The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →To make internet access switch automatically when your main ISP fails, use a router or firewall with two WAN interfaces. Connect the wired ISP to WAN1 and a 5G/LTE modem-router to WAN2, select Failover or Link Backup mode, and configure health checks that test an external IP address or DNS service. The router then sends new connections over cellular when the primary path is unavailable. Existing TCP, VPN and other stateful sessions may still need to reconnect because the public IP address changes.
What automatic dual-WAN failover does
Dual-WAN failover gives one network gateway two internet paths. WAN1 is normally preferred; WAN2 remains ready but carries little or no traffic until WAN1 fails. The gateway periodically tests connectivity and changes its routing decision when the configured failure threshold is reached. When WAN1 recovers, the gateway can either move new sessions back automatically or leave traffic on WAN2 until you intervene.
As an Amazon Associate I earn from qualifying purchases.
This is different from load balancing. Load balancing uses both links at the same time, which can consume cellular data during normal operation and does not preserve a single public address. Failover-only mode keeps the backup path idle except for health checks and outage traffic, making it the appropriate choice when the requirement is continuity rather than extra aggregate bandwidth.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
TP-Link describes its Link Backup behavior as switching “all the new sessions” from a dropped line to another line. ASUS similarly describes switching to a backup network when the current WAN connection fails. In both cases, the documented promise concerns new sessions; it is not a guarantee that every existing connection survives the transition.
#1 Best Overall
- 【Flexible Port Configuration】1 2.5Gigabit WAN Port + 1 2.5Gigabit WAN/LAN Ports + 4 Gigabit WAN/LAN Port + 1 Gigabit SFP WAN/LAN Port + 1 USB 2.0 Port (Supports USB storage and LTE backup with LTE dongle) provide high-bandwidth aggregation connectivity.
- 【High-Performace Network Capacity】Maximum number of concurrent sessions – 500,000. Maximum number of clients – 1000+.
- 【Cloud Access】Remote Cloud access and Omada app brings centralized cloud management of the whole network from different sites—all controlled from a single interface anywhere, anytime.
- 【Highly Secure VPN】Supports up to 100× LAN-to-LAN IPsec, 66× OpenVPN, 60× L2TP, and 60× PPTP VPN connections.
- 【5 Years Warranty】Backed by our 5-years warranty and free technical support from 6am to 6pm PST Monday to Fridays
Build an independent backup path
Use a genuinely different access network
A backup that shares the same cable, fiber, pole, building entry or upstream provider can fail at the same time as the primary. For meaningful resilience, use a cellular carrier for WAN2 when WAN1 is a fixed-line ISP. A second wired circuit can also work, but only if its physical route and upstream network are genuinely independent.
- Primary path: cable, fiber, DSL or fixed wireless service connected to WAN1.
- Backup path: 5G or LTE service from a modem-router with an Ethernet port.
- Gateway: a firewall or router that supports two WANs and automatic failover.
- Power: place the gateway, 5G device and any required modem on a UPS if short power interruptions are part of the risk you are addressing.
Choose a 5G device with an Ethernet handoff
The cellular unit must present internet service to the failover gateway over Ethernet. Bridge mode or IP-passthrough mode is preferable because it avoids an extra layer of routing. If the cellular device cannot bridge, leave it in router mode and configure the failover gateway’s WAN2 for DHCP. Zyxel’s FWA515 example documents this type of secondary-WAN arrangement.
Check the cellular plan before relying on it. Confirm coverage at the installation location, expected indoor signal, data allowance, throttling or deprioritization rules, roaming restrictions, and whether the carrier uses carrier-grade NAT (CGNAT). A plan can be excellent for emergency web access yet unsuitable for hosting a public server or accepting inbound VPN connections.
Confirm that your gateway supports the controls you need
| Capability | Why it matters | What to verify |
|---|---|---|
| Two routed WAN interfaces | Provides separate primary and backup paths. | Both ports can operate as WANs, not merely LAN switch ports. |
| Failover or Link Backup mode | Keeps WAN2 idle until WAN1 is unavailable. | The interface offers primary/backup selection rather than only load balancing. |
| External health checks | Detects an upstream outage even when the local modem still answers. | Ping and/or DNS checks can target public destinations. |
| Retry and failure thresholds | Prevents a brief packet loss from causing unnecessary switching. | Interval, retry count and consecutive-failure values are configurable. |
| Failback control | Determines whether service returns to WAN1 automatically. | Automatic and manual recovery options are available. |
| Policy routing | Lets selected devices or services use a particular WAN. | Rules can be tied to source device, destination or service. |
| IPv6 support | Prevents IPv6-only applications from failing during an IPv4-only switchover. | Both WANs can provide IPv6, or IPv6 can be disabled deliberately. |
| Remote management | Allows you to inspect status when the primary site is unattended. | Management remains secure and reachable over the surviving path. |
TP-Link documents Link Backup on models including the TL-ER6120. RouterOS can implement recursive-route failover for advanced configurations. Product names, firmware menus and available features vary by model and software version, so verify the current documentation for your exact gateway.
