What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
The reliable pattern is a dual-WAN failover router with a satellite terminal on WAN1 and an independent 4G/5G modem or hotspot on WAN2. One LAN, one DHCP scope and one staff Wi-Fi network let employees keep using the same devices while the router checks each connection and moves new traffic to the surviving link.
Make satellite primary when the site has a clear sky view and the plan offers the capacity you need. Make cellular primary when local 4G/5G is cheaper, has lower latency or has proved more dependable. In either order, expect active calls, VPN tunnels and uploads to reconnect when the public IP or route changes.
As an Amazon Associate I earn from qualifying purchases.
The reference design
Put the multi-WAN router or SD-WAN appliance at the network edge. Feed the satellite terminal into WAN1 and an independently provisioned 4G/5G modem or hotspot into WAN2. Connect the office switch, wireless access points, desk phones and workstations to the router’s LAN.
- WAN1: satellite terminal, normally the higher-capacity path.
- WAN2: carrier-approved 4G/5G modem or hotspot with its own SIM and data plan.
- LAN: one DHCP scope and one staff SSID so users never choose a different network during an outage.
- Policy engine: automatic health checks, failover order, hold-down timers and optional traffic policies.
Satellite documentation describes third-party routers for failover, load balancing, link aggregation and IPsec tunnelling. Multi-WAN router documentation commonly calls the feature Link Backup. A managed design can also combine 5G and satellite for automatic failover and load balancing.
#1 Best Overall
- 【Flexible Port Configuration】1 2.5Gigabit WAN Port + 1 2.5Gigabit WAN/LAN Ports + 4 Gigabit WAN/LAN Port + 1 Gigabit SFP WAN/LAN Port + 1 USB 2.0 Port (Supports USB storage and LTE backup with LTE dongle) provide high-bandwidth aggregation connectivity.
- 【High-Performace Network Capacity】Maximum number of concurrent sessions – 500,000. Maximum number of clients – 1000+.
- 【Cloud Access】Remote Cloud access and Omada app brings centralized cloud management of the whole network from different sites—all controlled from a single interface anywhere, anytime.
- 【Highly Secure VPN】Supports up to 100× LAN-to-LAN IPsec, 66× OpenVPN, 60× L2TP, and 60× PPTP VPN connections.
- 【5 Years Warranty】Backed by our 5-years warranty and free technical support from 6am to 6pm PST Monday to Fridays
Why two access links help
The links must be genuinely independent. A cellular modem that relies on the same damaged fibre route, power cabinet or upstream provider as the primary ISP does not provide meaningful resilience. Satellite and mobile radio normally use different last-mile paths, but both still depend on electricity, equipment and an upstream service plan.
Failover protects new connections; it does not make the two links behave like one uninterrupted circuit. A video meeting, VoIP call, VPN tunnel or large upload can break when the router changes public IP addresses. Users may need to reconnect, while new web pages and new application sessions use the backup link.
Choose the primary link and the backup policy
Satellite primary, cellular standby
This order suits a site with a clear view of the sky and a satellite plan with enough capacity for the team’s normal workload. Cellular remains available for short outages, heavy rain or a satellite obstruction. It also avoids consuming mobile data during ordinary operation.
Cellular primary, satellite standby
Reverse the order when local 4G/5G is less expensive, has lower latency, or has a stronger reliability record. Satellite then supplies an independent path when a tower is congested, damaged or without power. Validate the cellular signal during the hours your team actually works; a strong signal at midday does not prove capacity during the evening peak.
Rank #2
- 【Five Gigabit Ports】1 Gigabit WAN Port plus 2 Gigabit WAN/LAN Ports plus 2 Gigabit LAN Port. Up to 3 WAN ports optimize bandwidth usage through one device.
- 【One USB WAN Port】Mobile broadband via 4G/3G modem is supported for WAN backup by connecting to the USB port. For complete list of compatible 4G/3G modems, please visit TP-Link website.
- 【Abundant Security Features】Advanced firewall policies, DoS defense, IP/MAC/URL filtering, speed test and more security functions protect your network and data.
- 【Highly Secure VPN】Supports up to 20× LAN-to-LAN IPsec, 16× OpenVPN, 16× L2TP, and 16× PPTP VPN connections.
- Security - SPI Firewall, VPN Pass through, FTP/H.323/PPTP/SIP/IPsec ALG, DoS Defence, Ping of Death and Local Management. Standards and Protocols IEEE 802.3, 802.3u, 802.3ab, IEEE 802.3x, IEEE 802.1q
Reserve cellular for critical traffic
If the mobile plan has a limited allowance, use policy routing to keep essential traffic on WAN2 while allowing non-critical synchronisation to wait for the primary link. Typical critical classes are authentication, voice signalling, help-desk access and the VPN used for administration. Define the policy by application, destination or VLAN rather than asking employees to change Wi-Fi networks.
