For most homes and small businesses, the best backup is an independent 4G or 5G connection connected to a dual-WAN router. The router monitors your main line, switches traffic to cellular when health checks fail, and switches back after the primary connection is stable. Put the modem, router, cellular gateway and backup equipment on a UPS so a local power cut does not take both connections offline.
Use a phone hotspot only as a short, manual fallback for a few devices. Consider Starlink when mobile coverage is unreliable or you need a physically separate path from cable, fiber or DSL. Whatever you choose, confirm data limits, coverage, power requirements and failback behavior, then test the complete system before an outage.
As an Amazon Associate I earn from qualifying purchases.
What makes an internet backup reliable?
A backup works only when it survives the failure that took out your primary service. If your cable and second cable service use the same neighborhood plant, pole, duct, backhaul provider or regional facility, one construction cut or upstream outage can disable both. A different access technology and a different physical path provide stronger resilience.
There are two separate problems to solve:
- Upstream connectivity: an alternate service such as cellular, satellite or a genuinely independent wired provider.
- Local power and equipment: a UPS and correctly configured network hardware that remain operational during a power interruption.
A UPS cannot repair an ISP outage, and a second internet service cannot help if your router, modem or cellular gateway has no power. Design both layers together.
#1 Best Overall
- 【Flexible Port Configuration】1 2.5Gigabit WAN Port + 1 2.5Gigabit WAN/LAN Ports + 4 Gigabit WAN/LAN Port + 1 Gigabit SFP WAN/LAN Port + 1 USB 2.0 Port (Supports USB storage and LTE backup with LTE dongle) provide high-bandwidth aggregation connectivity.
- 【High-Performace Network Capacity】Maximum number of concurrent sessions – 500,000. Maximum number of clients – 1000+.
- 【Cloud Access】Remote Cloud access and Omada app brings centralized cloud management of the whole network from different sites—all controlled from a single interface anywhere, anytime.
- 【Highly Secure VPN】Supports up to 100× LAN-to-LAN IPsec, 66× OpenVPN, 60× L2TP, and 60× PPTP VPN connections.
- 【5 Years Warranty】Backed by our 5-years warranty and free technical support from 6am to 6pm PST Monday to Fridays
Backup options compared
| Option | Independence from primary outage | Coverage or site requirement | Failover method | Data and recurring-cost considerations | Setup and power needs | Suitable scale |
|---|---|---|---|---|---|---|
| Dedicated 4G/5G hotspot or gateway | High when the mobile network is not the primary provider’s infrastructure; lower if both services share a local failure or the cellular tower is affected | Reliable 4G/5G signal at the building; gateway placement may affect signal | Automatic through a dual-WAN router; manual with a standalone hotspot | Carrier policy, throttling and data limits vary by address and plan; set a hard limit where the device supports it | Gateway, SIM and power adapter; place on UPS for outage operation | Home, small office and moderate device counts, subject to the plan’s capacity |
| Phone hotspot | Independent of a fixed-line outage, but dependent on the handset, battery and carrier tethering policy | Mobile signal and a phone positioned where reception is good | Usually manual; each device joins the phone’s hotspot | Often subject to handset-plan limits, throttling or tethering restrictions | No extra hardware, but the phone must stay charged and cool | A few critical devices for a short outage |
| Dual-WAN router | Depends on the two WAN services attached to it | Requires two usable WAN inputs or a supported LAN-connected cellular mode | Automatic health checks, failover and failback; policy controls can keep selected traffic on one link | The router itself adds a one-time cost; cellular usage still follows the carrier’s terms | Router, modem or gateway, configuration and UPS capacity for the entire network stack | Whole home or office, including wired devices, VLANs and multiple access points |
| Starlink satellite | Strong physical-path diversity from terrestrial cable, fiber or DSL | Unobstructed sky view, outdoor terminal placement, mounting and weather exposure planning | Automatic with a multi-WAN or SD-WAN gateway; otherwise manual cable changes | Current service terms and regional availability apply; verify the plan before purchase | Terminal and networking equipment need continuous power, including during severe weather | Sites where cellular is weak or a separate terrestrial route is unavailable |
| Second wired ISP | Useful only when the last-mile network and upstream route are genuinely different | Address-specific availability; ask providers about shared poles, ducts, backhaul and regional dependencies | Automatic with a dual-WAN or SD-WAN gateway | Two recurring subscriptions; no cellular data cap, but each provider’s service terms apply | Second modem or ONT, gateway ports and UPS capacity | High device counts and sustained office traffic when both networks are independent |
1. 4G or 5G hotspot and cellular gateway
Cellular is normally the simplest backup where mobile coverage is strong. A dedicated hotspot or cellular gateway can connect directly to a router’s second WAN port, or it can operate as a LAN-connected backup device. Ubiquiti documents both approaches: a cellular device can be used as a standard WAN link or connected on the LAN for backup and failover. The exact menu names depend on the gateway and router software, so check the current documentation for your model.
