Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Automatic internet failover requires a router or firewall with two WAN interfaces. Connect your regular cable, fiber, or DSL service to WAN1, connect a 5G/LTE modem-router by Ethernet to WAN2, mark WAN1 as primary and WAN2 as backup, and enable health checks that test an external address or DNS service. When WAN1 fails those checks, the gateway sends new connections through cellular; when WAN1 recovers, it either returns automatically or stays on 5G, depending on your failback setting.
The backup link must use an independent access network. A second router on the same cable or fiber circuit will not help when that circuit, pole, or local provider is down. Cellular backup also changes your public IP, so existing VPN, TCP, VoIP, and other stateful sessions may need to reconnect.
What internet failover does
Dual-WAN failover is a standby arrangement rather than a way to combine two connections. The gateway monitors the preferred WAN, removes it from service after a defined number of failed checks, and installs the backup WAN as the route for new traffic. TP-Link describes Link Backup as switching “all the new sessions” from a dropped line to another line. ASUS similarly describes switching to a backup network after the current WAN fails.
Failover is different from load balancing, where traffic is distributed across both links during normal operation. Choose failover or Link Backup when the objective is to keep cellular data unused until the primary path is unavailable.
#1 Best Overall
- 【Flexible Port Configuration】1 2.5Gigabit WAN Port + 1 2.5Gigabit WAN/LAN Ports + 4 Gigabit WAN/LAN Port + 1 Gigabit SFP WAN/LAN Port + 1 USB 2.0 Port (Supports USB storage and LTE backup with LTE dongle) provide high-bandwidth aggregation connectivity.
- 【High-Performace Network Capacity】Maximum number of concurrent sessions – 500,000. Maximum number of clients – 1000+.
- 【Cloud Access】Remote Cloud access and Omada app brings centralized cloud management of the whole network from different sites—all controlled from a single interface anywhere, anytime.
- 【Highly Secure VPN】Supports up to 100× LAN-to-LAN IPsec, 66× OpenVPN, 60× L2TP, and 60× PPTP VPN connections.
- 【5 Years Warranty】Backed by our 5-years warranty and free technical support from 6am to 6pm PST Monday to Fridays
| Mode | Normal operation | What happens on failure | Best fit |
|---|---|---|---|
| Failover or Link Backup | WAN1 carries traffic; WAN2 is standby | New sessions move to WAN2 after health-check thresholds are reached | Businesses or homes that want continuity and predictable cellular usage |
| Load balancing | Both WANs carry traffic according to configured weights or rules | The failed WAN is removed and its traffic is redistributed | Extra capacity when using both services is more important than keeping cellular idle |
Failover does not merge bandwidth, preserve the same public address, or guarantee that every existing connection survives. It is a routing and session-continuity mechanism, not a second circuit that behaves identically to the first.
Plan the two paths before buying hardware
Use genuinely independent access networks
For useful resilience, WAN1 and WAN2 should reach the internet through different infrastructure. Fiber or cable as WAN1 and a cellular carrier as WAN2 is the clearest separation. Two services that share the same neighborhood fiber, cable plant, power feed, or upstream provider can fail together.
- Confirm that the cellular carrier has usable signal at the router location, not merely coverage somewhere in the town.
- Check monthly data allowances, overage pricing, throttling, and deprioritization rules. A backup link can consume its allowance quickly during a prolonged outage.
- Ask whether the carrier supplies a public IPv4 address or uses carrier-grade NAT (CGNAT). CGNAT normally prevents unsolicited inbound connections.
- Check IPv6 support if your network or hosted services use IPv6 prefixes.
- Verify that the 5G device offers an Ethernet handoff and, ideally, bridge or IP-passthrough mode.
Select a gateway with the controls you need
The router or firewall needs two physical WAN interfaces, a selectable primary and secondary link, health-check options, and a defined failback policy. TP-Link documents Link Backup on models including the TL-ER6120. RouterOS supports recursive-route failover for administrators who need route-level control. Other gateways expose similar functions under names such as Dual WAN, Link Backup, WAN Backup, or Internet Connection Failover.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Compare the following capabilities before purchase:
- WAN port speed: a 1 Gb/s backup port cannot pass a multi-gigabit primary connection at wire speed.
- Health checks that can ping an external address or perform DNS lookups, rather than checking only the local modem.
- Configurable probe interval, retry count, failure threshold, and recovery threshold.
- Automatic or manual failback.
- Policy routing for devices that must remain on a particular WAN.
- Remote management that remains reachable when the primary link is down.
- IPv4 and IPv6 failover behavior, including prefix changes.
