iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
For most homes and small businesses, the best backup internet is an independent 4G or 5G connection connected to a dual-WAN router. The router monitors your normal wired service, moves traffic to cellular when health checks fail, and switches back after the primary path is stable. Put the modem, router, cellular gateway and other networking equipment on a UPS so a short power cut does not interrupt the failover system itself.
Use a phone hotspot only as a manual, short-outage fallback for a few devices. Consider Starlink when cellular coverage is poor or you need a physically separate path from cable, fiber or DSL. A second wired ISP can work well for offices with many devices, but only if its last-mile and upstream networks are genuinely independent of the first provider.
What “backup internet” must protect you from
A backup connection is useful only when it survives the failure that took down the primary service. If two subscriptions use the same local fiber, pole, duct, backhaul or regional network, one construction cut or provider outage can disable both. Different access technologies and different physical routes generally provide stronger resilience than simply buying a second plan from a familiar provider.
Also separate an internet outage from a Wi-Fi outage. If devices cannot see your wireless network but the modem still has service, the fix may be a router reboot, access-point repair or replacement—not a second ISP. A backup internet design addresses loss of the upstream connection, while local Wi-Fi coverage and internal network equipment still need their own reliability plan.
#1 Best Overall
- 【Flexible Port Configuration】1 2.5Gigabit WAN Port + 1 2.5Gigabit WAN/LAN Ports + 4 Gigabit WAN/LAN Port + 1 Gigabit SFP WAN/LAN Port + 1 USB 2.0 Port (Supports USB storage and LTE backup with LTE dongle) provide high-bandwidth aggregation connectivity.
- 【High-Performace Network Capacity】Maximum number of concurrent sessions – 500,000. Maximum number of clients – 1000+.
- 【Cloud Access】Remote Cloud access and Omada app brings centralized cloud management of the whole network from different sites—all controlled from a single interface anywhere, anytime.
- 【Highly Secure VPN】Supports up to 100× LAN-to-LAN IPsec, 66× OpenVPN, 60× L2TP, and 60× PPTP VPN connections.
- 【5 Years Warranty】Backed by our 5-years warranty and free technical support from 6am to 6pm PST Monday to Fridays
Best options compared
| Option | Independence from primary failure | Coverage or installation requirement | Failover method | Data, cost and capacity considerations | Best fit |
|---|---|---|---|---|---|
| Dedicated 4G/5G hotspot or gateway | High when the mobile network and wired ISP use different infrastructure; reduced if a local disaster affects both | Usable cellular signal at the site; gateway placement may affect signal quality | Automatic through a dual-WAN router, or manual when connected directly | Carrier data caps and overage rules can make sustained use expensive; suitable for homes and small offices when signal is strong | Urban and suburban sites with reliable mobile coverage |
| Dual-WAN router | Depends on the two WAN services attached to it; it is the control point rather than an internet service itself | Requires two compatible uplinks and correct health-check configuration | Automatic failover and failback; can also load-balance when desired | Hardware cost and configuration effort; supports many users and policy controls | Whole-home or office continuity |
| Starlink satellite | Strong physical separation from terrestrial cable, fiber or DSL; regional conditions still affect service | Unobstructed sky view, terminal installation, outdoor exposure planning and power | Automatic with a compatible multi-WAN gateway, or manual if connected separately | Service-plan terms and equipment requirements apply; weather and regional capacity can affect performance | Rural or low-cell-signal locations, or sites needing a separate terrestrial path |
| Secondary wired ISP | High only when the provider uses a different last-mile and upstream network; shared poles, ducts or backhaul reduce independence | Address-specific availability and a second physical installation | Automatic through dual-WAN or SD-WAN equipment | Usually handles many devices better than a capped hotspot; requires a second recurring subscription | Businesses with high device counts and two truly separate providers |
| Phone hotspot | Independent of a wired ISP if it uses cellular service, but vulnerable to handset battery, signal and carrier tethering limits | Mobile coverage and a phone with an allowed tethering plan | Usually manual; a person connects devices or moves the cable | Limited battery, throughput and connected-device count; data policy varies | A few users during a short outage |
Option 1: 4G or 5G gateway for the simplest automatic backup
A dedicated cellular gateway or hotspot is the practical default where mobile coverage is dependable. It can provide a second WAN without another cable entering the building. For more than a few devices, use the cellular unit as the secondary uplink to a dual-WAN router instead of asking the hotspot to manage the entire office network.
