Epoch guide

Epoch makes a Windows laptop look like it is at home, and proves it with a check you can run any time. Ghost Mode is one switch: on before you travel, off when you are back.

Before you start

Epoch changes settings on the laptop and checks the result. It does not change your travel router; with an Epoch Kit, the router side is done for you.

Install

1. Download the Epoch installer (Epoch-<version>.msi) from the link in your order email.
2. Open it. This early-access build is not code-signed yet, so Windows shows "Windows protected your PC". Click More info, then Run anyway. The next prompt names an unknown publisher; choose Yes. You are asked once.
3. Done. The Epoch icon (a shield) appears by the clock; click the ^ arrow if it is hidden. Epoch starts with Windows from now on.
4. Activate. Right-click the icon, choose Licence..., paste the key from your order email and click ACTIVATE. Do this once on each laptop, while you have internet; a key covers two laptops.

Set up the routers (once, at home)

There are two ends. The home end stays plugged in at home and is where your traffic comes out. The travel router goes in your bag and carries the tunnel back to it. Set both up at home, before your first trip: the home end cannot be fixed from abroad.

	Epoch Kit	Your own routers
Home end	GL.iNet Brume 2 (in the kit)	Your home router's VPN server (OpenVPN or WireGuard), e.g. TP-Link Archer, Asus, GL.iNet Flint
Travel router	GL.iNet Beryl AX (in the kit)	GL.iNet Beryl AX (GL-MT3000) recommended
Tunnel	Set up by Epoch before shipping	You configure it (below)
Time needed	About 10 minutes	About 45 minutes

Epoch Kit

1. Home end: plug the Brume 2's WAN port into a spare LAN port on your home internet router with the short cable in the kit, and power it with its USB-C adapter. After about 2 minutes its light turns steady. Leave it on for as long as you travel; if it loses power, the laptop goes offline but is never exposed.
2. Travel router: power the Beryl AX and plug the laptop into its LAN port with the cable.
3. Practice run: turn on your phone's personal hotspot and join the Beryl AX to it (steps in At a cafe or hotel). After about 30 seconds, do First run below, then click RUN CHECKS. ✔ PROTECTED means both ends work. Your setup call confirms this with you.

Your own routers: home end (TP-Link example)

1. Sign in to http://tplinkwifi.net (or the address on the router's label) on a computer at home.
2. Dynamic DNS: bind a free TP-Link ID to the router, then Advanced > Network > Dynamic DNS, provider TP-Link, Register a hostname such as yourname.tplinkdns.com. It follows your home address when your provider changes it.
3. VPN server: Advanced > VPN Server > OpenVPN: on, UDP, port 1194, client access Internet and Home Network (the option that includes the internet). "Home Network Only" fails the checks.
4. Export the configuration file (.ovpn); click Generate first only if no certificate exists, and never again afterwards.
5. Edit the file in Notepad: set the remote line to remote yourname.tplinkdns.com 1194 and add data-ciphers AES-256-GCM:AES-128-GCM:AES-128-CBC and data-ciphers-fallback AES-128-CBC at the end.
6. Remote Management off (Advanced > System > Administration).

Your own routers: travel router (Beryl AX)

1. First sign-in: join your phone to its Wi-Fi (label underneath), open http://192.168.8.1 and set a strong admin password.
2. Wireless: change the Wi-Fi name and password from the label's.
3. System > Upgrade > Firmware Online Upgrade.
4. Cloud Services > GoodCloud (older firmware: Applications > GoodCloud): remote access off.
5. VPN > OpenVPN Client > Add Manually: name the group, upload the .ovpn file, Apply. Start it from the three-dot icon; a green dot means connected.
6. Kill switch: VPN > VPN Dashboard: Enhanced Kill Switch (firmware 4.8+), or Global Options > Block Non-VPN Traffic (older). Without it, traffic goes out directly whenever the tunnel drops.
7. Practice run on your phone's hotspot, as for the kit above.

First run: set home

Do this at home, before your first trip. The order is: set up the routers, set home, check the tunnel, then travel.

1. Connect: at home on your normal connection, or through your travel router's tunnel home. Not on hotel, cafe or phone internet: Epoch would treat that place as home.
2. Right-click the Epoch icon > Set home... and answer Yes. Epoch reads where your connection comes out and shows you the place, provider and address.
3. Check it is your home, then answer Yes. If it shows anywhere else, answer No and home stays as it was. Epoch saves your home country, time zone and regional format, and the Epoch window shows them on the HOME line.
4. Epoch Kit owners: cable the laptop to the travel router, then right-click > Set up travel router... Enter the admin password from your kit card and click Test and save.

Before you leave, cable the laptop to the travel router and switch Ghost Mode on (Everyday use). ✔ PROTECTED means the tunnel comes out at the home you just saved. The travel router needs no setting for this: its tunnel is what takes your traffic home, and Set home only records what home looks like so the checks can compare.

Your home internet address can change. If the check later says your connection has the same provider as home but a different address, run Set home again through the tunnel.

Everyday use

Before you leave

Click the Epoch icon, then the big GHOST OFF button. Epoch hardens the laptop, turns Wi-Fi and Bluetooth off, and runs the full check. You should see ✔ PROTECTED.

On the road

Plug the laptop into the travel router with the cable. Click RUN CHECKS whenever you want proof. Connecting the router at a cafe or hotel, including their login pages: see At a cafe or hotel.