Hardware, service and placement
1. Select the satellite service
Order a current business kit and plan that is sold at the physical service address. Business service documentation describes backup and emergency use, while the Performance hardware is intended for resilient connectivity. Availability, plan features and public-IP options vary by country and address, so confirm them before shipping equipment.
The current business page advertises up to 400+ Mbps download for the Performance Kit. That is a hardware or service capability claim, not a guaranteed speed for your team. Priority plans list a 99.9% network-availability SLA; an SLA is a plan commitment with its own terms, not a promise that every application remains connected during an outage.
2. Install the terminal with a clear sky view
Use the satellite app’s obstruction check at the intended mounting point. Fixed-site instructions reduce the physical setup to connecting power and pointing the terminal at the sky, but trees, roofs and other obstructions can interrupt service. Weather can also affect availability. A location that passes a quick visual inspection can still fail the app’s obstruction test, so check the complete view before permanently mounting the hardware.
Rank #3
- ALL-IN-ONE VPN SOLUTION FOR REMOTE WORK: Extends your corporate network to homes or remote offices, enabling access with enhanced security to resources without complex setup. Ideal for small businesses, entrepreneurs, and enterprises supporting remote or hybrid teams
- ENTERPRISE-GRADE SECURITY & ENCRYPTION: Helps protect sensitive data using IPSec, PPTP, L2TP, OpenVPN, SSL, and strong encryption (DES, 3DES, AES), reducing risk from external threats in an increasingly digital landscape
- FOLLOWS NDAA & TAA FOR ENHANCED TRUST: Made in Taiwan. Meets government and industry standards, making it well-suited for agencies and businesses under strict regulations, while providing reassurance for any organization seeking elevated data protection
- DUAL WAN FAILOVER FOR CONTINUOUS CONNECTIVITY: Automatically switches to a backup internet source if the primary goes down, minimizing disruptions to crucial tasks like video calls or file sharing. Load balancing ensures optimized bandwidth for smoother, more reliable performance
- SIMPLIFIED MANAGEMENT: Web-based and SNMP tools offer clear visibility and control, reducing complex troubleshooting and making it easier to deploy
3. Hand Ethernet to the failover router
Run the terminal’s Ethernet feed to WAN1 on the failover router. If the supplied satellite router remains in the path, enable the documented bypass mode or the equivalent handoff supported by your selected router. Bypass mode prevents two routers from independently performing NAT and DHCP, which can complicate VPNs and health checks. Confirm that the failover router receives an address and can resolve DNS before connecting staff devices.
4. Add an independent 4G/5G modem
Connect a carrier-approved modem or hotspot to WAN2. Before installation, verify SIM activation, supported radio bands, antenna connectors and whether the plan permits use in a business router. Some consumer plans restrict tethering or impose a separate hotspot allowance. Place the modem where signal quality is best, then use Ethernet or a supported USB interface to the router; do not assume a phone hotspot will remain stable for a whole office.
5. Provide continuous power
Place the terminal, failover router, modem and access points on a UPS. Size it from the actual wattage of every device and the outage duration you need; there is no universal runtime figure. Include the modem and Wi-Fi equipment in the calculation, because keeping only the satellite terminal powered does not keep employees online. Test that the UPS can start all equipment after a cold shutdown and that its alarms are visible to an administrator.
Build one LAN instead of two separate offices
Use the failover router as the only DHCP server for staff devices. Keep the same private address ranges, DNS settings and staff SSID regardless of which WAN is active. This avoids manual network changes and keeps printers, file services and internal names reachable during a WAN event.
Rank #4
- 【Flexible Port Configuration】1 Gigabit SFP WAN Port + 1 Gigabit WAN Port + 2 Gigabit WAN/LAN Ports plus1 Gigabit LAN Port. Up to four WAN ports optimize bandwidth usage through one device.
- 【Increased Network Capacity】Maximum number of associated client devices – 150,000. Maximum number of clients – Up to 700.
- 【Integrated into Omada SDN】Omada’s Software Defined Networking (SDN) platform integrates network devices including gateways, access points & switches with multiple control options offered – Omada Hardware controller, Omada Software Controller or Omada cloud-based controller(Contact TP-Link for Cloud-Based Controller Plan Details). Standalone mode also applies.
- 【Cloud Access】Remote Cloud access and Omada app brings centralized cloud management of the whole network from different sites—all controlled from a single interface anywhere, anytime.
- 【SDN Compatibility】For SDN usage, make sure your devices/controllers are either equipped with or can be upgraded to SDN version. SDN controllers work only with SDN Gateways, Access Points & Switches. Non-SDN controllers work only with non-SDN APs. For devices that are compatible with SDN firmware, please visit TP-Link website.
- Use WPA2 or WPA3 with a unique staff passphrase.
