Two month after flashing the Flint 2 GL-MT6000, I got its little brother GL-MT3000 in my hands as a powerful mini travel router runs stable build of OpenWrt.
There are a few comparable routers in the same market, such as its older model GL-MT1300 v1 which is not very appealing price-wise; Cudy TR3000 v1 which is a direct competitor by its naming but has confusing variations that is not well supported by OpenWrt; and yet another older model Cudy TR1200 which is not available in the US.
Since I have been (and still) using the good old Mango GL-MT300N-V2 and had a good experience with the latest GL-MT6000 model, buying a GL-MT3000 to play with is an easy decision (without the risk of buying unsupported TR3000 variations).
Although the specs of this model is still way overkill for my use case, like its 2.5GbE WAN speed for always on VPN connection, but its portability, switch function and Type C power supply is a fully upgrade from my old Mango model.
Then, let’s get started with the official guide and download the latest Sysupgrade image from the Installation table.
Check the hash with the data from the index
sha256sum openwrt-24.10.4-mediatek-filogic-glinet_gl-mt3000-squashfs-sysupgrade.bin
f4fc9c6ebf9da466d108d00f6854b1cd155ae389010f940ae6e05d0de9f3e6ef
Note: For operational security, all initial settings should be done without physical Internet/WAN connection.
Use browser to access the web admin panel via 192.168.8.1 to go through the initial setup guide that created by GL.iNet, and upload the .bin file through http://192.168.8.1/#/upgrade
The same Thoughts on Security applies for this model as well.
Basic Configuration
After awhile, it’s ready to log in with OpenWrt’s good old credential root:admin via http://192.168.1.1
Now, set up a strong root password by Snowden’s rule via System - Administration, then set the Interface under SSH Access tab to lan
Using HTTPS can be beneficial in untrusted environment, but keeping HTTP can make web adminstration easier for the sake of modern browsers, so Redirect to HTTPS is not recommended in this case
Because this is a travel router, it is recommended to change the router’s LAN (or IP) from 192.168.1.1 into something uncommon to avoid conflicts between other unmanageable routers, through Network - Interfaces - Edit lan - IPv4 address.
Optional but recommend to Edit the wan6 interface, check Disable this interface and uncheck Bring up on boot to prevent any troubles with IPv6.
While applying changes, it may be needed to re-plug the ethernet cable for allowing the computer to renew the ip. If soft-bricked, follow the debrick section to restore the firmware. Thanks to the hardware reset button design and built-in Uboot, things are made very easy.
Instead of doing Channel Analysis for a stationary router, the travel router doesn’t need that. Just go to Network - Wireless, do not enable any Access Point for now, but Edit one of the SSID: OpenWrt
In Device Configuration (General Setup), set Operating frequency to N with Auto for channel, and leave other settings default unless needed
Down to the Interface Configuration, keep Mode as Access Point, give a ESSID that not contain any meaningful information (don’t troll your neighbors with WiFi)
Go to Wireless Security tab, set WPA2/WPA3 Personal (PSK/SAE) mixed mode for Encryption
Create a random long password if it is not meant to be share with a lot of people, or follow Snowden’s rule by creating something like margaretthatcheris110%SEXY
Enable Enable key reinstallation (KRACK) countermeasures for WPA2 packages and Save then Save & Apply
Now, it is time to Enable the Access Point which has been configured with new SSIDs, then plug in WAN port for Internet access and test it with a very new phone and a very old phone.
Next, repeat the same step to setup the 5GHz Access Point which operating on AX mode, and it is time to make a configuration backup. Go to System - Backup - Generate archive
Bypassing Censorship
It’s very easy to find guides on WireGuard installation which is currently the way to go for traveling around regions that are not heavily censored. However, in some regions, neither WireGuard nor OpenVPN are usable, where only SOCKS5-based or other specialized protocols would work.
The VPN ban is coming as a global trend, so these quasi-unbannable anti-censorship proxies will become useful everywhere on the planet, unfortunately.
After the takedown of Clash, alternatives developes continuously, such as mihomo and sing-box.
Because my server backend is more compatible with Clash/mihomo, I decide to use the most mature project OpenClash. Although there are more versatile options like ShellCrash, openwrt-passwall, and ImmortalWrt available.
Now, connect OpenWrt via terminal ssh [email protected] then run
opkg update
opkg remove dnsmasq
mv /etc/config/dhcp /etc/config/dhcp.bak
opkg install bash iptables dnsmasq-full curl ca-bundle ipset ip-full iptables-mod-tproxy iptables-mod-extra ruby ruby-yaml kmod-tun kmod-inet-diag unzip luci-compat luci luci-base
wget -O /tmp/openclash.ipk "https://github.com/vernesong/OpenClash/releases/download/v0.47.028/luci-app-openclash_0.47.028_all.ipk"
opkg install /tmp/openclash.ipk
#note: if github isn't accessible, run `opkg install openssh-sftp-server` and SFPT into it with openclash.ipk locally stored
reboot
After reboot, the Services - OpenClash entry will show up on the luci webui.
Upon opening the plugin page, OpenClash is asking for installing the core, answer OK
By default, the version is armv8 which matches the A53 processor I’m running on this router, then click Github raw as source to install it
Go to Config Subscribe - Add, name the config alias, copy and paste the subscribe address from the server side. Then Commit Settings and click Update Config button at the bottom.
Now the page refreshes back to Overviews, where the Running Status shows ON with Meta Running in Enhance and Rule mode.
Because Enhance mode creates wired behaviors, I changed it into TUN mode under Plugin Settings - Operation Mode - Select Mode, then making sure the Running Mode on top of the Overviews page aligns.
Scroll down to the bottom of the page, where the IP Address section is, I can see 4 IP check results, some of them shows the IP of my VPS and some shows the IP of my ISP. This is exactly expected for running at Rule mode, which saves VPS bandwidth.
If swithcing Proxy Mode into Direct, all IP check results will back to ISP’s.
But what if I want all my traffic goes into the Proxy server? Just switch it into Global mode.
To troubleshoot, go to Overviews - Control Panel - zashboard, check the logs and connections then tweaking configurations under Proxies and Rules.
Make sure both IP and DNS addresses are changing simultaneously, check DNS leaking via https://www.dnsleaktest.com/
When everything works as expected, go to Config Manage and Backup the config of OpenClash to the local storage. Keep in mind, these plugins and configurations should not be installed if there will be any possible scrutinizes at checkpoints like border searches. Be prepared for restoring backups via cloud afterwards.
Although most anti-censorship proxies have certain implementation of encryption/anonymization/obfuscation, after all, they are designed specific for its purpose. It’s still needed to have VPN/Tor running on top of these proxies, in order to meet your level of security/privacy, based on your particular threat model.
There’s one thing left, that is to play with the switch button. But writing a script is required, so that would be a fun project in the future.