Back home

Click GHOST ON. Windows asks "Switch Ghost Mode off?"; choose Yes. Wi-Fi, Bluetooth and your original settings come back. If you did not ask for it, choose No: any program on the laptop could have requested it, and only you at the keyboard can approve. No answer in 2 minutes counts as No.

Epoch shows	Meaning
✔ PROTECTED	Every check passed.
▲ DEGRADED	Ghost Mode is on but some checks fail. The list shows each one and what it should be. See Troubleshooting.
✖ EXPOSED	Ghost Mode is off: the laptop shows its real location.

At a cafe or hotel

The travel router joins the venue's Wi-Fi, never the laptop. You set it up from your phone in about 3 minutes; the laptop stays on the cable throughout, and Ghost Mode can stay on.

What	Value
Router Wi-Fi	Name and password on your kit card (own router: as you set them)
Router admin page	http://192.168.8.1
Router admin password	Kit card only
Login-page trigger	http://neverssl.com

Connect

1. Power the router from a USB-C charger or power bank; its light turns steady after about a minute.
2. Cable the laptop into the router's LAN port. (WAN is only for a hotel wall cable.)
3. Join your phone to the router's Wi-Fi. The phone says No internet connection; choose Stay connected or Keep Wi-Fi. On Android, switch mobile data off for these few minutes if pages fail to load.
4. Open the admin page at 192.168.8.1 on the phone and sign in. (The laptop can open it over the cable too; the page lives on the router.)
5. Internet > Repeater > Connect: pick the venue's network (e.g. Google Starbucks), enter its password if it has one, tap Apply. Not listed or hidden: Join Other Network. Hotel wall cable instead: plug it into WAN and skip this step.

Accept the login page

Starbucks and most hotels block the internet until someone accepts their terms or enters a room number. The tunnel cannot connect until that is done. Never open that page on the laptop: the venue would record it, and the router blocks it anyway. If the router's admin page offers Login Mode for Public Hotspots, decline it; it relaxes protection for every device.

1. Slide the router's side switch toward the back. For 5 minutes, devices other than the laptop (your phone) can reach the venue directly. The laptop stays tunnel-only.
2. On the phone, open neverssl.com. The venue's page appears; accept it or enter your room details.
3. Slide the switch back toward the front (the antenna side), its normal position. The window also closes by itself after 5 minutes.
4. Check: after about 30 seconds, click RUN CHECKS on the laptop and look for ✔ PROTECTED.

The venue sees your phone during those 5 minutes, so use it only for the login page. Hotels often ask again every 24 hours: repeat the steps. Own router without a side switch: follow its maker's login-page steps and unplug the laptop while its VPN protection is relaxed.

What Ghost Mode changes

Everything is backed up first and restored when you switch Ghost Mode off.

Setting	In Ghost Mode
Wi-Fi and Bluetooth	Off, so nearby networks and devices cannot place the laptop.
Windows location	Location service off and app access denied by policy.
Browsers (Chrome, Edge, Brave)	Websites cannot ask for your location; WebRTC cannot reveal your network address.
Time zone	Pinned to home; automatic time zone off.
Region and formats	Windows country/region and date/number formats set to home.
IPv6	Off on every adapter, so nothing leaves outside the tunnel.

Licence and updates

Epoch needs the licence only to switch Ghost Mode on. Switching off, running checks and a Ghost Mode that is already on never depend on it, so a licence problem cannot remove your protection or leave you stuck in Ghost Mode.

After activation Epoch works offline. It renews by itself about once a month when it has internet. Being offline never stops it: if the server cannot be reached, including during the first activation, Epoch keeps working and retries. It refuses to switch on only with no key, or once the licence server has said the licence ended or was cancelled.

Once a week Epoch checks for a newer version. If there is one, a notice appears and the tray menu gets an Update available item that opens the download page. Nothing installs by itself; run the new installer over the old one and your settings stay.

What leaves the laptop: activation and renewal send your key and a one-way hash of the Windows machine ID to ripplemark.io. The update check downloads one file from GitHub and sends nothing of yours. Neither is sent through a special route, so outside Ghost Mode those servers can see your network address, as with any web request. Epoch's own code does not record addresses; the hosting providers keep their own request logs.

Troubleshooting

Each failing check is listed in the Epoch window with its value and what it should be.

Failing check	What to do
Public IPv4 egress	Your traffic is not leaving from home. Check the cable and that the travel router's tunnel is connected. If it says same ISP as home and you are on the tunnel, your home address changed: run Set home again.
Default gateway	The laptop is not on the travel router. Check the cable is in the router's LAN port.
Wi-Fi adapter / Bluetooth radio	Something turned them back on. Switch Ghost Mode on again.
Timezone, Windows region, Regional format	A setting was changed by hand or by an app. Switch Ghost Mode on again.
VPN adapters present / VPN processes running	A VPN app is on the laptop. The tunnel belongs on the travel router; quit or uninstall the laptop VPN.
Public IPv6 egress, IPv6 default route	Your network offers IPv6 around the tunnel. Switch Ghost Mode on again; if it stays, ask for help.
Resolver seen by internet	Name lookups are leaving outside home. Check the travel router's DNS goes through the tunnel.
HOME ○ NOT SET	Run Set home (First run, above).
ROUTER ▲ NOT FOUND	Kit owners: check the cable, then Set up travel router... again.

Uninstall

1. Switch Ghost Mode off first, so your original settings come back.
2. Open Settings > Apps > Installed apps, find Epoch, and choose Uninstall.

Help

Email support@epochprivacy.com with a screenshot of the Epoch window. Kit owners can book a 30-minute setup call: mailto:support@epochprivacy.com.

Early-access build.