Rank #2
- 【Five Gigabit Ports】1 Gigabit WAN Port plus 2 Gigabit WAN/LAN Ports plus 2 Gigabit LAN Port. Up to 3 WAN ports optimize bandwidth usage through one device.
- 【One USB WAN Port】Mobile broadband via 4G/3G modem is supported for WAN backup by connecting to the USB port. For complete list of compatible 4G/3G modems, please visit TP-Link website.
- 【Abundant Security Features】Advanced firewall policies, DoS defense, IP/MAC/URL filtering, speed test and more security functions protect your network and data.
- 【Highly Secure VPN】Supports up to 20× LAN-to-LAN IPsec, 16× OpenVPN, 16× L2TP, and 16× PPTP VPN connections.
- Security - SPI Firewall, VPN Pass through, FTP/H.323/PPTP/SIP/IPsec ALG, DoS Defence, Ping of Death and Local Management. Standards and Protocols IEEE 802.3, 802.3u, 802.3ab, IEEE 802.3x, IEEE 802.1q
Set up automatic failover step by step
1. Record the existing network and back up configuration
- Log in to the current router or firewall and record the LAN subnet, DHCP range, DNS settings, VLANs, port forwards, VPN definitions and IPv6 settings.
- Export a configuration backup before changing WAN assignments. Keep a local copy that is available even if internet access is lost.
- Update the gateway and 5G device firmware during a maintenance window, then note the firmware versions. Menu labels and behavior can change between releases.
2. Connect WAN1 and WAN2
- Connect the fixed-line ISP modem or optical terminal to the gateway’s WAN1 port.
- On the 5G device, enable bridge or IP-passthrough mode if supported. Reboot it after changing that mode.
- Connect the 5G Ethernet port to WAN2. If the cellular device remains in router mode, set WAN2 to obtain an address automatically by DHCP.
- Check that each WAN receives an address, default gateway and DNS information. Do not assume that a link light means that internet routing works.
3. Select failover rather than load balancing
- Open the gateway’s Internet, WAN, Multi-WAN or Link Backup page.
- Assign the fixed-line interface as Primary and the cellular interface as Backup.
- Choose Failover, Link Backup or the equivalent option. Do not select load balancing if cellular data should remain unused during normal operation.
- Save and apply the configuration. Confirm in the status page that WAN1 is active and WAN2 is standby.
4. Configure meaningful health checks
A local gateway check can pass while the ISP has lost upstream connectivity. Configure checks that leave your network: a stable public IP address, a DNS lookup service, or both. Where the software permits multiple targets, use independent destinations so that a single remote outage does not trigger a false failover.
- Enable ping checks to an external address and/or DNS lookup checks.
- Set a reasonable probe interval, retry count and consecutive-failure threshold.
- Require recovery checks before declaring WAN1 healthy again; one successful packet should not immediately cause failback after a flapping event.
- Apply the settings and watch the event log for successful probes on both interfaces.
Vendor defaults are not universal. One ASUS configuration example checks every five seconds and fails over after 12 consecutive failures. That example would allow roughly one minute of failed probes before switching, but the actual result depends on timing and the product’s implementation. Treat it as a product-specific example, not a reliability statistic or recommended value for every network.
5. Decide how failback should work
Automatic failback returns new connections to WAN1 as soon as its health checks pass. It is convenient after a short outage but can interrupt sessions again if the fixed line is unstable. Manual failback keeps the network on WAN2 until you verify that WAN1 is stable. Choose automatic recovery only when a brief second transition is acceptable, and use a recovery delay or hold-down timer when the gateway provides one.
6. Preserve policy and security settings on both paths
Review firewall rules, outbound NAT, DNS enforcement, VPN routing and content policies for WAN2. Some gateways create NAT automatically for the backup interface; others require a separate rule. Ensure that the backup path is not treated as an untrusted exception, and confirm that management access is restricted to the same administrators and networks as on WAN1.
Rank #3
- High performance hardware with one 10G/Multi-Gig configurable LAN/WAN port, one 2.5G WAN port, three 2.5G LAN ports and one 10G SFP+ port for long-distance backhaul
- Dual WAN Ports with failover and load balancing for reliable, seamless connectivity. Optimize network performance and security with up to 32 VLANs
- Secure remote network access via IPSec Site-to-Site and Client-to-Site VPN, Open VPN and WireGuard, with up to 100 client device connections and 30 VPN tunnels
- Integrates with NETGEAR Pro WiFi Access Points and select Smart switches as part of NETGEAR’s Enterprise Network Solution, designed for easy SME management
- NETGEAR Insight for remote network management anytime, from anywhere. Includes 1-year subscription
Test failover and recovery safely
Testing while everything is healthy is the only way to know whether the design works before an outage. Schedule the first test when someone can restore the cable and when cellular data usage is acceptable.
