How to use this glossary
Each entry gives a plain definition from the vendor or protocol documentation, then says where the feature lives. App means the setting is in a VPN provider's app on a phone or laptop. Router means it is set on a GL.iNet router running firmware 4.x. Both means you will meet it in both places, though the settings may differ. Bracketed numbers point to the sources at the end.
The router column matters more than it looks. Many provider features exist only in the provider's app. A travel router connects to the provider with a standard WireGuard or OpenVPN profile, so app-only features like Proton's Stealth protocol or NordVPN's NordWhisper do not come with it. [7][11]
Leak protection: kill switches, always-on and DNS
These terms describe what happens when the tunnel drops. The main danger on hotel Wi-Fi is not a broken VPN. It is a VPN that fails quietly while your devices keep sending traffic outside it.
| Term | Definition | App, router or both | GL.iNet router note |
|---|---|---|---|
| Kill switch | Blocks internet traffic if the VPN connection is lost, until you reconnect, so your real IP address and DNS queries stay hidden [1] | Both | On firmware 4.8 and later, each tunnel has its own kill switch, on by default [4] |
| Advanced kill switch (Proton) | Allows internet access only while connected to Proton VPN, and stays active after a restart. Windows, Linux GUI and iOS beta [1] | App | No direct equivalent name; the closest is Enhanced Kill Switch below |
| Internet and App Kill Switch (NordVPN) | Internet Kill Switch blocks all internet access when traffic is not going through NordVPN. App Kill Switch closes only the programs you choose when the VPN drops [2] | App | A router cannot close apps on your laptop; it can only block traffic |
| Tunnel Kill Switch (GL.iNet) | Blocks traffic matched to a tunnel if that VPN connection fails unexpectedly [3] | Router | On by default in 4.8 and later once a tunnel is active [4] |
| Enhanced Kill Switch (GL.iNet) | Blocks internet traffic that does not match any VPN tunnel [3] | Router | Policy mode only, off by default, and mutually exclusive with the All Other Traffic option [4] |
| Always-on VPN | Android system setting that keeps a VPN connected, with a companion Block connections without VPN toggle. Proton says it behaves more like its advanced kill switch than its standard one [1] | App (Android) | Not needed for devices behind a router running the tunnel |
| DNS leak | When third parties can see the address of the DNS server you are really using, despite the VPN. Proton routes DNS queries through the tunnel and blocks IPv6 connections in its apps [21] | Both | Proton warns that custom DNS settings can override its leak protection [21]; check the router's DNS page if you change DNS |
Routing: split tunneling, policies, AllowedIPs and multi-hop
These terms decide which traffic goes into the tunnel and which path it takes. On a router, routing is set per device or per destination. In an app, it is usually set per app.
| Term | Definition | App, router or both | GL.iNet router note |
|---|---|---|---|
| Split tunneling | Routes some connections through the VPN while others bypass it [5]. NordVPN's apps exclude chosen apps; on Linux it uses an allowlist of ports or subnets [6] | Both | On the router, the equivalent is a VPN policy (next row) |
| Include and exclude modes | Exclude sends everything through the VPN except chosen items; include sends only chosen items through it [5] | App | Router policies express the same idea as Specified Devices or Exclude Specified Devices [3] |
| VPN policy (policy mode) | Rules that send traffic to a tunnel by client device (by MAC address), connection type or destination domain or IP list [3] | Router | Firmware 4.9 and later; unmatched traffic uses the normal WAN unless you turn that off [3] |
| AllowedIPs | WireGuard peer setting listing the addresses that may arrive from a peer and that are sent to it; 0.0.0.0/0 matches all IPv4, ::/0 all IPv6 [14] | Both | Changing it is how you route only some destinations through a WireGuard tunnel |
| Multi-hop (Secure Core) | Proton routes traffic through its own servers in Switzerland, Iceland or Sweden before the exit server, on all paid plans [17] | App | Proton's router setup page does not mention Secure Core [26] |
| Double VPN (NordVPN) | Sends your traffic through two VPN servers instead of one [18] | App | NordVPN's router guidance is built around OpenVPN clients [27][25] |
| VPN cascading (GL.iNet) | The router runs a VPN server for your devices and forwards that traffic into a VPN client tunnel to a provider [19] | Router | GL.iNet recommends WireGuard for both ends for speed [19] |
| IP masquerading | Rewrites LAN clients' source addresses to the router's tunnel IP [3] | Router | GL.iNet suggests turning it off mainly for site-to-site setups [3] |
Protocols and disguise
A protocol is the way the encrypted tunnel is built. Obfuscation tries to make that tunnel look like ordinary traffic. Both affect speed, and both affect whether the VPN gets through a restrictive network.
