 2026
- Proton VPN: Download WireGuard configuration files Accessed 29 Oct 2026
- GL.iNet: WireGuard configuration files from service providers Accessed 29 Oct 2026
- GL.iNet: Opal (GL-SFT1200) price and specifications Accessed 29 Oct 2026
Sources link directly to providers. Product buttons may use separately labeled affiliate links. Read our disclosure.