Two ways to connect cellular service
- LAN-connected backup: The cellular device remains a small router and connects by Ethernet to the main gateway. This is useful when the device exposes a local network interface or when you want to preserve its carrier-specific functions.
- Standard WAN connection: The cellular device presents an Ethernet uplink that the multi-WAN router treats like any other internet service. The router can then fail over to it or include it in load balancing.
Documentation for Ubiquiti equipment describes both LAN-connected backup and standard WAN use. Exact menus and supported models vary, so verify that the chosen gateway and router support the same connection mode before purchasing.
Control cellular data before an outage
Set a monthly or cycle-based data limit in the gateway or router. Some LTE backup devices can purchase additional data automatically when the allowance is exhausted. Disable automatic top-ups unless you have deliberately accepted that risk, and create alerts at conservative thresholds. Estimate how much video conferencing, cloud synchronization and software updating your users can generate during a prolonged outage; a backup that silently burns through its allowance is not dependable.
When a phone hotspot is enough
A phone hotspot is reasonable for one or two people who need email, messaging or a brief work session. It is normally a manual recovery method, not a whole-building failover system. Battery drain, handset placement, tethering limits and the number of supported clients all become constraints. Keep a charging cable or power bank available, and do not assume that a phone plan permits continuous tethering.
Rank #2
- 【Five Gigabit Ports】1 Gigabit WAN Port plus 2 Gigabit WAN/LAN Ports plus 2 Gigabit LAN Port. Up to 3 WAN ports optimize bandwidth usage through one device.
- 【One USB WAN Port】Mobile broadband via 4G/3G modem is supported for WAN backup by connecting to the USB port. For complete list of compatible 4G/3G modems, please visit TP-Link website.
- 【Abundant Security Features】Advanced firewall policies, DoS defense, IP/MAC/URL filtering, speed test and more security functions protect your network and data.
- 【Highly Secure VPN】Supports up to 20× LAN-to-LAN IPsec, 16× OpenVPN, 16× L2TP, and 16× PPTP VPN connections.
- Security - SPI Firewall, VPN Pass through, FTP/H.323/PPTP/SIP/IPsec ALG, DoS Defence, Ping of Death and Local Management. Standards and Protocols IEEE 802.3, 802.3u, 802.3ab, IEEE 802.3x, IEEE 802.1q
Option 2: A dual-WAN router that switches automatically
The dual-WAN router is the decision-making point for a home or office network. One WAN connects to the normal modem or optical network terminal; the second connects to cellular, satellite or another ISP. The router sends periodic health checks to determine whether the primary path really reaches the internet, rather than merely reporting that its Ethernet link is still plugged in.
What happens during failover
- The router probes configured destinations or services through the primary WAN.
- If the required checks fail for the configured interval, it marks that WAN unhealthy.
- New sessions use the secondary WAN. Existing sessions may need to reconnect because their public IP address changes.
- When the primary passes health checks consistently, the router performs failback according to its recovery policy.
Choose sensible detection and recovery intervals. Checks that are too aggressive can switch to cellular during a brief packet-loss event; checks that are too slow leave everyone waiting through a real outage. Confirm whether the router supports sticky sessions, policy-based routing and a hold-down period before failback so a flapping line does not repeatedly move traffic between providers.