| Term | Definition | App, router or both | GL.iNet router note |
|---|---|---|---|
| WireGuard | Modern protocol Proton calls fast and secure, using less battery [7] | Both | GL.iNet's WireGuard client accepts .conf files and has built-in providers [24] |
| NordLynx | NordVPN's WireGuard-based protocol, used by default in its apps [8] | App | NordVPN's own GL.iNet guide uses OpenVPN [25], though GL.iNet's WireGuard client lists NordVPN as a built-in provider set up with an access token [24] |
| OpenVPN | Mature open-source protocol that runs over UDP or TCP [8] | Both | Supported as client and server on GL.iNet routers [10][25] |
| UDP and TCP | UDP is faster but does not resend lost packets; TCP resends them and is more reliable but slower [9] | Both | GL.iNet suggests trying UDP first and switching to TCP if you see instability or packet loss [10] |
| Obfuscation | Making VPN traffic look like regular web traffic so network filters are less likely to detect it [12] | Both | On GL.iNet routers this means AmneziaWG (below), not provider app features |
| Stealth (Proton) | Proton's protocol that uses obfuscated TLS tunneling over TCP to look like common HTTPS connections [23] | App | Listed for Proton's apps only; Proton's router page names OpenVPN and WireGuard [7][26] |
| NordWhisper (NordVPN) | Protocol for restrictive networks; now powers NordVPN's Obfuscated Servers. Not compatible with Dedicated IP, Meshnet or Onion Over VPN [11][12] | App | Obfuscated servers cannot be reached with NordVPN's OpenVPN manual method [12] |
| AmneziaWG | WireGuard-based protocol with junk packets, dynamic headers and random prefixes to hide VPN traffic from deep packet inspection [13] | Router (and AmneziaWG apps) | GL.iNet firmware 4.9 and later; version 2.0 configs supported [13] |
Connection tuning: MTU, keepalive, endpoints and NAT
These settings rarely need touching, but they are the usual fix when a VPN connects yet some websites stall, or when the tunnel goes quiet after a few minutes.
| Term | Definition | App, router or both | GL.iNet router note |
|---|---|---|---|
| MTU | Maximum packet size on the tunnel. wg-quick sets it automatically from the endpoint or default route if not specified [15] | Router (mostly) | GL.iNet suggests lowering the default 1420 to 1380 or 1280 when a mobile carrier limits packet size; the tunnel MTU you set overrides the config file [16][3] |
| Endpoint | The peer's IP address or hostname and port; WireGuard updates it automatically from authenticated packets [14] | Both | For a home server, this is your public IP or DDNS name |
| PersistentKeepalive | Interval in seconds for an empty packet that keeps a NAT or firewall mapping alive; off by default, and most users do not need it [14] | Both | Useful when the travel router sits behind hotel NAT and must stay reachable |
| Moderate NAT (Proton) | Turns off Proton's randomized NAT mapping to help games and peer-to-peer apps, at a slight privacy cost; paid plans; set when generating a WireGuard config [20] | Both | Choose it when downloading the router's WireGuard file, not on the router itself [20] |
| Dedicated IP | A personal IP address that does not change [18] | App, and some router setups | Not compatible with NordWhisper, so you cannot combine it with obfuscation in the NordVPN app [11] |
| NetShield (Proton) | DNS-level blocking of malware, or of malware, ads and trackers, on paid plans [22] | Both | Chosen as an option when you generate a manual WireGuard config on a paid plan [28] |
Router-specific notes for GL.iNet travel routers
Three terms cause most confusion on GL.iNet routers. First, the kill switch moved. Firmware 4.7 and earlier had one global Block Non-VPN Traffic switch. Firmware 4.8 split it into a per-tunnel Tunnel Kill Switch, on by default, and an optional Enhanced Kill Switch in policy mode. [4] Older guides that tell you to find Block Non-VPN Traffic under Global Options are describing the old layout.
