Choose a trustworthy VPN with audited no‑logs claims, enable kill switches, and prefer WireGuard for speed. Pair with DNS over HTTPS and cautious link‑checking. These practices blunt captive portal risks and ensure route maps, payments, and chat apps work without leaking sensitive details.
Turn off UPnP, restrict management to the local interface, and keep firmware updated before crossing time zones. Hide SSID only when necessary, rotate passwords, and limit administrative access, so an opportunistic attacker cannot reconfigure or spy on your traveling network.