GL-iNet Slate 7 (GL-BE3600) Reference
Applies to: the GL-iNet Slate 7 (GL-BE3600, Wi-Fi 7). The JSON-RPC admin API, WireGuard server provisioning, and stacked-tunnel material apply to most GL-iNet sdk4 firmware devices, not only the Slate 7.
Quick Reference
| Item |
Value |
| Model |
GL-BE3600 (Slate 7) |
| Admin panel URL |
http://192.168.8.1 |
| Default LAN subnet |
192.168.8.0/24 |
| Default 2.4 GHz SSID |
GL-BE3600-XXX (see bottom label) |
| Default 5 GHz SSID |
GL-BE3600-XXX-5G (see bottom label) |
| Default Wi-Fi password |
Printed on bottom label |
| Admin password |
None — must be set on first boot |
| SSH username / port |
root / 22 |
| SSH password |
Same as admin password |
| U-Boot recovery IP |
Computer: 192.168.1.2 → Router: 192.168.1.1 |
| Soft reset (Repair Mode) |
Hold reset until touchscreen shows "Release to Repair Mode" |
| Factory reset |
Hold reset until touchscreen shows "Release to Reset Mode" |
| Firmware downloads |
https://dl.gl-inet.com/router/be3600/ |
| Official docs |
https://docs.gl-inet.com/router/en/4/user_guide/gl-be3600/ |
What This Router Does
The Slate 7 is purpose-built for three scenarios:
- Privacy on the go — connects to hotel/cafe Wi-Fi or cellular data, then presents a clean, VPN-protected network to all your devices
- Portable gateway — acts as a full NAT router with firewall, DHCP, and DNS for any location
- Remote access hub — runs WireGuard or OpenVPN server so you can reach your home network securely from anywhere
Key Capabilities at a Glance
- Wi-Fi 7 (802.11be) with MLO — up to 3,570 Mbps theoretical, 2.4 GHz + 5 GHz simultaneously
- 2.5 Gbps WAN + 2.5 Gbps LAN Ethernet ports
- WireGuard client up to ~490 Mbps throughput; OpenVPN with DCO up to ~385 Mbps
- 30+ VPN provider integrations (NordVPN, Mullvad, Surfshark, PIA, and more)
- VPN Server (WireGuard + OpenVPN) with client config export
- AdGuard Home — DNS-level ad/tracker blocking, pre-installed (disabled when Tor is active)
- Tor — full-tunnel Tor routing for all connected devices (mutually exclusive with VPN clients, AdGuard Home, DNS encryption, and IPv6)
- Tailscale and ZeroTier overlay networking
- Multi-WAN failover — Ethernet + Repeater + Cellular with automatic switchover
- Drop-in Gateway mode — extend any existing router with VPN and ad blocking
- Touchscreen — swipe through status screens; toggle VPN and view Wi-Fi QR code without a browser; physical side toggle button assignable via System → Toggle Button Settings
- USB 3.0 — smartphone tethering, 4G/5G dongle, or network-attached storage
- LuCI (full OpenWrt UI) accessible via Admin Panel → System → Advanced Settings
Reference Files
| File |
Contents |
| hardware-and-features.md |
Hardware specs, ports, buttons, touchscreen screens, LED behavior, network modes comparison, feature limitations and known issues |
| web-ui-guide.md |
Admin panel menu structure, every section explained, VPN setup flows (WireGuard client/server, OpenVPN client/server), AdGuard, DDNS, Tailscale, Tor, Multi-WAN |
| setup-and-management.md |
Initial connection and first-time setup wizard, direct connection (no internet), SSH/CLI access and useful commands, troubleshooting, firmware update, U-Boot recovery |
| json-rpc-api.md |
The /rpc JSON-RPC backend used by the admin panel — auth flow (challenge → SHA-256 crypt → sid), call envelope, module/method discovery via .so strings and gzipped Vue bundles in /www/views/, common modules table, reusable bash helper, error codes and pitfalls |
| wireguard-server-api.md |
Programmatic provisioning of the built-in WireGuard server: wg-server module method reference, add_peer / generate_peer parameter shapes, end-to-end provisioning flow, server-side state inspection (UCI vs kernel vs RPC), local-only Endpoint pattern for LAN-side clients, leak verification |