- Start a continuous ping to an external destination from a test computer, and open a status page that shows the active WAN.
- Run a normal web session, a DNS lookup, and any business-critical application used by your household or office.
- Physically disconnect the WAN1 Ethernet cable or disable the primary service upstream. Do not merely unplug the gateway’s power, because that tests a different failure.
- Watch the event log and status page. Confirm that WAN1 is marked failed and WAN2 becomes active after the configured threshold.
- Open a new browser session and verify its public egress address and path. New traffic should leave through the cellular connection.
- Test DNS, IPv4 and IPv6 behavior separately. An IPv6 address may remain advertised even when the backup does not provide equivalent IPv6 service.
- Test site-to-site VPNs, remote-access VPNs, VoIP calls, video meetings, policy-routed devices, cloud synchronization and any inbound service that matters.
- Reconnect WAN1 and wait for the health checks. Verify whether the gateway fails back automatically or remains on WAN2, according to your chosen setting.
- Record detection time, recovery time, data consumed and which sessions had to be restarted. Keep these observations with the network diagram.
Repeat the test with the 5G device unavailable if you need to understand the single-failure boundary. A dual-WAN design protects against loss of one access path; it does not make the gateway, power supply, DNS policy or local network redundant.
What users will notice during an outage
Public address changes
WAN1 and WAN2 normally have different public addresses. A connection that moves to cellular therefore appears to come from a new address. TCP sessions, many VPN tunnels, long-lived database connections and some video calls can break and must reconnect. Failover is primarily a mechanism for moving new sessions, not for preserving the identity of an existing flow.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Inbound access may stop
Port forwards and allowlists built around the primary address do not automatically work on the backup. Cellular providers commonly place subscribers behind CGNAT, which prevents unsolicited inbound IPv4 connections. Dynamic DNS can update a name, but it cannot bypass CGNAT. If inbound access is essential, verify that the carrier offers a reachable public address or use an outbound tunnel designed for that purpose.
Rank #4
- ALL-IN-ONE VPN SOLUTION FOR REMOTE WORK: Extends your corporate network to homes or remote offices, enabling access with enhanced security to resources without complex setup. Ideal for small businesses, entrepreneurs, and enterprises supporting remote or hybrid teams
- ENTERPRISE-GRADE SECURITY & ENCRYPTION: Helps protect sensitive data using IPSec, PPTP, L2TP, OpenVPN, SSL, and strong encryption (DES, 3DES, AES), reducing risk from external threats in an increasingly digital landscape
- FOLLOWS NDAA & TAA FOR ENHANCED TRUST: Made in Taiwan. Meets government and industry standards, making it well-suited for agencies and businesses under strict regulations, while providing reassurance for any organization seeking elevated data protection
- DUAL WAN FAILOVER FOR CONTINUOUS CONNECTIVITY: Automatically switches to a backup internet source if the primary goes down, minimizing disruptions to crucial tasks like video calls or file sharing. Load balancing ensures optimized bandwidth for smoother, more reliable performance
- SIMPLIFIED MANAGEMENT: Web-based and SNMP tools offer clear visibility and control, reducing complex troubleshooting and making it easier to deploy
Geolocation, allowlists and IPv6 can differ
Websites may geolocate the cellular address differently from the fixed-line address. Corporate services that allowlist WAN1 may reject WAN2. IPv6 prefixes can change or disappear during failover, causing applications that prefer IPv6 to behave differently from IPv4 clients. Test these conditions instead of assuming that a successful speed test proves full service equivalence.
Voice and real-time applications are sensitive
VoIP, video meetings and gaming can notice both the interruption and the new route. A health-check threshold that is too aggressive can create repeated switches during ordinary packet loss; one that is too slow extends the outage. Tune thresholds using the behavior observed in your environment, not a generic number.
Failover-only versus load balancing
| Decision | Failover-only | Load balancing |
|---|---|---|
| Normal WAN2 use | Mostly idle except health checks. | Carries selected traffic continuously. |
| Cellular data consumption | Usually limited to probes and outage traffic. | Can consume the allowance every day. |
| Primary goal | Continuity when WAN1 fails. | Use both links for capacity or distribution. |
| Public addresses | New sessions move to a different address during failover. | Different sessions may use different addresses at the same time. |
| Configuration complexity | Lower; one preferred route and one backup. | Higher; requires balancing rules and application testing. |
| Best fit | Home offices, small businesses and sites with metered backup. | Sites that accept complexity and have sufficient allowances on both links. |
Zyxel distinguishes a primary-plus-backup arrangement from load balancing, while Ubiquiti documents cellular devices used either as a primary connection or as a LAN-connected backup WAN. The exact topology depends on the gateway and cellular hardware, so confirm whether the device can terminate the backup directly or must connect through an Ethernet handoff.
