If we're talking about laptops here, this means an additional piece of hardware. If you're carrying around an additional piece of network filtering hardware, you might as well just run the VPN client on that, too.

I'm looking into dual-wifi travel routers that will run OpenWRT (and thus give me root) and can do WireGuard at reasonable speeds. I've been meaning to do it for iOS devices anyway (these things phone home constantly, with no way to turn it off) and now it's going to be needed on Apple Silicon macs, too.

"If you're carrying around an additional piece of network filtering hardware, you might as well just run the VPN client on that, too."

Perhaps - and of course that point is well taken.

However, if the hardware device is complicated enough to actually run the VPN then you are back to wondering how it can fail, who can attack it and how things can accidently go around it.

Not so with a slug - it is a dead simple bridge that can't be seen on the network.

I assume you mean wired, then? So, for the usual connection of laptop on wifi, there would be an ethernet dongle, to the slug, to a wifi client bridge? Three external devices?

If you meant wifi, do you have configs available or hardware you recommend?