| wg-client-stacked-tunnels.md |
Read when: configuring a Linux WireGuard client against the GL-iNet server, debugging a full-tunnel WG client that won't reach the internet or tailnet, layering Tailscale/ZeroTier/another overlay on top of a WG client, or seeing symptoms like "tailscale ping --tsmp works but ICMP/SSH to a tailnet peer doesn't", "tailscale netcheck reports UDP blocked", or "large transfers stall while small probes succeed". Contents: wg-quick policy-routing internals (rules 5208/5209, table 51820, fwmark 0xca6c), MTU selection for stacked tunnels, the two leak modes specific to Tailscale-on-WG (fwmark 0x80000 bypass at 5210/5230/5250, and wg-quick's 5209 catch-all shadowing the tailnet routes) with copy-pasteable wg0.conf PostUp/PreDown fixes, leak-verification recipe, and a diagnostic command table covering ip route get … mark, ss -tunpe, the three tailscale ping modes, and journalctl interpretation. Generalizes to ZeroTier/Nebula/OpenVPN. |
Common Tasks
Get to the admin panel
Connect to the router by Ethernet (LAN port) or Wi-Fi (GL-BE3600-XXX), then open http://192.168.8.1.
Connect to a VPN provider
Admin Panel → VPN → WireGuard Client (or OpenVPN Client) → select provider or "Add Manually" → upload config → start. See web-ui-guide.md for provider-specific credential notes.
Enable ad blocking
Admin Panel → Applications → AdGuard Home → toggle on. Can also be toggled directly from the touchscreen.
Share Wi-Fi credentials via QR code
Swipe the touchscreen to the Wi-Fi screen — it shows the SSID, password, and a scannable QR code.
Reset to factory defaults
Hold the reset button until the touchscreen shows "Release to Reset Mode", then release. Or: Admin Panel → System → Reset Firmware → Delete All and Reboot.
Access CLI
ssh root@192.168.8.1 — password is the same as your admin panel password. See setup-and-management.md for useful commands.
Run a VPN server (WireGuard)
Admin Panel → VPN → WireGuard Server → Generate Configuration → Profiles tab → Add profile → export QR/config → Start server. Requires a public IP or DDNS hostname. Full flow in web-ui-guide.md.
Provision WireGuard server programmatically (no UI)
Auth to the /rpc API, then call wg-server.set_setting, wg-server.add_peer, wg-server.generate_peer, wg-server.start. End-to-end shell flow in wireguard-server-api.md. Underlying auth/envelope and reusable bash helper in json-rpc-api.md.
Script the admin panel
The admin UI is a Vue SPA over a JSON-RPC backend at http://192.168.8.1/rpc. Modules live in /usr/lib/oui-httpd/rpc/; method names and parameter shapes can be discovered from the gzipped Vue bundles in /www/views/. See json-rpc-api.md for the auth flow, request envelope, module/method discovery, and a reusable bash client.
Build a LAN-only WireGuard tunnel (no public IP / DDNS)
Set Endpoint = 192.168.8.1:<listen_port> in the client config and local_access: true on the server. The handshake stays on the LAN segment and the client gets full-tunnel egress through the router with no external port-forwarding. Verification (tcpdump leak check) and pitfalls in wireguard-server-api.md.
Layer Tailscale (or another overlay VPN) on top of a WG client tunnel
Naive stacking leaks two ways on Linux: Tailscale's fwmark 0x80000 bypass rules at priorities 5210/5230/5250 escape wg0, and wg-quick's catch-all at 5209 shadows Tailscale's tailnet routes in table 52. Both fixes are wg-quick PostUp/PreDown rule inserts (priorities 5200, 5205, 5206). Full explanation, ready-to-paste rules, MTU guidance for stacked tunnels, and diagnostic command table in wg-client-stacked-tunnels.md.