- Create a separate guest VLAN and guest SSID with Internet-only access.
- Keep management interfaces on an administrator VLAN, not on the guest or staff network.
- Give phones, workstations and access points fixed reservations where monitoring or quality-of-service rules require predictable addresses.
Do not connect the satellite router and the cellular hotspot as two independent Wi-Fi networks for staff. Users will cling to a failed access point, local addressing will differ, and internal services may appear to disappear. The router should make the WAN decision invisibly.
Configure automatic failover
Names and menu locations differ by router, but the required controls are consistent: WAN priority, link health tests, a delay before declaring failure, a return-to-primary rule and visibility into usage.
- Define WAN priority. Set satellite as primary and cellular as standby, or reverse the order based on your measured cost, latency and reliability. Do not enable load balancing until basic failover works.
- Set health checks beyond the local gateway. Test DNS resolution and an external HTTPS endpoint as well as the modem or terminal’s local address. A powered-up modem can still have no upstream Internet.
- Choose failure thresholds. Require several failed probes or a short hold-down period before switching. This prevents a momentary packet loss event from causing repeated WAN flaps.
- Choose session behavior. Basic failover normally moves new sessions only. If the appliance supports session persistence or bonding, understand its limits: a public-IP change can still force an application to renegotiate.
- Configure return-to-primary. Decide whether traffic returns immediately when satellite recovers or waits for a stable interval. A delayed return prevents a second interruption while the link is still unstable.
- Apply policy routing if needed. Keep critical applications on the available link and restrict bulk transfers when cellular data is expensive or capped.
- Enable alerts and accounting. Send notifications for WAN changes, prolonged packet loss and cellular consumption. Record which link carried traffic and retain the carrier portal credentials offline.
What employees will experience
New browser sessions, chat connections and newly started calls should use the surviving WAN after the health-check threshold expires. Existing calls, VPN tunnels, uploads and some long-lived TCP sessions can stop and require a reconnect. Explain this behavior before an outage so staff do not repeatedly reboot equipment or change Wi-Fi networks.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Plan for cellular limits and satellite variability
Cellular capacity and cost controls
Mobile performance depends on tower coverage, congestion, supported bands, antenna placement and the plan’s allowance. Monitor the carrier portal for gigabytes consumed during every failover drill. A policy that leaves cloud backup or operating-system updates unrestricted can exhaust the allowance before the primary link returns.
Best Value
- Easier-Than-Ever Setup — Convenient and easy router management via web browser or the ASUS ExpertWiFi mobile app through Bluetooth setup.
- VLAN for Added Security —Each of the Ethernet ports can be assigned to one or more VLAN IDs that provides additional security for your business.
- Up to 3 WAN Ethernet Ports – 1 gigabit WAN port and 2 gigabit WAN/LAN ports with load balancing optimize multi-line broadband usage.
- Backup WAN for Stable Connectivity –The USB port can be used as a backup WAN by connecting it to a mobile phone with hotspot to maintain a reliable internet connection.
- Commercial-Grade Network Security and VPN — Secure public WiFi connections with Safe Browsing and VPN features. Enjoy a free-subscription ASUS AiProtection Pro, including robust intrusion prevention system (IPS) features like deep packet inspection (DPI) and virtual patching to block malicious traffic.
Some satellite business plans also enforce data tiers. The current business information states that, after Global Priority data is exhausted, service can be reduced to up to 1 Mbps download and 0.5 Mbps upload. Those are plan figures under the stated condition, not a prediction of the speed your team will obtain. Set alerts before the threshold and identify which applications can be paused.
Satellite visibility and weather
Obstructions produce recurring outages as satellites move across the sky; weather can add shorter disruptions. Keep the terminal’s obstruction report, mounting details and a photo of the cable route in the runbook. If service degrades, compare the app’s obstruction and status information with router health-check logs before replacing other equipment.
Public addresses and VPNs
Business plans document support for VPNs, public-IP configurations and IPv6. Confirm the exact address behavior of your plan and cellular carrier before designing inbound services. For private applications, prefer a site-to-site or client VPN initiated from the office. If the WAN changes public IP, the tunnel may renegotiate; design remote administration around that event rather than exposing router management to the Internet.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Security and administration baseline
- Change every default administrator username and password; use a unique, long credential stored in your approved password manager.
- Install current firmware on the failover router, satellite equipment, modem and access points. Schedule updates and record the resulting WAN behavior.
- Disable remote management from both WANs unless a documented VPN path requires it. Permit administration only from the admin VLAN.
- Use WPA3 where all clients support it, otherwise WPA2 with a strong passphrase. Rotate credentials when a contractor leaves.
- Separate guest devices with a VLAN and firewall policy that blocks access to staff, voice and management networks.