Dedicated gateway versus hotspot
A dedicated gateway is designed to stay connected, expose Ethernet, and run from a fixed power source. It is easier to place near a window or in a location with better signal while keeping the main router in a wiring cabinet. A hotspot is simpler and cheaper to deploy, but Wi-Fi tethering, battery life, heat, USB or Ethernet limitations and carrier tethering rules can become failure points.
A phone hotspot is reasonable for a short outage affecting a laptop, tablet or point-of-sale device. It is not a dependable whole-office design: every device must be moved to the phone’s network, the handset may sleep or overheat, and the connection is manual unless you add specialized hardware.
Free tools Windows power users keep installed
One-click scans. No signup required.
Control cellular data before it controls your bill
Failover can consume cellular data quickly because cloud backups, operating-system updates, video calls and streaming continue to run after the switch. Ubiquiti recommends setting a data limit because some LTE backup devices can purchase additional data automatically. Use the gateway or carrier controls to define a monthly ceiling, alert threshold and behavior when the allowance is exhausted. Decide in advance whether noncritical traffic should be blocked, throttled or allowed to continue.
Check signal at the actual installation point
Coverage maps are not a guarantee inside your building. Test the SIM and gateway where it will operate, at different times of day, and during the weather conditions that commonly affect your site. If signal is marginal, try a window-facing location, an approved external antenna or a different carrier. Keep the cellular gateway reachable for maintenance and on the same UPS as the router.
2. Dual-WAN routing for automatic switching
The dual-WAN router is the control point for a whole-home or office backup. WAN 1 connects to the primary modem or optical network terminal; WAN 2 connects to the cellular gateway, satellite terminal or second ISP. The router sends health-check probes to determine whether the primary path can actually reach the internet, not merely whether the Ethernet cable is plugged in.
Rank #2
- 【Five Gigabit Ports】1 Gigabit WAN Port plus 2 Gigabit WAN/LAN Ports plus 2 Gigabit LAN Port. Up to 3 WAN ports optimize bandwidth usage through one device.
- 【One USB WAN Port】Mobile broadband via 4G/3G modem is supported for WAN backup by connecting to the USB port. For complete list of compatible 4G/3G modems, please visit TP-Link website.
- 【Abundant Security Features】Advanced firewall policies, DoS defense, IP/MAC/URL filtering, speed test and more security functions protect your network and data.
- 【Highly Secure VPN】Supports up to 20× LAN-to-LAN IPsec, 16× OpenVPN, 16× L2TP, and 16× PPTP VPN connections.
- Security - SPI Firewall, VPN Pass through, FTP/H.323/PPTP/SIP/IPsec ALG, DoS Defence, Ping of Death and Local Management. Standards and Protocols IEEE 802.3, 802.3u, 802.3ab, IEEE 802.3x, IEEE 802.1q
What automatic failover should do
- Monitor the primary WAN with more than one health-check target or method where the router allows it.
- Declare the primary unavailable only after consecutive failures, avoiding a switch for a momentary packet loss.
- Move new sessions to the secondary WAN while preserving local addressing, DHCP and firewall policy.
- Keep selected traffic, such as business VPNs or voice services, on a preferred link when policy routing supports it.
- Probe the primary until it is stable, then fail back according to a deliberate delay rather than immediately after one successful response.
Existing sessions may not survive a WAN change because their public source address changes. Expect some VPNs, video meetings and downloads to reconnect. Applications that reconnect automatically will recover faster than those that pin a session to the old address.
Hardware features to require
- Two Ethernet WAN inputs, or documented support for a LAN-connected cellular device.
- Configurable health checks, failure thresholds, recovery delays and failback.