Router is unreachable at 192.168.8.1
Mode may have been switched to AP or WDS. Hold the reset button until the touchscreen shows "Release to Repair Mode", then release — this reverts to Router Mode. See setup-and-management.md.
Device bricked / firmware corrupted
Enter U-Boot recovery mode, set computer IP to 192.168.1.2, open http://192.168.1.1, flash firmware. Full procedure in setup-and-management.md.
Network Modes Summary
| Mode |
NAT/DHCP |
Admin at 192.168.8.1 |
VPN/Features |
Best For |
| Router (default) |
Yes |
Always |
All enabled |
Gateway, travel, primary router |
| Access Point |
No |
No — find IP from upstream |
Limited |
Wired uplink, extend coverage |
| Extender |
No |
Yes |
Limited |
Wireless range extension |
| WDS |
No |
No — find IP from upstream |
Limited |
Multi-router bridge |
| Drop-in Gateway |
Transparent |
Yes |
VPN + AdGuard for entire upstream network |
Augment existing router |
Full mode details and switching instructions: hardware-and-features.md
1---2name: glinet-slate73description: Use when the user asks about the GL-iNet Slate 7 or GL-BE3600 travel router (Wi-Fi 7) - first connection and setup, admin panel access, VPN client or server configuration with WireGuard or OpenVPN (NordVPN, Mullvad, Surfshark and 30+ providers), AdGuard Home, Tor, Tailscale or ZeroTier, DDNS, network modes, SSH and CLI access, lost admin access, factory reset, firmware update, or U-Boot recovery of a bricked device. Also use when scripting the device through its JSON-RPC admin API at /rpc, provisioning the built-in WireGuard server without the UI (wg-server, add_peer, generate_peer), or configuring a Linux WireGuard client with an overlay VPN stacked on top of it. Applies to most GL-iNet sdk4 firmware devices, not to generic router questions.4license: MIT5---67# GL-iNet Slate 7 (GL-BE3600) Reference89**Applies to:** the GL-iNet Slate 7 (GL-BE3600, Wi-Fi 7). The JSON-RPC admin API, WireGuard server provisioning, and stacked-tunnel material apply to most GL-iNet sdk4 firmware devices, not only the Slate 7.1011---1213## Quick Reference1415| Item | Value |16|------|-------|17| Model | GL-BE3600 (Slate 7) |18| Admin panel URL | `http://192.168.8.1` |19| Default LAN subnet | `192.168.8.0/24` |20| Default 2.4 GHz SSID | `GL-BE3600-XXX` (see bottom label) |21| Default 5 GHz SSID | `GL-BE3600-XXX-5G` (see bottom label) |22| Default Wi-Fi password | Printed on bottom label |23| Admin password | None — must be set on first boot |24| SSH username / port | `root` / `22` |25| SSH password | Same as admin password |26| U-Boot recovery IP | Computer: `192.168.1.2` → Router: `192.168.1.1` |27| Soft reset (Repair Mode) | Hold reset until touchscreen shows "Release to Repair Mode" |28| Factory reset | Hold reset until touchscreen shows "Release to Reset Mode" |29| Firmware downloads | `https://dl.gl-inet.com/router/be3600/` |30| Official docs | `https://docs.gl-inet.com/router/en/4/user_guide/gl-be3600/` |3132---3334## What This Router Does3536The Slate 7 is purpose-built for three scenarios:37381. **Privacy on the go** — connects to hotel/cafe Wi-Fi or cellular data, then presents a clean, VPN-protected network to all your devices392. **Portable gateway** — acts as a full NAT router with firewall, DHCP, and DNS for any location403. **Remote access hub** — runs WireGuard or OpenVPN server so you can reach your home network securely from anywhere4142---4344## Key Capabilities at a Glance4546- **Wi-Fi 7 (802.11be)** with MLO — up to 3,570 Mbps theoretical, 2.4 GHz + 5 GHz simultaneously47- **2.5 Gbps WAN + 2.5 Gbps LAN** Ethernet ports48- **WireGuard client** up to ~490 Mbps throughput; **OpenVPN with DCO** up to ~385 Mbps49- **30+ VPN provider integrations** (NordVPN, Mullvad, Surfshark, PIA, and