Choose the 5G equipment arrangement
A 5G modem-router can be the secondary WAN if it provides Ethernet. Put it in bridge or IP-passthrough mode when the device supports that option; the failover gateway then receives the carrier-facing address (or the carrier’s translated address) directly. If bridge mode is unavailable, leave the 5G unit in router mode and configure the gateway’s WAN2 for DHCP, as in Zyxel’s FWA515 example. This creates a second NAT layer but still supports outbound failover.
Bridge mode avoids one layer of NAT, but it does not guarantee a public address: the carrier may still place the connection behind CGNAT. Router mode is simpler and often the only option on consumer equipment. In either arrangement, place the cellular device where signal is strongest and run Ethernet to the dual-WAN gateway rather than relying on a second wireless hop.
Rank #2
- 【Five Gigabit Ports】1 Gigabit WAN Port plus 2 Gigabit WAN/LAN Ports plus 2 Gigabit LAN Port. Up to 3 WAN ports optimize bandwidth usage through one device.
- 【One USB WAN Port】Mobile broadband via 4G/3G modem is supported for WAN backup by connecting to the USB port. For complete list of compatible 4G/3G modems, please visit TP-Link website.
- 【Abundant Security Features】Advanced firewall policies, DoS defense, IP/MAC/URL filtering, speed test and more security functions protect your network and data.
- 【Highly Secure VPN】Supports up to 20× LAN-to-LAN IPsec, 16× OpenVPN, 16× L2TP, and 16× PPTP VPN connections.
- Security - SPI Firewall, VPN Pass through, FTP/H.323/PPTP/SIP/IPsec ALG, DoS Defence, Ping of Death and Local Management. Standards and Protocols IEEE 802.3, 802.3u, 802.3ab, IEEE 802.3x, IEEE 802.1q
Recommended physical layout
Use this topology:
- ISP modem or optical network terminal to the gateway’s WAN1 port.
- 5G/LTE modem-router Ethernet port to the gateway’s WAN2 port.
- Gateway LAN port to your switch, wireless access points, phones, cameras, and other clients.
Keep the LAN subnet and DHCP service on the failover gateway. Do not connect the 5G router’s LAN to the main LAN unless you are deliberately designing a routed or policy-based topology; connect it to WAN2 instead. Record the 5G unit’s management address so you can administer it without confusing it with the main LAN.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesConfigure automatic failover step by step
1. Confirm both links independently
Before enabling automation, connect a laptop to each service separately. Verify that WAN1 reaches several public sites and that the 5G device can reach the internet over its own cellular connection. Note the cellular signal, assigned address type, DNS behavior, and any data-use meter. If either service is unstable by itself, failover will be difficult to diagnose.
2. Update and document the gateway
Install a current stable firmware release, export the existing configuration, and record the administrator credentials and management addresses. Write down which physical port is WAN1 and WAN2. A configuration backup lets you restore the known-good state if a new health-check rule or route causes an outage.
3. Configure WAN1
Open the internet or WAN settings, select the primary port, and enter the access method required by the ISP: DHCP, PPPoE, or a fixed address. Confirm that the gateway receives an address, default route, and DNS servers. Do not mark the link healthy merely because the modem has a local address; verify an actual public destination.
4. Configure WAN2
Connect the Ethernet cable from the 5G device and set WAN2 to the matching handoff. Use bridge or IP-passthrough mode on the cellular device when supported. Otherwise choose DHCP on WAN2 and accept that the 5G device will perform its own NAT. Confirm that a client behind the gateway can browse while WAN1 is temporarily disconnected or administratively disabled.
5. Select failover, not load balancing
In the gateway’s Multi-WAN, Dual WAN, or Link Backup page, assign WAN1 as primary and WAN2 as backup. Disable load balancing if standby-only behavior is the goal. Some interfaces let you assign a priority number; the lower or higher value varies by vendor, so verify the status page shows WAN1 as active and WAN2 as standby.
Rank #3
- High performance hardware with one 10G/Multi-Gig configurable LAN/WAN port, one 2.5G WAN port, three 2.5G LAN ports and one 10G SFP+ port for long-distance backhaul
- Dual WAN Ports with failover and load balancing for reliable, seamless connectivity. Optimize network performance and security with up to 32 VLANs
- Secure remote network access via IPSec Site-to-Site and Client-to-Site VPN, Open VPN and WireGuard, with up to 100 client device connections and 30 VPN tunnels
- Integrates with NETGEAR Pro WiFi Access Points and select Smart switches as part of NETGEAR’s Enterprise Network Solution, designed for easy SME management
- NETGEAR Insight for remote network management anytime, from anywhere. Includes 1-year subscription
6. Define external health checks
Enable Online Detection, link monitoring, or an equivalent feature. Prefer at least two independent public destinations, such as a public IP and a DNS lookup service. A check that reaches only the ISP modem can report success while the provider’s upstream network is unreachable. TP-Link documents ping and DNS lookup choices; MikroTik examples use monitored public hosts with recursive routes and check-gateway=ping; D-Link documents DNS or ping checks, retry intervals, and a failure count.
