Skip to content
Wirebump Docs

On-the-Go Mode

WiFi as your upstream. VPN protection wherever you go.

On-the-Go mode uses a wireless connection for WAN and optionally provides a wired LAN for your own devices. The untrusted network only sees your Wirebump machine. Everything behind it stays hidden and protected.

Network Topology

Section titled “Network Topology”
                    [Untrusted WiFi]
                     (hotel, airport,
                      coffee shop)
                          |
                       (WiFi)
                          |
  [Your devices] --- [Wirebump laptop] --- [Travel router]
       (wired LAN)                            (optional)

Your Wirebump host connects to the hotel or coffee shop WiFi. All traffic from the host and any devices on your wired LAN routes through your VPN circuits before reaching the internet. The untrusted network sees one device making encrypted connections to VPN endpoints. Your actual traffic, device count, and network topology stay invisible.

Use Cases

Section titled “Use Cases”

Hotel room: Connect your laptop’s WiFi to the hotel network. Plug a travel router into your ethernet port. Your phone, tablet, and work laptop all connect to your private WiFi and route through your chosen VPN topology. The hotel network sees one guest device.

Coffee shop: Running Wirebump directly on your laptop with single-NIC mode. Your laptop’s traffic goes through the VPN. No downstream devices, no hardware to carry.

Airbnb or rental: Same setup as the hotel. Create a private LAN segment that travels with you. Consistent network environment across locations.

Conference or coworking space: Untrusted networks with unknown monitoring. Your VPN circuits handle everything. Switch providers or locations without reconfiguring any client devices.

What You Need

Section titled “What You Need”

Minimum:

  • Laptop or mini-PC with WiFi
  • Ubuntu 25.10 or 24.04 LTS
  • Proton VPN or Mullvad VPN account

For downstream LAN:

  • One ethernet port (built-in or USB adapter)
  • Travel router or small switch (optional, for WiFi to downstream devices)

The WiFi handles upstream connectivity. The ethernet port (if you have one) can serve as your private LAN where Wirebump provides DHCP and routes all traffic through your VPN.

Setup

Section titled “Setup”

Connect to WiFi First

Section titled “Connect to WiFi First”

Wirebump does not manage WiFi connections. Use your system’s normal tools:

  • Ubuntu Desktop: Click the network icon, select the WiFi network, enter credentials
  • Ubuntu Server: Use nmcli or wpa_supplicant to connect
  • NetworkManager CLI: nmcli device wifi connect "NetworkName" password "password"

Connect to the WiFi network before or after running the installer. Wirebump routes traffic through whatever interface you designate as WAN.

Run the Installer

Section titled “Run the Installer”
Terminal window
sudo bash -c "$(wget -qO- https://wirebump.net/install.sh)"

During bootstrap, select your WiFi interface as the upstream (WAN) connection. If you have an ethernet port for downstream devices, select it as LAN. If you only have WiFi, bootstrap creates a virtual interface and runs in single-NIC mode.

Access the UI

Section titled “Access the UI”

After bootstrap completes:

  • http://localhost/ when on the Wirebump machine itself
  • http://10.0.0.1/ from devices connected to the LAN port

If you prefer HTTPS: https://localhost/ and https://10.0.0.1/ are also available. They use a self-signed certificate since Wirebump runs locally on your network. Your browser will show a security warning—this is expected. Click ‘Advanced’ and proceed to the site.

Default credentials: admin / wirebump

Deploy a Circuit

Section titled “Deploy a Circuit”
  1. Add your Mullvad VPN or Proton VPN account in Settings
  2. Create a circuit (single-hop, parallel, or nested multi-provider)
  3. Deploy and verify traffic routes through the VPN

Changing WiFi Networks

Section titled “Changing WiFi Networks”

When you move to a new location:

  1. Connect to the new WiFi network using Ubuntu’s network tools
  2. Wirebump detects the connection change and continues routing through it
  3. Your VPN circuits reconnect automatically

No reconfiguration needed. The VPN topology stays the same. Only the underlying WiFi transport changes.

Important Notes

Section titled “Important Notes”

WiFi management is external. Wirebump uses whatever WiFi connection you establish through NetworkManager, wpa_supplicant, or other system tools. If WiFi disconnects, reconnect using the same methods you used initially.

A warning banner appears in the UI when WiFi is selected as WAN. This reminds you that Wirebump is not managing the wireless connection.

Hotel captive portals: Connect to the WiFi and complete any captive portal authentication before enabling VPN circuits. Once the portal is cleared, your VPN traffic flows normally.

Signal strength matters. Weak WiFi means unstable VPN connections. If you experience frequent disconnects, move closer to the access point or switch to a less congested network.

Verification

Section titled “Verification”

After setup, verify your traffic is protected:

Next Steps

Section titled “Next Steps”

Mullvad and Mullvad VPN are trademarks of Mullvad VPN AB. Proton VPN is a registered trademark of Proton AG.