Example of automatic 5G switching
NETGEAR documents a setup in which an MD200 cradle links a fixed Ethernet connection to a compatible 5G hotspot and automatically switches to the hotspot when the fixed service fails. Without the cradle, the user must move the connection manually. This illustrates an important distinction: a hotspot may provide the second service, but automatic switching requires compatible gateway hardware and configuration.
Router features worth requiring
- At least two WAN interfaces, or a documented LAN-connected cellular-backup mode.
- Configurable health checks, failover delays and automatic failback.
- Data-limit controls, usage reporting and alerting for the metered link.
- VLAN and policy controls so critical devices can be prioritized during an outage.
- VPN support compatible with your remote-access and site-to-site requirements.
- Enough throughput, DHCP capacity and wireless-access-point support for the full device count.
- Firmware maintenance and a documented recovery process if a WAN or SIM change breaks the configuration.
Option 3: Starlink as a physically separate backup
Satellite internet is most compelling when cellular coverage is weak or when a business wants a path that does not depend on local cable, fiber or DSL infrastructure. Starlink’s enterprise FAQ states: “Can I use Starlink as a back-up / failover option for my business? Yes, this is possible and many businesses currently use Starlink as secondary or tertiary backup connection.”
Starlink says it aims for 99.99% uptime, while noting that reliability can vary by region. Treat that figure as a vendor aim, not a guarantee for a particular address or day. Before relying on it, check the current service terms for the site and plan you intend to use.
Rank #3
- ALL-IN-ONE VPN SOLUTION FOR REMOTE WORK: Extends your corporate network to homes or remote offices, enabling access with enhanced security to resources without complex setup. Ideal for small businesses, entrepreneurs, and enterprises supporting remote or hybrid teams
- ENTERPRISE-GRADE SECURITY & ENCRYPTION: Helps protect sensitive data using IPSec, PPTP, L2TP, OpenVPN, SSL, and strong encryption (DES, 3DES, AES), reducing risk from external threats in an increasingly digital landscape
- FOLLOWS NDAA & TAA FOR ENHANCED TRUST: Made in Taiwan. Meets government and industry standards, making it well-suited for agencies and businesses under strict regulations, while providing reassurance for any organization seeking elevated data protection
- DUAL WAN FAILOVER FOR CONTINUOUS CONNECTIVITY: Automatically switches to a backup internet source if the primary goes down, minimizing disruptions to crucial tasks like video calls or file sharing. Load balancing ensures optimized bandwidth for smoother, more reliable performance
- SIMPLIFIED MANAGEMENT: Web-based and SNMP tools offer clear visibility and control, reducing complex troubleshooting and making it easier to deploy
Site and power requirements
- Provide the terminal with an unobstructed view of the sky; trees, buildings and other obstructions can interrupt service.
- Plan a safe mount, cable route and weather exposure strategy before installation.
- Place the terminal’s power equipment and the indoor network components on a UPS sized for the required runtime.
- Connect the Starlink router or Ethernet adapter to the secondary WAN of the failover gateway, using the supported mode for your hardware.
Satellite is not automatically better than cellular. It adds installation, sky-view and power requirements, and the plan’s current terms determine recurring cost and any usage policy. Its advantage is path diversity where terrestrial and mobile alternatives are unreliable.
Option 4: A second wired provider
A second cable, fiber or fixed-wireless subscription can be the most comfortable option for a busy office. It generally supports more simultaneous devices than a metered hotspot and avoids cellular signal variability. Availability is address-specific, however, and two brands can still share the same physical facilities.
Ask both providers whether they use the same poles, ducts, neighborhood aggregation equipment, backhaul carrier or regional exchange. Request the practical details of their last-mile route and outage dependencies rather than assuming that different company names mean different infrastructure. Attach the two services to a dual-WAN or SD-WAN gateway and test an actual provider outage, not just a cable unplug.