7. Set failure and recovery thresholds
Choose how often probes run and how many consecutive failures trigger a switch. Avoid a single-packet threshold on a noisy cellular or wireless access path; it can create unnecessary flapping. Also set a recovery condition so one successful packet does not immediately return traffic to a still-unstable primary link.
ASUS publishes one product-specific example that checks every five seconds and fails over after 12 consecutive failures. That example would allow roughly one minute of failed probes, but it is not a universal standard. Vendor defaults differ, and the actual delay also includes route installation and client retransmission time.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →8. Decide on failback
Automatic failback returns traffic to WAN1 as soon as its recovery threshold is met. This restores the preferred service and limits cellular usage, but it can interrupt sessions a second time. Select manual recovery when a brief transition is unacceptable or when you want an operator to verify the primary circuit before returning to it.
9. Save, apply, and observe
Apply the configuration and watch the gateway’s WAN status, route table, health-check log, and data counters. Confirm that WAN2 remains idle while WAN1 is healthy. If the 5G link is carrying traffic immediately, check for a reversed priority, an always-on load-balancing rule, or a health check that is failing against an unreachable destination.
How to test failover and recovery
Test at a quiet time, tell users that sessions may reset, and record timestamps. A complete test covers detection, service on the backup, and return to the primary.
Rank #4
- ALL-IN-ONE VPN SOLUTION FOR REMOTE WORK: Extends your corporate network to homes or remote offices, enabling access with enhanced security to resources without complex setup. Ideal for small businesses, entrepreneurs, and enterprises supporting remote or hybrid teams
- ENTERPRISE-GRADE SECURITY & ENCRYPTION: Helps protect sensitive data using IPSec, PPTP, L2TP, OpenVPN, SSL, and strong encryption (DES, 3DES, AES), reducing risk from external threats in an increasingly digital landscape
- FOLLOWS NDAA & TAA FOR ENHANCED TRUST: Made in Taiwan. Meets government and industry standards, making it well-suited for agencies and businesses under strict regulations, while providing reassurance for any organization seeking elevated data protection
- DUAL WAN FAILOVER FOR CONTINUOUS CONNECTIVITY: Automatically switches to a backup internet source if the primary goes down, minimizing disruptions to crucial tasks like video calls or file sharing. Load balancing ensures optimized bandwidth for smoother, more reliable performance
- SIMPLIFIED MANAGEMENT: Web-based and SNMP tools offer clear visibility and control, reducing complex troubleshooting and making it easier to deploy
- Start a new web session and note the public IPv4 address shown by an external address-check service. Record the gateway’s WAN status.
- Disconnect the WAN1 Ethernet cable or disable the upstream service at the modem. Do not unplug the 5G device.
- Wait for the configured failure threshold. Confirm the gateway marks WAN1 down and WAN2 active.
- Open new web pages, resolve several DNS names, and run a controlled download. Verify that new traffic works through cellular and that the cellular data counter increases.
- Check a site-to-site or remote-access VPN, a VoIP call, video meeting, cloud synchronization, and any policy-routed device. Existing sessions may fail even when new sessions succeed.
- Restore WAN1 and wait for the recovery threshold. Confirm the selected automatic or manual failback behavior.
- Repeat the test at least once with the primary modem’s upstream service disabled rather than only removing the Ethernet cable. This distinguishes a cable or port failure from an internet-path failure.
Record detection time, backup address, DNS results, VPN behavior, IPv6 behavior, and whether inbound services remained reachable. Test again after firmware updates or changes to probe targets.
What changes when the backup link is active
Existing sessions and public addresses
The cellular path normally has a different public egress address. TCP connections, VPN tunnels, remote desktops, uploads, and other stateful sessions tied to the old address can break. The documented failover behavior is primarily to move new sessions; applications must reconnect or be restarted as needed.
Inbound services and allowlists
Port forwards, remote cameras, self-hosted services, and office VPN listeners may stop working when the backup uses CGNAT or a different address. Cloud firewalls, corporate allowlists, geofencing rules, and access-control lists that contain the primary address must include an approved cellular address or an alternate access method. If the carrier does not offer inbound reachability, use an outbound overlay or a separate hosted rendezvous service rather than assuming port forwarding will work.
IPv6
Primary and cellular providers can delegate different IPv6 prefixes. Devices that cached addresses from WAN1 may need to select new addresses after failover. Test IPv6-only destinations and firewall rules explicitly; do not infer IPv6 continuity from a successful IPv4 test.
VoIP and real-time traffic
A change of NAT mapping and path can interrupt SIP registration, active calls, and video meetings. Set realistic registration intervals, confirm that the phone system can re-register through WAN2, and test both directions of audio. Cellular latency and radio scheduling can also differ significantly from the wired service.