- VLAN, policy-routing and firewall controls if guest, work and critical devices need different treatment.
- VPN compatibility and a way to avoid exposing management interfaces on the cellular link.
- Usage accounting, data-limit controls or integration with the cellular gateway.
- Firmware support and logs that show why a failover occurred.
Example of an automatic 5G setup
NETGEAR documents an Ethernet-to-5G arrangement using an MD200 cradle and a compatible hotspot. The fixed Ethernet connection feeds the router, while the cradle presents the hotspot’s 5G connection as the alternate path. With the cradle, switching can be automatic; without it, the user must move the connection manually. Confirm that the exact hotspot, cradle and router combination is supported before relying on it.
3. Starlink as a satellite backup
Starlink’s enterprise FAQ answers the business use case directly: “Can I use Starlink as a back-up / failover option for my business? Yes, this is possible and many businesses currently use Starlink as secondary or tertiary backup connection.” That makes it a practical option where mobile coverage is poor or where a business wants a route independent of terrestrial cable, fiber and DSL.
When satellite is the better choice
- The building has weak or congested 4G/5G service.
- The primary and local alternatives all use the same buried or aerial infrastructure.
- The site can provide a clear, stable view of the sky and a safe terminal location.
- The business can tolerate the installation, equipment and plan costs of a separate satellite service.
Starlink says it aims for 99.99% uptime, while also noting that reliability can vary by region. Treat 99.99% as a vendor aim, not a guarantee for your address. Weather, obstructions, regional capacity, terminal power and service-plan terms still matter.
Installation and operating requirements
Plan for an unobstructed view, a secure mount, a cable route that protects the connector, and power for the terminal and its networking equipment. Trees that appear clear in dry weather can obstruct the link when wind moves branches. Put the terminal’s power supply and the indoor router on the UPS if satellite backup must work during a utility outage. Check current regional availability and plan terms before ordering because those details change.
Recommended Free Tools
4. A second wired ISP
A second cable, fiber or fixed-wireless provider can be excellent for a busy office because it usually supports sustained traffic without a cellular allowance. It is redundant only if the networks are independent enough. Ask both providers whether they share neighborhood poles, ducts, conduit, backhaul, aggregation equipment or a regional outage domain. Two brands can still depend on the same physical cut or upstream carrier.
Rank #3
- ALL-IN-ONE VPN SOLUTION FOR REMOTE WORK: Extends your corporate network to homes or remote offices, enabling access with enhanced security to resources without complex setup. Ideal for small businesses, entrepreneurs, and enterprises supporting remote or hybrid teams
- ENTERPRISE-GRADE SECURITY & ENCRYPTION: Helps protect sensitive data using IPSec, PPTP, L2TP, OpenVPN, SSL, and strong encryption (DES, 3DES, AES), reducing risk from external threats in an increasingly digital landscape
- FOLLOWS NDAA & TAA FOR ENHANCED TRUST: Made in Taiwan. Meets government and industry standards, making it well-suited for agencies and businesses under strict regulations, while providing reassurance for any organization seeking elevated data protection
- DUAL WAN FAILOVER FOR CONTINUOUS CONNECTIVITY: Automatically switches to a backup internet source if the primary goes down, minimizing disruptions to crucial tasks like video calls or file sharing. Load balancing ensures optimized bandwidth for smoother, more reliable performance
- SIMPLIFIED MANAGEMENT: Web-based and SNMP tools offer clear visibility and control, reducing complex troubleshooting and making it easier to deploy
Use a dual-WAN or SD-WAN gateway to manage the services. If both lines are uncapped and truly diverse, you can reserve one for critical applications, load-balance ordinary traffic or fail over the entire site. Availability is address-specific, so obtain an installation feasibility check rather than assuming a second provider serves the building.
Choose by site and failure scenario
Home office with strong mobile coverage
Use the existing wired line as WAN 1, a dedicated 4G/5G gateway as WAN 2 and a dual-WAN router for automatic switching. Put the modem, router, gateway and Wi-Fi access point on a UPS. Set a data ceiling and exclude large backups or streaming from the cellular path when the primary is down.