more)50- **VPN Server** (WireGuard + OpenVPN) with client config export51- **AdGuard Home** — DNS-level ad/tracker blocking, pre-installed (disabled when Tor is active)52- **Tor** — full-tunnel Tor routing for all connected devices (mutually exclusive with VPN clients, AdGuard Home, DNS encryption, and IPv6)53- **Tailscale** and **ZeroTier** overlay networking54- **Multi-WAN failover** — Ethernet + Repeater + Cellular with automatic switchover55- **Drop-in Gateway mode** — extend any existing router with VPN and ad blocking56- **Touchscreen** — swipe through status screens; toggle VPN and view Wi-Fi QR code without a browser; physical side toggle button assignable via System → Toggle Button Settings57- **USB 3.0** — smartphone tethering, 4G/5G dongle, or network-attached storage58- **LuCI (full OpenWrt UI)** accessible via Admin Panel → System → Advanced Settings5960---6162## Reference Files6364| File | Contents |65|------|----------|66| [hardware-and-features.md](hardware-and-features.md) | Hardware specs, ports, buttons, touchscreen screens, LED behavior, network modes comparison, feature limitations and known issues |67| [web-ui-guide.md](web-ui-guide.md) | Admin panel menu structure, every section explained, VPN setup flows (WireGuard client/server, OpenVPN client/server), AdGuard, DDNS, Tailscale, Tor, Multi-WAN |68| [setup-and-management.md](setup-and-management.md) | Initial connection and first-time setup wizard, direct connection (no internet), SSH/CLI access and useful commands, troubleshooting, firmware update, U-Boot recovery |69| [json-rpc-api.md](json-rpc-api.md) | The `/rpc` JSON-RPC backend used by the admin panel — auth flow (challenge → SHA-256 crypt → sid), call envelope, module/method discovery via `.so` strings and gzipped Vue bundles in `/www/views/`, common modules table, reusable bash helper, error codes and pitfalls |70| [wireguard-server-api.md](wireguard-server-api.md) | Programmatic provisioning of the built-in WireGuard server: `wg-server` module method reference, `add_peer` / `generate_peer` parameter shapes, end-to-end provisioning flow, server-side state inspection (UCI vs kernel vs RPC), local-only Endpoint pattern for LAN-side clients, leak verification |71| [wg-client-stacked-tunnels.md](wg-client-stacked-tunnels.md) | **Read when:** configuring a Linux WireGuard client against the GL-iNet server, debugging a full-tunnel WG client that won't reach the internet or tailnet, layering Tailscale/ZeroTier/another overlay on top of a WG client, or seeing symptoms like *"`tailscale ping --tsmp` works but ICMP/SSH to a tailnet peer doesn't"*, *"`tailscale netcheck` reports UDP blocked"*, or *"large transfers stall while small probes succeed"*. **Contents:** wg-quick policy-routing internals (rules 5208/5209, table 51820, fwmark `0xca6c`), MTU selection for stacked tunnels, the two leak modes specific to Tailscale-on-WG (fwmark `0x80000` bypass at 5210/5230/5250, and wg-quick's 5209 catch-all shadowing the tailnet routes) with copy-pasteable `wg0.conf` `PostUp`/`PreDown` fixes, leak-verification recipe, and a diagnostic command table covering `ip route get … mark`, `ss -tunpe`, the three `tailscale ping` modes, and journalctl interpretation. Generalizes to ZeroTier/Nebula/OpenVPN. |7273---7475## Common Tasks7677### Get to the admin panel78Connect to the router by Ethernet (LAN port) or Wi-Fi (`GL-BE3600-XXX`), then open `http://192.168.8.1`.7980### Connect to a VPN provider81Admin Panel → VPN → WireGuard Client (or OpenVPN Client) → select provider or "Add Manually" → upload config → start. See [web-ui-guide.md](web-ui-guide.md) for provider-specific credential notes.8283### Enable ad blocking84Admin Panel → Applications → AdGuard Home → toggle on. Can also be toggled directly from the touchscreen.8586### Share Wi-Fi credentials via QR code87Swipe the touchscreen to the Wi-Fi screen — it shows the SSID, password, and a scannable QR code.8889### Reset to factory defaults90Hold the reset button until the touchscreen shows **"Release to Reset Mode"**, then release. Or: Admin Panel → System → Reset Firmware → Delete All and Reboot.9192### Access CLI93`ssh root@192.168.8.1` — password is the same as your admin panel password. See [setup-and-management.md](setup-and-management.md) for useful commands.9495### Run a VPN server (WireGuard)96Admin Panel → VPN → WireGuard Server → Generate Configuration → Profiles tab → Add profile → export QR/config → Start server. Requires a public IP or DDNS hostname. Full flow in [web-ui-guide.md](web-ui-guide.md).9798### Provision WireGuard server programmatically (no UI)99Auth to the `/rpc` API, then call `wg-server.set_setting`, `wg-server.add_peer`, `wg-server.generate_peer`, `wg-server.start`. End-to-end shell flow in [wireguard-server-api.md](wireguard-server-api.md). Underlying auth/envelope and reusable bash helper in [json-rpc-api.md](json-rpc-api.md).100101### Script the admin panel102The admin UI is a Vue SPA over a JSON-RPC backend at `http://192.168.8.1/rpc`. Modules live in `/usr/lib/oui-httpd/rpc/`; method names and parameter shapes can be discovered from the gzipped Vue bundles in `/www/views/`. See [json-rpc-api.md](json-rpc-api.md) for the auth flow, request envelope, module/method discovery, and a reusable bash client.103104### Build a LAN-only WireGuard tunnel (no public IP / DDNS)105Set `Endpoint = 192.168.8.1:<listen_port>` in the client config and `local_access: true` on the server. The handshake stays on the LAN segment and the client gets full-tunnel egress through the router with no external port-forwarding. Verification (tcpdump leak check) and pitfalls in [wireguard-server-api.md](wireguard-server-api.md).106107### Layer Tailscale (or another overlay VPN) on top of a WG client tunnel108Naive stacking leaks two ways on Linux: Tailscale's `fwmark 0x80000` bypass rules at priorities 5210/5230/5250 escape `wg0`, and `wg-quick`'s catch-all at 5209 shadows Tailscale's tailnet routes in table 52. Both fixes are `wg-quick` `PostUp`/`PreDown` rule inserts (priorities 5200, 5205, 5206). Full explanation, ready-to-paste rules, MTU guidance for stacked tunnels, and diagnostic command table in [wg-client-stacked-tunnels.md](wg-client-stacked-tunnels.md).109110### Router is unreachable at 192.168.8.1111Mode may have been switched to AP or WDS. Hold the reset button until the touchscreen shows "Release to Repair Mode", then release — this reverts to Router Mode. See [setup-and-management.md](setup-and-management.md).112113### Device bricked / firmware corrupted114Enter U-Boot recovery mode, set computer IP to `192.168.1.2`, open `http://192.168.1.1`, flash firmware. Full procedure in [setup-and-management.md](setup-and-management.md).115116---117118## Network Modes Summary119120| Mode | NAT/DHCP | Admin at 192.168.8.1 | VPN/Features | Best For |121|------|----------|----------------------|--------------|----------|122| **Router** (default) | Yes | Always | All enabled | Gateway, travel, primary router |123| **Access Point** | No | No — find IP from upstream | Limited | Wired uplink, extend coverage |124| **Extender** | No | Yes | Limited | Wireless range extension |125| **WDS** | No | No — find IP from upstream | Limited | Multi-router bridge |126| **Drop-in Gateway** | Transparent | Yes | VPN + AdGuard for entire upstream network | Augment existing router |127128Full mode details and switching instructions: [hardware-and-features.md](hardware-and-features.md)
AeyeOps