How to build an automatic failover system
- Define the failure you need to survive. Decide whether the priority is a provider outage, a cut cable, a local power failure, or all three. Power protection and ISP diversity solve different problems.
- Measure your site. Check 4G/5G signal where the gateway will sit, identify a Starlink location with clear sky, and verify that a second wired service is available at the exact address.
- Estimate outage traffic. List essential users and applications, then estimate video calls, cloud access, point-of-sale traffic, backups and updates. Use that estimate to choose cellular data allowances and router capacity.
- Choose independent uplinks. Prefer wired plus cellular, wired plus satellite, or two providers with documented separate routes. Avoid two services that share an obvious local path.
- Install the dual-WAN gateway. Connect the primary modem or terminal to WAN 1 and the secondary gateway to WAN 2. Update firmware before configuring policies.
- Configure health checks. Use reliable internet destinations, set failure and recovery intervals, and enable automatic failback only after the primary has remained stable for the chosen hold-down period.
- Apply data and traffic policies. Set cellular alerts and hard limits where available. During failover, prioritize voice, payment, remote-access and business-critical traffic; defer large updates and nonessential backups.
- Protect the network stack. Connect the modem, primary router, dual-WAN gateway, cellular gateway and any satellite networking equipment to a UPS. Make sure the UPS can support the expected load for the required minutes.
- Document manual recovery. Record SIM details, gateway login information, WAN port assignments, carrier support contacts and the steps to bypass automatic failover if troubleshooting requires it.
Power protection is a separate layer
A UPS keeps powered networking equipment running during a building power interruption. It does not restore a damaged cable, a failed cellular tower or an ISP outage upstream. Size it for the modem, router, access points, cellular gateway and satellite equipment that must stay online, and verify the expected runtime under the actual load.
Rank #4
- 【Flexible Port Configuration】1 Gigabit SFP WAN Port + 1 Gigabit WAN Port + 2 Gigabit WAN/LAN Ports plus1 Gigabit LAN Port. Up to four WAN ports optimize bandwidth usage through one device.
- 【Increased Network Capacity】Maximum number of associated client devices – 150,000. Maximum number of clients – Up to 700.
- 【Integrated into Omada SDN】Omada’s Software Defined Networking (SDN) platform integrates network devices including gateways, access points & switches with multiple control options offered – Omada Hardware controller, Omada Software Controller or Omada cloud-based controller(Contact TP-Link for Cloud-Based Controller Plan Details). Standalone mode also applies.
- 【Cloud Access】Remote Cloud access and Omada app brings centralized cloud management of the whole network from different sites—all controlled from a single interface anywhere, anytime.
- 【SDN Compatibility】For SDN usage, make sure your devices/controllers are either equipped with or can be upgraded to SDN version. SDN controllers work only with SDN Gateways, Access Points & Switches. Non-SDN controllers work only with non-SDN APs. For devices that are compatible with SDN firmware, please visit TP-Link website.
If the building has a generator, test the transfer behavior with the UPS. Some equipment reboots when power quality changes, so a nominally protected system can still drop connections unless the UPS and generator are compatible.
Test before you need the backup
- Record the normal public IP, DNS behavior, VPN status and critical application connections.
- Disconnect the primary WAN cable or disable the primary service at the gateway.
- Confirm that the router marks WAN 1 unhealthy and that clients receive working addresses and DNS through WAN 2.
- Test web access, remote desktop or site-to-site VPN, voice and video calls, payment systems and any cloud applications that matter to the business.
- Check the cellular or satellite gateway’s data counter and verify that alerts and limits operate as expected.
- Reconnect the primary WAN and confirm that traffic returns only after the configured stability period.
- Repeat the test after firmware updates, SIM changes, carrier-plan changes, router replacements or major network-policy edits.