Small office with many users
Favor a dedicated gateway or independent wired ISP over a phone hotspot. Size the backup for the number of simultaneous users and prioritize payment terminals, voice, VPN and remote-access traffic. Use VLANs and policy rules to prevent guest traffic from consuming the emergency link.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsRural site with weak cellular coverage
Test every available carrier first. If none is dependable, evaluate Starlink with a clear sky view and a UPS-backed terminal. A second fixed wireless or wired provider is useful only after you verify that it does not share the same local infrastructure as the primary.
Short, infrequent outages
A phone hotspot may be sufficient if only one or two people need email and messaging for an hour. Keep a charging cable and a written procedure available. Upgrade to a gateway and automatic failover when an outage interrupts business operations or affects more than a few devices.
How to build automatic failover
- Document the primary path. Record the modem or ONT model, WAN type, authentication method, public-address requirements, VPN settings and the equipment that must remain online.
- Validate the alternate service. Test cellular signal and throughput at the planned gateway location, or confirm satellite sky view and service availability. For a second wired ISP, obtain written details about its last-mile and upstream path.
- Install the dual-WAN gateway. Connect WAN 1 to the primary modem or ONT and WAN 2 to the cellular gateway, satellite router or second ISP. If using a LAN-connected cellular mode, follow the router and gateway documentation so the backup is not accidentally placed behind conflicting DHCP or NAT settings.
- Configure health checks. Use reliable external targets and set failure and recovery thresholds that tolerate brief packet loss. A link can have a live Ethernet signal while DNS, routing or upstream service is broken, so test beyond the local modem.
- Set failover policy. Choose which WAN carries ordinary traffic, VPNs, voice and management access. Set a recovery delay and decide whether the router should fail back automatically or wait for an administrator.
- Apply data controls. Enter the carrier allowance or gateway limit, enable alerts and block or throttle nonessential traffic during cellular operation. Check whether the device can buy extra data automatically and disable that behavior if the budget cannot tolerate it.
- Secure the alternate path. Keep firewall rules, administrative passwords, firmware and VPN policy consistent on both WANs. Do not expose the gateway’s management page directly to the internet.
- Label and document cables. Mark WAN 1, WAN 2, modem power, gateway power and UPS outlets. Store the recovery steps and carrier account details where another person can use them.
Power protection is part of the design
Put the primary modem or ONT, dual-WAN router, cellular gateway, Wi-Fi access points, switches and any satellite networking equipment on a UPS sized for the required runtime. Add the terminal or outdoor equipment when satellite is the backup. Measure the actual load rather than relying on a UPS’s headline capacity, and leave enough runtime to shut down equipment cleanly if the outage is prolonged.
Rank #4
- 【Flexible Port Configuration】1 Gigabit SFP WAN Port + 1 Gigabit WAN Port + 2 Gigabit WAN/LAN Ports plus1 Gigabit LAN Port. Up to four WAN ports optimize bandwidth usage through one device.
- 【Increased Network Capacity】Maximum number of associated client devices – 150,000. Maximum number of clients – Up to 700.
- 【Integrated into Omada SDN】Omada’s Software Defined Networking (SDN) platform integrates network devices including gateways, access points & switches with multiple control options offered – Omada Hardware controller, Omada Software Controller or Omada cloud-based controller(Contact TP-Link for Cloud-Based Controller Plan Details). Standalone mode also applies.
- 【Cloud Access】Remote Cloud access and Omada app brings centralized cloud management of the whole network from different sites—all controlled from a single interface anywhere, anytime.
- 【SDN Compatibility】For SDN usage, make sure your devices/controllers are either equipped with or can be upgraded to SDN version. SDN controllers work only with SDN Gateways, Access Points & Switches. Non-SDN controllers work only with non-SDN APs. For devices that are compatible with SDN firmware, please visit TP-Link website.
During a utility outage, the UPS keeps your local network alive only while the upstream services remain powered. A neighborhood fiber cabinet, cable node or cellular tower may have its own backup limits. This is why a UPS improves resilience but does not replace an independent access technology.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Test the system before you need it
- Record normal WAN status, public address, DNS behavior, VPN connectivity and the applications that matter.
- Disconnect the primary WAN cable or use the router’s documented disable control. Do not unplug random modem power if that could damage service provisioning.
- Confirm that the router marks WAN 1 down and moves new traffic to WAN 2.
- Verify that critical wired and wireless devices receive addresses, resolve DNS and reach required services.
