What you are building, and the prerequisites
The Flint 2 at home runs a WireGuard server. The Beryl AX you travel with runs a WireGuard client that connects back to it. Every device on the Beryl AX Wi-Fi then reaches the internet through your home connection and can reach home devices if you allow it. GL.iNet tutorial lists the uses: appearing to be at home while travelling, avoiding third-party VPN fees, encrypting traffic over untrusted networks, and reaching home resources. [2]
| Prerequisite | Why | How to check |
|---|---|---|
| Public IP on the home connection | The travel router has to reach the home router from the internet [1][2] | Compare the router WAN IP with a what-is-my-IP lookup [3] |
| DDNS if the public IP changes | Gives the client a name that follows your IP [2][4] | DDNS Test button or nslookup [4] |
| Port forwarding if the Flint 2 is behind another router | The main router has to pass UDP 51820 through [2] | Look for double NAT; see our double NAT guide |
| Different LAN subnets on the two routers | Both default to 192.168.8.1 [2] | Change the Beryl AX to 192.168.10.1 or similar |
| Both routers powered and online | The tunnel needs both ends [2] | Put the home router on a UPS if outages are common |
Step 1: confirm a public IP and plan for CGNAT
Log in to the home router at 192.168.8.1 and note the WAN IP. Then search what is my ip in a browser on the home network. If the two match, you have a public IP. If they differ, you are behind another router or your provider. You can also ask your provider. [3]
GL.iNet is clear on the consequence: without a public IP, the router cannot be set up as a WireGuard server. Its suggestions are checking a primary router WAN address, asking your ISP for a public IP, which may cost extra, or its AstroWarp option for CGNAT networks. [1] Settle this before buying anything.
Step 2: enable DDNS on the Flint 2
Home IP addresses often change. On the Flint 2, go to Applications, Dynamic DNS, turn on Enable DDNS, accept the terms and click Apply. You get a host name under glddns.com. [4] Use the DDNS Test button. If the resolved address does not match the WAN IP, GL.iNet says the router may be behind NAT. [4]
Allow time. GL.iNet notes a delay of up to 10 minutes for DNS records to sync. If you also run a VPN client on the Flint 2, disable Services From GL.iNet Use VPN so DDNS keeps reporting the real address. [4] You do not need to enable HTTPS or SSH remote access for WireGuard; leave the admin panel closed to the internet unless you have a reason.
Step 3: set up the server and export a client profile
On the Flint 2, open VPN, WireGuard Server and click Generate Configuration, which is for first setup only. The default tunnel address works in most cases. If it clashes with your upstream gateway, change it and keep the /24, for example 10.1.0.1/24. GL.iNet notes some Xfinity gateways use 10.0.0.1. [1] Its tutorial confirms the listen port as 51820. [2]
On the Profiles tab, click Add, name the profile, for example beryl-travel, and Apply. Download the client configuration as a .conf file. On firmware 4.8 and later you can choose whether the file points at your public IP, DDNS domain or current WAN IP. Choose the DDNS domain if your address changes. [1] Click Start in the upper right.
Under Options on firmware 4.8 and later, decide on Allow Remote Access to the LAN Subnet, so travel devices can reach home devices, and Client to Client, so connected clients can reach each other by tunnel IP. Leave IP Masquerading on. GL.iNet says to disable it only for site-to-site setups where the remote peer knows your LAN subnets. [1]
Step 4: set up the Beryl AX as the client
First change the Beryl AX LAN address. Under NETWORK, LAN, set something like 192.168.10.1 so it no longer matches the Flint 2. [2] Reconnect to the Beryl AX at its new address.
Go to VPN, WireGuard Client, Add Manually, and upload the .conf file or paste its text. Click Apply. [5] Start it from the three-dot menu and wait for the green dot; the tutorial notes this can take a few minutes. The VPN Dashboard should then show your home public IP. [2]
Test checklist before you leave home
Home Wi-Fi hides problems because both routers share a network. Test from outside, using cellular data, before the trip. GL.iNet suggests a phone test: turn off Wi-Fi, use cellular data, import the profile into the WireGuard app, connect, and check that the public IP matches your home address. [1]
- Phone on cellular data connects with the WireGuard app and shows the home IP [1]
- Beryl AX tethered to the phone shows a green dot and the home IP on VPN Dashboard [2]
- Flint 2 WireGuard Server page shows a connected client and traffic, on firmware 4.8 and later [1]
- If you enabled LAN access, a home device such as a NAS is reachable from the travel side [1]
- Both routers bound to your GoodCloud account for remote troubleshooting, as the tutorial suggests [2]
- Home router on reliable power; it must stay on for the whole trip [2]
- Profile file and DDNS name saved somewhere you can reach from the road
When it does not connect
Work from the outside in: public reachability first, then the tunnel settings.
| Symptom | Likely cause | Next check |
|---|---|---|
| Zero clients and zero traffic on the server page | No client has reached the server [1] | Public IP, port forwarding, DDNS address in the profile |
| Works at home, fails abroad | Some countries or regions block VPN connections [1] | Try another network, or plan an alternative |
| Never connects from any network | ISP may block the port, or you are behind CGNAT [1] | Change the port or contact the ISP; recheck public IP [3] |
| DDNS name points to a different address | Router behind NAT, or record not synced yet [4] | DDNS Test; wait up to 10 minutes |
| Tunnel up but home devices unreachable | LAN access option off, or subnets overlap [1][2] | Enable LAN access; confirm different LAN subnets |
Questions before you decide
What if my internet provider uses CGNAT?
GL.iNet says that without a public IP the router cannot act as a WireGuard server. Its options are asking your ISP for a public IP, possibly for a fee, or trying its AstroWarp service for CGNAT networks.
Do I need port forwarding?
Not if the Flint 2 is your main router connected straight to the ISP modem. If it sits behind another router, GL.iNet says to reserve a fixed IP for it on the main router and forward UDP port 51820 to it.
Why change the Beryl AX LAN address?
Both routers default to 192.168.8.1. GL.iNet tutorial says to change one to avoid a conflict, using 192.168.10.1 on the travel router as its example.
Sources & verification
Product details and prices can change. Check the linked provider before buying.
- GL.iNet Router Docs 4: WireGuard Server Accessed 30 Oct 2026
- GL.iNet Router Docs 4: Build your own WireGuard home server with two GL.iNet routers Accessed 30 Oct 2026
- GL.iNet Router Docs 4: Check if you have a public IP Accessed 30 Oct 2026
- GL.iNet Router Docs 4: Dynamic DNS Accessed 30 Oct 2026
- GL.iNet Router Docs 4: WireGuard Client Accessed 30 Oct 2026
Sources link directly to providers. Product buttons may use separately labeled affiliate links. Read our disclosure.