- Log WAN changes, health-check failures, data consumption, firmware versions and UPS alarms. Keep carrier and satellite support contacts on paper or in an offline file.
Test the design before a real outage
Run a controlled exercise with staff present. The goal is not merely to see a dashboard turn green; it is to measure what applications do and how quickly people recover.
- Record the normal WAN, public IP, DNS status, latency observations and cellular data balance.
- Start a video call, a chat session, a file transfer and a VPN login from separate test devices.
- Disconnect WAN1 at the router or use its administrative disable control. Do not power-cycle random equipment.
- Measure the time until the router declares failure, new sessions work on cellular and alerts arrive.
- Check that the call and VPN behavior matches your documented expectation, and note which applications need a manual reconnect.
- Verify cellular usage in the carrier portal and confirm that policy routing protected any reserved traffic.
- Restore WAN1, wait for the configured stability interval and confirm the return policy without causing a second flap.
- Repeat after a firmware update, SIM replacement, carrier-plan change or satellite-plan change.
Record switch time, packet loss, application impact, alert delivery and data consumed. Keep the results with the network diagram so a new administrator can distinguish a WAN failure from a local switch, access-point or power problem.
Satellite and cellular options compared
| Decision factor | Satellite WAN | 4G/5G WAN |
|---|---|---|
| Independent path | Radio link through the satellite network; independent of a local wired ISP route | Mobile-radio path; independence depends on the carrier, tower power and upstream network |
| Site requirement | Terminal needs the unobstructed sky view reported by its app | Usable carrier coverage, supported bands and suitable antenna placement |
| Capacity evidence | Performance Kit business page lists up to 400+ Mbps download | Varies with signal, spectrum, tower load, modem and plan |
| Data policy | Priority tiers can apply; after Global Priority data is exhausted, the stated figure is up to 1 Mbps down and 0.5 Mbps up | Plan allowance, hotspot rules and overage or throttling terms control usage |
| Latency and jitter | Can be affected by obstructions and weather; real-time calls are sensitive to packet loss and route changes | Can offer lower latency locally, but congestion and radio conditions vary |
| Public IP and VPN | Business plans document VPN, public-IP and IPv6 support; verify the selected plan | Carrier NAT or changing addresses can affect inbound access and tunnel persistence |
| Power continuity | Terminal, router and access points all require UPS capacity | Modem, router and access points require UPS capacity; a nearby tower may also lose power |
| Best failover role | Primary where sky visibility and capacity are strong, or standby for tower outages | Standby where data is affordable, or primary where local coverage is dependable |
Troubleshoot by symptom
The router never switches to cellular
- Check that WAN2 is administratively enabled and the SIM is active.
- Test the modem itself by connecting a controlled test device, then verify the modem’s Ethernet or USB handoff.
- Review health-check targets; a blocked DNS or HTTPS probe can create a false failure.
- Confirm the failover rule is not limited to a particular VLAN or application.
Users still have no Internet after failover
- Check that WAN2 received an address, DNS servers and a default route.
- Confirm policy routing did not send all traffic to the failed WAN.
- Renew a test client’s DHCP lease only after verifying the router LAN is healthy; users should not need to change SSIDs.
- Inspect cellular allowance, tower status and signal quality before changing satellite settings.
Calls drop every few minutes
- Increase the health-check hold-down period if the router is flapping between WANs.
- Compare logs with obstruction and weather information from the satellite terminal.
- Check UPS load and battery alarms; a brief voltage sag can reboot the modem or terminal.
- Accept that a public-IP change can terminate an existing call or VPN, and provide a reconnect procedure.
Cellular data is consumed too quickly
- Identify backup windows in the router’s traffic accounting.
- Throttle or pause cloud synchronisation, video streaming and software updates on WAN2.
- Use application or destination policies to reserve cellular for voice, authentication and essential remote access.
- Set alerts below the plan limit and document who can approve temporary unrestricted use.
Operational runbook
Keep a one-page diagram showing the terminal, router WAN ports, modem, switch, access points, VLANs and UPS outlets. Add the service address, plan names, SIM identifier, support contacts, firmware versions, health-check targets and the last successful failover date. During an incident, follow this order:
- Check UPS status and whether the router is powered.
- Look at WAN health and public-IP status in the router dashboard.
- Check satellite obstruction or service status and the cellular modem’s signal and registration.
- Confirm which WAN is carrying traffic and whether the carrier allowance is safe.
- Tell staff which applications may need a reconnect; do not ask them to join a second SSID.
- Escalate with timestamps, health-check results and equipment logs rather than a generic “the Internet is down” report.
A dual-WAN design succeeds when the router, not the employee, makes the path decision. Keep both links independently powered, test controlled outages after every material change and treat session reconnection, data limits and sky visibility as normal engineering constraints rather than surprises.
Free tools Windows power users keep installed
One-click scans. No signup required.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