- Join a video call, establish the business VPN, process a test transaction and check remote access if those functions are essential.
- Watch cellular or satellite usage and confirm that the configured limit and alerts behave as expected.
- Reconnect WAN 1 and verify the configured failback delay. Check whether sessions reconnect and whether traffic returns to the intended link.
- Repeat after firmware updates, SIM replacement, plan changes, router changes or a move to a different installation point.
Run the test periodically and keep a dated record of the result. A failover that worked during installation can fail later because a SIM expired, a carrier changed policy, a firmware update altered health checks or the backup account was suspended.
Troubleshooting common failures
The router never fails over
Check that WAN 2 has an address, a default route and working DNS. Inspect health-check logs and confirm that the router is testing an external destination rather than only the modem. Verify that the failover rule is enabled and that the primary has actually lost upstream reachability.
Failover occurs too often
Increase the number of consecutive failed probes or the recovery delay, and use more than one test target if supported. Check cabling, modem errors, radio signal and packet loss. A threshold that is too aggressive can create more disruption than a brief outage.
Cellular data disappears quickly
Look for cloud synchronization, operating-system updates, streaming, camera uploads and guest devices. Apply policy rules during backup mode, set a gateway limit and confirm that automatic extra-data purchases are disabled. Review carrier throttling and tethering terms.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Some applications break after switching
Public-address changes can invalidate VPNs, remote desktop sessions, allowlists and long-lived video calls. Configure supported VPN failover behavior, use hostnames instead of hard-coded addresses where appropriate, and document which applications must be restarted after a WAN change.
Best Value
- Easier-Than-Ever Setup — Convenient and easy router management via web browser or the ASUS ExpertWiFi mobile app through Bluetooth setup.
- VLAN for Added Security —Each of the Ethernet ports can be assigned to one or more VLAN IDs that provides additional security for your business.
- Up to 3 WAN Ethernet Ports – 1 gigabit WAN port and 2 gigabit WAN/LAN ports with load balancing optimize multi-line broadband usage.
- Backup WAN for Stable Connectivity –The USB port can be used as a backup WAN by connecting it to a mobile phone with hotspot to maintain a reliable internet connection.
- Commercial-Grade Network Security and VPN — Secure public WiFi connections with Safe Browsing and VPN features. Enjoy a free-subscription ASUS AiProtection Pro, including robust intrusion prevention system (IPS) features like deep packet inspection (DPI) and virtual patching to block malicious traffic.
Satellite backup is unstable
Inspect the sky view for new obstructions, verify terminal power and cable connections, and check regional service status. Weather and local capacity can affect performance even when the terminal is otherwise healthy.
The backup works but the office is still offline during a blackout
Check every networking component on the UPS, including access points, switches, modem or ONT and satellite power supplies. Confirm that the UPS has enough runtime and that a tripped surge protector is not bypassing it. Remember that the upstream provider may also lose power.
Security and operations during backup mode
Failover should preserve the same firewall, segmentation and administrative controls as the primary path. Keep guest Wi-Fi isolated, restrict management access, and verify that inbound services are not unintentionally exposed through the alternate provider. If the business publishes services from a fixed public address, ordinary failover may not preserve inbound reachability; arrange an application-level or hosted alternative if that requirement is critical.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallTell users what changes during an outage: nonessential video is paused, large uploads wait, and VPN or voice calls may reconnect. A short written runbook should include the WAN status page, carrier and satellite account contacts, UPS shutdown procedure and the decision point for switching to manual phone hotspots.
Practical purchase checklist
- Confirm the alternate service uses a different access technology or physical route from the primary.
- Measure signal or sky view at the final equipment location.
- Choose a router with the WAN ports, LAN-connected cellular support, health checks and policy controls you actually need.
- Verify carrier data limits, throttling, tethering rules, account status and any automatic overage behavior.
- Size the UPS for every device required to keep networking operational.
- Plan for public-address changes, VPN reconnection and applications that cannot tolerate a WAN switch.
- Test disconnect, failover, critical applications, data accounting and failback before declaring the system ready.
For most sites, the balanced design is a wired primary, an independent 4G/5G gateway, a dual-WAN router and a UPS. Substitute Starlink when cellular coverage is inadequate or a satellite path better matches the site’s risk. Use a second wired provider when it is demonstrably independent and the backup must support sustained traffic for many users.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