Common failure modes and fixes
The router never fails over
- Check that WAN2 has a valid DHCP lease, gateway and DNS server.
- Confirm that the mode is Failover or Link Backup, not a disabled or standby-only profile.
- Review health-check targets and logs. A check aimed only at the local modem can report success during an ISP outage.
- Verify that the failure count is being reached; a long retry threshold can look like a failure of the feature when it is simply waiting.
The router fails over during brief glitches
- Use multiple external targets where supported.
- Increase consecutive failures or add a recovery hold-down period.
- Inspect cabling, modem power and signal quality before weakening the detection criteria.
WAN2 is active but websites do not open
- Test DNS separately from ping. A working IP route with a broken DNS configuration produces an apparent internet outage.
- Check outbound NAT and firewall rules for the backup interface.
- Look for an MTU mismatch, especially when the 5G device is double-NATed or uses a tunnel.
- Confirm that the cellular plan has not exhausted its allowance or entered a restricted state.
VPN or remote access breaks
Expect a new public address and rebuild stateful tunnels after failover. For inbound VPN, determine whether CGNAT blocks the cellular path. For outbound site-to-site VPN, configure both WAN endpoints or use a design that can re-establish through either address.
Best Value
- 【Flexible Port Configuration】1 Gigabit SFP WAN Port + 1 Gigabit WAN Port + 2 Gigabit WAN/LAN Ports plus1 Gigabit LAN Port. Up to four WAN ports optimize bandwidth usage through one device.
- 【Increased Network Capacity】Maximum number of associated client devices – 150,000. Maximum number of clients – Up to 700.
- 【Integrated into Omada SDN】Omada’s Software Defined Networking (SDN) platform integrates network devices including gateways, access points & switches with multiple control options offered – Omada Hardware controller, Omada Software Controller or Omada cloud-based controller(Contact TP-Link for Cloud-Based Controller Plan Details). Standalone mode also applies.
- 【Cloud Access】Remote Cloud access and Omada app brings centralized cloud management of the whole network from different sites—all controlled from a single interface anywhere, anytime.
- 【SDN Compatibility】For SDN usage, make sure your devices/controllers are either equipped with or can be upgraded to SDN version. SDN controllers work only with SDN Gateways, Access Points & Switches. Non-SDN controllers work only with non-SDN APs. For devices that are compatible with SDN firmware, please visit TP-Link website.
Failback causes repeated interruptions
Disable automatic failback or increase the recovery delay while you diagnose WAN1 stability. Check whether the fixed ISP is oscillating between reachable and unreachable states; repeated transitions are a symptom of an unstable primary path, not a reason to lower every health-check threshold.
Operational checks for a dependable backup
- Check the 5G signal, carrier registration and data balance monthly, not only after an outage.
- Keep the cellular device in a location with reliable signal and ventilation; a strong link at installation does not guarantee performance during congestion.
- Review logs for failed probes, unexpected failovers and repeated failbacks.
- Test a deliberate WAN1 disconnect at least twice a year and after major firmware or topology changes.
- Document which applications are expected to reconnect and which inbound services are unavailable on cellular.
- Restrict administrative interfaces, change default credentials and apply firmware updates to both gateways.
- Measure standby cost as the recurring cellular plan, hardware, power and any public-address or tunnel service required for your use case.
Official setup documentation does not establish a universal uptime percentage or failover success rate. The meaningful reliability evidence for your site is the detection and recovery behavior you observe in controlled tests, together with the carrier’s coverage and plan terms.
A practical decision checklist
| Question | Acceptable answer before deployment |
|---|---|
| Are the access paths independent? | WAN2 uses a different carrier or physically separate service. |
| Can the cellular device hand off Ethernet? | Bridge/IP-passthrough is available, or DHCP WAN2 is supported. |
| Is the gateway capable of automatic failover? | Failover/Link Backup, external probes and configurable thresholds are present. |
| Can the plan support outage traffic? | Coverage, allowance, speed policy and CGNAT behavior are understood. |
| Have critical applications been tested? | DNS, VPN, VoIP, IPv6, inbound access and policy-routed devices have known behavior. |
| Is recovery intentional? | Automatic or manual failback is selected with an acceptable interruption policy. |
With those conditions met, the implementation is straightforward: fixed ISP on WAN1, 5G Ethernet handoff on WAN2, external health checks, deliberate failback and a documented disconnect test. The design keeps ordinary traffic on the preferred link while providing a separate route for new sessions when the primary ISP is genuinely unavailable.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallQuick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
