The GL.iNet Brume 2 is a palm-sized, fanless VPN security gateway. It does one job: route a network's traffic through a VPN, or host your own VPN back into your LAN, on a dedicated always-on box instead of loading that work onto your main router. It runs OpenWrt under a clean GL.iNet web UI. The unit here is the aluminium GL-MT2500A.
Overview
A dedicated edge appliance for VPN and network privacy. Plug it inline behind your existing router and it becomes the box that owns your VPN, DNS filtering, and remote access.
- Highlights: WireGuard up to 355 Mbps, a 2.5G WAN port, OpenWrt underneath, and built-in AdGuard Home, Tor, and mesh VPN. All at under 2.6 watts.
- No WiFi by design. It is wired-only and sits behind your router or access point, not in place of it.
- Price: the plastic GL-MT2500 is about $59, the aluminium GL-MT2500A about $79 to $90 (around €80 in the EU store).
- Value: it offloads VPN and filtering from your main router onto a silent box that costs pennies a year to run.
Detailed Specifications
| Spec | Detail |
|---|---|
| Model | GL-MT2500 (ABS plastic) / GL-MT2500A (aluminium) |
| SoC | MediaTek MT7981B, dual-core Cortex-A53 @ 1.3 GHz |
| RAM | 1 GB DDR4 |
| Storage | 8 GB eMMC |
| WAN | 2.5 GbE (10/100/1000/2500) |
| LAN | 1 GbE |
| USB | 1x USB 3.0 |
| WiFi | None (wired only) |
| WireGuard | Up to 355 Mbps |
| OpenVPN | Up to 150 Mbps |
| Power | USB-C, 5V/2A, under 2.6 W |
| Size / weight | 70 x 70 x 22 mm; 157 g (alloy) / 60 g (plastic) |
| Firmware | GL.iNet UI on OpenWrt 21.02, with LuCI and SSH/root |
| Default admin | 192.168.8.1 |
Background and Context
GL.iNet is a maker of OpenWrt-based travel routers and gateways with a following among self-hosters and the privacy crowd. The Brume line is its wired, WiFi-less security gateway family; the Brume 2 (2022) replaced the original Brume. The pitch is a turnkey VPN box: the polished GL.iNet UI for the common cases, with the full OpenWrt system and thousands of packages underneath when you want them.
How it compares:
- vs a Raspberry Pi running PiVPN/OpenWrt: the Brume 2 is turnkey, lower power, and comes with a warranty and a UI. A Pi is more flexible but you build and maintain it yourself.
- vs running VPN on the router itself: modern gateways (including UniFi) can do WireGuard, but the Brume offloads it to its own hardware and adds AdGuard Home, Tor, VPN cascading, and mesh in one place.
- vs the GL.iNet Flint: the Flint is a full WiFi router. The Brume is wired-only and meant to sit behind whatever router you already run.
Standouts for the size and price: a 2.5G WAN port, USB 3.0, and VPN cascading (chaining one VPN through another).
Pros and Cons
Pros:
- Turnkey WireGuard and OpenVPN client and server, with a clean UI and full OpenWrt beneath it.
- 355 Mbps WireGuard is strong for a box this size and price.
- Tiny, silent, under 2.6 W, happy running 24/7.
- AdGuard Home, Tor, mesh VPN, and cascading built in.
- 2.5G WAN and USB 3.0 are rare at this tier.
Cons:
- No WiFi, so it needs your existing router or access point.
- 1 GB RAM and two cores cap heavy workloads; VPN throughput tops out near 355 Mbps, below gigabit.
- The OpenWrt 21.02 base is a few versions behind; updates track GL.iNet's cadence.
- The LAN port is only 1G while the WAN is 2.5G.
Who It's For
Anyone who wants VPN and DNS filtering as their own always-on appliance rather than a feature bolted onto the router: self-hosters, privacy-minded users, small offices needing site-to-site, and travellers who want a fixed anchor back into the home network.
For my setup, it slots behind the UniFi network as a dedicated VPN brain, offloading three jobs from the UniFi gateway:
- A WireGuard server to reach my LAN and NAS from anywhere (pairs with the RAID Types for a NAS and Home Assistant notes).
- A ProtonVPN WireGuard client so a chosen VLAN routes out through Proton.
- AdGuard Home for network-wide ad and tracker blocking, plus Tailscale for mesh access to the Mac Studio.
Buying Considerations
- Price: plastic GL-MT2500 around $59; aluminium GL-MT2500A around $79 to $90. The EU store ships with an EU plug at roughly €80 and avoids customs. It is also on Amazon in the EU.
- Alloy vs plastic: the aluminium A doubles as a passive heatsink and feels sturdier for a unit that runs 24/7. Worth the small premium.
- Tips: update the firmware on first boot, change the default admin password, and move it off the default
192.168.8.1if it clashes with your subnet. If you need full-gigabit VPN, this is not it (355 Mbps ceiling); look at the GL.iNet Flint 2 or a small x86 box instead.
Verdict / My Take
The Brume 2 is the right tool when you want VPN as its own box, not a checkbox on the router. For my network it is a clean way to run a home-access WireGuard server plus AdGuard without touching the UniFi gateway, at a power draw I can ignore. The 355 Mbps ceiling and the 1G LAN are the honest limits. For a silent, low-draw privacy and edge appliance at this size, little else competes.
Further Reading / Sources