Free tools Windows power users keep installed
One-click scans. No signup required.
Troubleshoot common failures
The router never fails over
- Check that the gateway is in Failover or Link Backup mode, not load balancing with WAN1 still preferred for every rule.
- Review probe logs. A gateway check aimed only at the local modem can remain successful during an upstream outage.
- Verify that the failure count and retry interval are long enough to be reached during the test.
- Ensure policy routes, static routes, or a VPN’s forced WAN assignment are not overriding the default failover route.
It fails over repeatedly
- Use multiple external probe targets instead of one host that may rate-limit or block ICMP.
- Increase the consecutive-failure threshold and add a recovery threshold.
- Check power, signal quality, Ethernet errors, and DNS latency on the 5G device.
- Confirm that WAN1’s modem is not rebooting or renewing DHCP at the same time as the test.
WAN2 shows connected but clients have no internet
- Verify that the 5G device itself can browse when connected directly.
- Set WAN2 to DHCP when the cellular unit is in router mode, and ensure its LAN subnet does not overlap the main LAN.
- Check that the gateway’s DNS service can reach external resolvers over WAN2.
- Review NAT rules and firewall policies for the secondary interface.
VPN or remote access stops working
First determine whether the problem is an existing session tied to the old address or a policy that blocks the new address. Reconnect the VPN, add the cellular egress address to approved lists when possible, and test whether CGNAT prevents inbound initiation. If inbound access is a requirement, choose a carrier plan with suitable addressing or design the service to establish an outbound connection.
Best Value
- 【Flexible Port Configuration】1 Gigabit SFP WAN Port + 1 Gigabit WAN Port + 2 Gigabit WAN/LAN Ports plus1 Gigabit LAN Port. Up to four WAN ports optimize bandwidth usage through one device.
- 【Increased Network Capacity】Maximum number of associated client devices – 150,000. Maximum number of clients – Up to 700.
- 【Integrated into Omada SDN】Omada’s Software Defined Networking (SDN) platform integrates network devices including gateways, access points & switches with multiple control options offered – Omada Hardware controller, Omada Software Controller or Omada cloud-based controller(Contact TP-Link for Cloud-Based Controller Plan Details). Standalone mode also applies.
- 【Cloud Access】Remote Cloud access and Omada app brings centralized cloud management of the whole network from different sites—all controlled from a single interface anywhere, anytime.
- 【SDN Compatibility】For SDN usage, make sure your devices/controllers are either equipped with or can be upgraded to SDN version. SDN controllers work only with SDN Gateways, Access Points & Switches. Non-SDN controllers work only with non-SDN APs. For devices that are compatible with SDN firmware, please visit TP-Link website.
Failback causes another outage
Disable automatic failback, raise the recovery threshold, or require an operator to confirm WAN1 stability. A primary link that briefly returns and fails again can cause repeated session loss if the gateway moves traffic back too quickly.
Advanced controls for larger networks
Policy routing
Some devices need a predictable egress address. Create policy rules for those devices or applications so they use WAN1 only, WAN2 only, or the normal failover group. Test the rule during both states; a policy that pins a device to a failed WAN defeats automatic recovery.
Recursive-route monitoring
Advanced RouterOS configurations can use recursive routes to monitored public hosts and check-gateway=ping. This approach gives precise control over route distance and probe targets, but a mistake can remove both default routes. Export the working configuration and test changes from a local console before relying on remote access.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Remote administration
Keep management access on the LAN and use a secured outbound management method. Do not assume the gateway’s WAN management address remains reachable after the public address changes. Restrict administrative exposure on both WANs and verify that logs are timestamped so you can correlate probes, route changes, and user reports.
Operating costs and maintenance
The standby design has three recurring cost categories: the dual-WAN gateway, the 5G hardware or service, and cellular data used during outages or tests. A low-cost plan with a small allowance may be adequate for short interruptions but unsuitable for a business that needs several days of continuity. Include the price of an external antenna or better placement if indoor signal is weak.
Once deployed, schedule a quarterly failover test and test after carrier, modem, or gateway firmware changes. Review cellular usage, probe logs, VPN reconnect behavior, IPv6 results, and the actual detection delay. Keep a printed or offline copy of the topology, credentials, carrier support number, and recovery procedure for use during a primary-site outage.
Bottom line
Build the system around a two-WAN gateway, an independent cellular access path, external health checks, and a deliberately chosen failback policy. Wire the wired ISP to WAN1 and the 5G Ethernet handoff to WAN2, validate each service separately, then test by physically removing the primary path. Expect a new public address and possible session resets, and verify DNS, VPN, VoIP, IPv6, inbound access, and policy-routed devices rather than assuming that ordinary web browsing proves the design works.
Recommended Free Tools
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
