Use cases overview
The Gateway is general-purpose, but five deployment shapes cover the majority of what operators actually build with it. Each page below walks the full setup end to end — hardware, install profile, network topology, policies, kill-switch behaviour and trade-offs.
How to choose
Section titled “How to choose”| If you want… | Start with |
|---|---|
| A privacy-first router for a home with mixed devices | Family router |
| A pocket router you take on the road | Travel router |
| Per-role enforcement (devs/finance/HR) with compliance audit | Small office |
| Two ISP uplinks sharing load | Dual-WAN |
| Home lab + a remote VPS acting as one logical system | Hybrid lab |
Combining shapes
Section titled “Combining shapes”The five aren’t exclusive — most real deployments mix two or three. A few common combinations:
- Family router + hybrid lab: home Pi as a family router; remote VPS as a federation primary and inbound link. Kids’ policy applies whether you’re home or accessing via the VPS.
- Travel router + bridge node: travel Pi outbound; a static VPS in a friendly jurisdiction as the bridge. SNI fronting hides everything from hotel-grade DPI.
- Small office + dual-WAN: per-role routing on top of two ISP uplinks. Finance pinned to the better link via higher-priority policy; everyone else load-balanced.
Each use-case page shows one shape in detail; once you’ve built one, layering another is mostly adding tunnels and policies — the data model stays the same.
Related
Section titled “Related”- Features overview — the subsystems each use case combines.
- Recipes — copy-paste snippets for individual building blocks.
- Comparisons — how each shape compares to alternatives.
Anti-censorship family routerRaspberry Pi 4 at home. Kids on bridge proxies, adults on split tunnels, IoT direct. Fail-closed for everyone.
Self-hosted travel routerPi 4 in a bag, single NIC, portable mode. Hotel WiFi upstream, your own WPA2 AP downstream, all traffic through a privacy-level-4 pool.
Small office gatewayVPS or local box for a 5-person startup. Per-role routing: devs direct, finance VPN-only with kill-switch, HR via bridge.
Dual-WAN load balancingTwo ISP uplinks, 50/50 split with per-connection affinity. Failover to single link with kill-switch on the dead one.
Hybrid home labHome Pi + remote VPS, federated, meshed. LAN devices route through either node; the VPS gives you a stable inbound point and a censorship-free egress.