Second, MTU problems look like a website problem. If the tunnel is up but some pages hang, GL.iNet's first suggestion for mobile carriers is to lower the MTU from 1420 to 1380 or 1280 in the tunnel options. [16] Third, app features do not travel with a config file. NetShield and Moderate NAT can be baked into a Proton WireGuard file when you generate it. [28][20] Stealth, NordWhisper and the app kill switches stay inside the apps. [7][11]
- Using the router's VPN: check Tunnel Kill Switch is on, choose UDP first, and know where the MTU setting is.
- Using the app behind a router with no VPN: the app's kill switch, split tunneling and obfuscation all apply.
- Running both at once creates a VPN inside a VPN. Pick one for everyday use.
Questions before you decide
What is the difference between a kill switch and always-on VPN?
A kill switch blocks traffic when the VPN drops. Android's Always-on VPN keeps a VPN connected, and with Block connections without VPN it acts like Proton's advanced kill switch, blocking traffic outside the VPN at all times.
Does split tunneling work on a travel router?
Not by that name. GL.iNet routers use VPN policies that route traffic by device, connection type or destination domain or IP. App-based split tunneling exists only in provider apps such as Proton VPN and NordVPN.
What MTU should I use for a VPN on a GL.iNet router?
Leave the default unless pages stall. GL.iNet suggests lowering the default 1420 to 1380 or 1280 when an ISP, especially a mobile carrier, limits packet size, and says the tunnel setting overrides the config file.
Can I use Proton Stealth or NordVPN obfuscated servers on my router?
Their documentation offers no router path. Proton lists Stealth for its apps only, and NordVPN says obfuscated servers cannot be reached with its OpenVPN manual method. GL.iNet routers support AmneziaWG obfuscation instead.
Sources & verification
Product details and prices can change. Check the linked provider before buying.
- Proton VPN Support: How to use kill switch Accessed 30 Oct 2026
- NordVPN Help Center: NordVPN Kill Switch, how does it work Accessed 30 Oct 2026
- GL.iNet Router Docs 4: VPN Dashboard (firmware v4.9 and later) Accessed 30 Oct 2026
- GL.iNet Router Docs 4: Block non-VPN traffic (kill switch) Accessed 30 Oct 2026
- Proton VPN Support: Split tunneling Accessed 30 Oct 2026
- NordVPN Help Center: What is split tunneling and how to use it Accessed 30 Oct 2026
- Proton VPN Support: Change your VPN protocol Accessed 30 Oct 2026
- NordVPN Help Center: Which NordVPN protocol should I choose Accessed 30 Oct 2026
- NordVPN Help Center: Pros and cons of OpenVPN TCP and UDP Accessed 30 Oct 2026
- GL.iNet Router Docs 4: OpenVPN TCP or UDP Accessed 30 Oct 2026
- NordVPN Help Center: How to use NordWhisper on NordVPN Accessed 30 Oct 2026
- NordVPN Help Center: Obfuscated Servers are getting an upgrade, what changed Accessed 30 Oct 2026
- GL.iNet Router Docs 4: AmneziaWG obfuscation Accessed 30 Oct 2026
- wireguard-tools: wg(8) manual page Accessed 30 Oct 2026
- wireguard-tools: wg-quick(8) manual page Accessed 30 Oct 2026
- GL.iNet Router Docs 4: Why is my VPN speed slow Accessed 30 Oct 2026
- Proton VPN Support: Secure Core Accessed 30 Oct 2026
- NordVPN Help Center: What features does NordVPN have Accessed 30 Oct 2026
- GL.iNet Router Docs 4: How to use VPN cascading Accessed 30 Oct 2026
- Proton VPN Support: Moderate NAT Accessed 30 Oct 2026
- Proton VPN Support: DNS leaks and privacy Accessed 30 Oct 2026
- Proton VPN Support: NetShield Accessed 30 Oct 2026
- Proton VPN blog: Stealth VPN protocol Accessed 30 Oct 2026
- GL.iNet Router Docs 4: WireGuard Client Accessed 30 Oct 2026
- NordVPN Help Center: GL.iNet setup with NordVPN Accessed 30 Oct 2026
- Proton VPN Support: Installing Proton VPN on a router Accessed 30 Oct 2026
- NordVPN Help Center: Setting up a router with NordVPN Accessed 30 Oct 2026
- Proton VPN Support: How to download WireGuard configuration files Accessed 30 Oct 2026
Sources link directly to providers. Product buttons may use separately labeled affiliate links. Read our disclosure.