Schedule periodic tests rather than waiting for a storm or construction cut. Keep a record of the date, trigger, failover time, applications tested and data consumed so configuration drift is visible.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteTroubleshooting common failures
The router never fails over
Check that the secondary WAN is enabled, has an address from the cellular or satellite gateway, and is included in the failover group. A link light only proves that Ethernet is connected; review the health-check target and failure threshold. Also verify that policy rules are not forcing all traffic to the failed primary.
Failover works but applications break
A new WAN normally changes the public IP. VPN tunnels, allowlists, inbound services and some video or voice sessions may need to reconnect. Configure supported dynamic DNS or alternate VPN behavior where required, and do not promise uninterrupted inbound services unless the design includes a mechanism for changing public addresses.
Best Value
- Easier-Than-Ever Setup — Convenient and easy router management via web browser or the ASUS ExpertWiFi mobile app through Bluetooth setup.
- VLAN for Added Security —Each of the Ethernet ports can be assigned to one or more VLAN IDs that provides additional security for your business.
- Up to 3 WAN Ethernet Ports – 1 gigabit WAN port and 2 gigabit WAN/LAN ports with load balancing optimize multi-line broadband usage.
- Backup WAN for Stable Connectivity –The USB port can be used as a backup WAN by connecting it to a mobile phone with hotspot to maintain a reliable internet connection.
- Commercial-Grade Network Security and VPN — Secure public WiFi connections with Safe Browsing and VPN features. Enjoy a free-subscription ASUS AiProtection Pro, including robust intrusion prevention system (IPS) features like deep packet inspection (DPI) and virtual patching to block malicious traffic.
Cellular data disappears quickly
Inspect usage reports for cloud backups, operating-system updates, streaming video and guest devices. Set a hard cap or disable automatic top-ups, then create a restricted outage policy that permits essential traffic only. Recheck the carrier’s tethering and hotspot terms before increasing the allowance.
Cellular speed or reliability is poor
Move the gateway to a location with better signal, use approved external antennas if the hardware supports them, and test at the times your business operates. A strong speed test at one moment does not guarantee capacity during a busy outage.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Satellite service drops intermittently
Inspect the terminal’s sky view for obstructions, confirm that weather and mounting have not shifted the installation, and verify that all equipment remains powered. Use the satellite provider’s current regional guidance when diagnosing repeated interruptions.
Both connections fail together
Investigate shared infrastructure, not just router settings. A neighborhood utility cut, regional backhaul problem, building power failure or extreme weather can affect supposedly different services. This is why route diversity, UPS coverage and a tested manual hotspot are complementary layers rather than interchangeable products.
Practical designs by site type
Home office with one or two workers
Use the existing wired ISP as primary, a 4G/5G gateway as secondary and a small dual-WAN router. A phone hotspot can serve as the emergency fallback for a short outage. Put the modem, router and cellular device on a UPS, and prioritize work calls and VPN traffic when the metered link is active.
Small office with many devices
Use a business-grade dual-WAN gateway with VLANs, usage controls and VPN support. Pair the primary wired service with a dedicated cellular gateway or a second wired provider whose route has been verified as independent. Keep guest Wi-Fi, large updates and cloud replication on a lower-priority policy during failover.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rural site with weak mobile coverage
Evaluate Starlink first for path independence and then investigate any usable fixed-wireless or wired service. Plan sky view, mounting and UPS runtime before ordering. If a small area has intermittent cellular signal, retain a phone hotspot as a manual tertiary option rather than treating it as the primary backup.
Quick Recap
What to verify before committing
- Does the secondary service use infrastructure that can survive the primary provider’s likely failure?
- Is coverage, sky view or address availability proven at the exact site?
- Can the chosen router fail over and fail back automatically, or will someone have to move a cable?
- What are the data caps, overage rules, tethering restrictions and current recurring charges?
- Will the backup support the required number of users, VPNs, voice calls and cloud applications?
- Are the modem, gateway, router and access points protected by a UPS for the required runtime?
- Has the complete system been tested recently, including data usage and failback?
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
