iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Use a single multi-WAN failover router as the network edge: connect the satellite terminal to WAN1, an independent 4G/5G modem or hotspot to WAN2, and your switch, Wi-Fi access points, phones and computers to the router’s LAN. The router monitors both links and moves new traffic to the surviving connection without asking employees to change Wi-Fi networks.
For most remote teams, make satellite primary when the site has a clear sky view and the cellular plan is capped or unreliable. Make cellular primary when local 4G/5G has lower latency, better availability or lower recurring cost. In either order, keep one staff SSID and DHCP scope, reserve limited cellular data for critical applications, and test the switchover before an outage occurs.
What the finished design looks like
The reliable pattern is two genuinely independent WAN paths controlled by one router or SD-WAN appliance. Independence matters: a second service that uses the same cable, tower backhaul, power feed or upstream provider may fail at the same time as the primary.
Satellite terminal ── Ethernet/bypass ── WAN1 ┌─────────────────────┐
4G/5G modem or hotspot ─────────────── WAN2 │ Multi-WAN router │
│ health checks │
Switch ── Wi-Fi APs ── phones/workstations │ failover/policy rules│
└──────── LAN ─────────┘Use one DHCP scope and one employee SSID behind the router. Staff devices retain their addresses and wireless association while the router changes the upstream path. A guest VLAN or SSID should be separate from the staff network.
#1 Best Overall
- 【Flexible Port Configuration】1 2.5Gigabit WAN Port + 1 2.5Gigabit WAN/LAN Ports + 4 Gigabit WAN/LAN Port + 1 Gigabit SFP WAN/LAN Port + 1 USB 2.0 Port (Supports USB storage and LTE backup with LTE dongle) provide high-bandwidth aggregation connectivity.
- 【High-Performace Network Capacity】Maximum number of concurrent sessions – 500,000. Maximum number of clients – 1000+.
- 【Cloud Access】Remote Cloud access and Omada app brings centralized cloud management of the whole network from different sites—all controlled from a single interface anywhere, anytime.
- 【Highly Secure VPN】Supports up to 100× LAN-to-LAN IPsec, 66× OpenVPN, 60× L2TP, and 60× PPTP VPN connections.
- 【5 Years Warranty】Backed by our 5-years warranty and free technical support from 6am to 6pm PST Monday to Fridays
Choose the primary link deliberately
| Situation | Recommended primary | Reason |
|---|---|---|
| Clear sky view, limited cellular allowance, satellite plan with suitable capacity | Satellite | Preserves cellular data for outages and critical traffic. |
| Strong local 4G/5G, lower latency, inexpensive high-volume data | Cellular | Interactive applications generally benefit from the shorter path. |
| Both links have weaknesses | Policy-based design | Route calls, VPN and business systems over the steadier path while sending bulk synchronization over the other. |
Managed designs that combine 5G and Starlink demonstrate automatic failover and load balancing, but the exact behavior depends on the router, modem and service plans you purchase.
Plan the requirements before buying equipment
Map applications to network needs
- Video meetings and VoIP: sensitive to latency, jitter and packet loss. A link can show high download speed yet still produce poor calls.
- VPNs and remote administration: sensitive to changing public IP addresses and blocked inbound connections.
- File synchronization and backups: sensitive to sustained throughput and cellular data caps.
- Point-of-sale, monitoring and alerts: need predictable reachability and a documented recovery path.
Confirm service availability and contractual limits
Select a current Starlink Business kit and plan sold at the installation address. Starlink describes Business service for primary connectivity, backup, interim setup and emergency use, and its Performance hardware is intended for resilient connectivity. Availability, plan names and terms vary by country and can change, so verify the address-specific offer before ordering.
For cellular, confirm tower coverage at the building, supported bands, SIM activation, antenna options and whether the carrier permits use in a business router. A phone hotspot may work for testing but can have different terms, limits and thermal behavior from a carrier-approved modem.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Rank #2
- 【Five Gigabit Ports】1 Gigabit WAN Port plus 2 Gigabit WAN/LAN Ports plus 2 Gigabit LAN Port. Up to 3 WAN ports optimize bandwidth usage through one device.
- 【One USB WAN Port】Mobile broadband via 4G/3G modem is supported for WAN backup by connecting to the USB port. For complete list of compatible 4G/3G modems, please visit TP-Link website.
- 【Abundant Security Features】Advanced firewall policies, DoS defense, IP/MAC/URL filtering, speed test and more security functions protect your network and data.
- 【Highly Secure VPN】Supports up to 20× LAN-to-LAN IPsec, 16× OpenVPN, 16× L2TP, and 16× PPTP VPN connections.
- Security - SPI Firewall, VPN Pass through, FTP/H.323/PPTP/SIP/IPsec ALG, DoS Defence, Ping of Death and Local Management. Standards and Protocols IEEE 802.3, 802.3u, 802.3ab, IEEE 802.3x, IEEE 802.1q
Account for power and physical routing
Put the satellite terminal, router, cellular modem and access points on a UPS. Size it from the equipment’s measured power draw and the outage duration you require; no universal runtime applies because hardware, battery capacity and load differ. Keep the two WAN devices on separate power circuits where practical, and label both Ethernet feeds and power adapters.
Install and place the satellite terminal
Find an unobstructed sky view
Use the Starlink app’s obstruction check at the proposed mounting point. Trees, rooflines and nearby structures can interrupt the link; weather can also affect service. Fixed-site instructions reduce the initial process to connecting power and pointing the terminal at the sky, but a good result still depends on a clear view and a secure mount.
- Open the app and run the obstruction or visibility check at roof, pole or ground locations.
- Select the location with the clearest view, safe access and a cable route that avoids sharp bends, standing water and trip hazards.
- Mount the terminal according to its hardware instructions and weather-seal any exterior penetration.
- Power the terminal and allow it to acquire service before connecting it to the production router.
- Record the terminal identifier, service address, account recovery details and support contact in the team’s offline runbook.
Hand Ethernet service to the failover router
Connect the terminal’s Ethernet feed to WAN1 on the multi-WAN router. If the supplied Starlink router remains in the path, use the documented bypass or equivalent handoff supported by your router. A bypass prevents two routers from performing conflicting NAT and DHCP functions. Some installations instead place the downstream router behind the Starlink router; that can work, but double NAT may complicate inbound services, VPNs and troubleshooting.
Rank #3
- ALL-IN-ONE VPN SOLUTION FOR REMOTE WORK: Extends your corporate network to homes or remote offices, enabling access with enhanced security to resources without complex setup. Ideal for small businesses, entrepreneurs, and enterprises supporting remote or hybrid teams
- ENTERPRISE-GRADE SECURITY & ENCRYPTION: Helps protect sensitive data using IPSec, PPTP, L2TP, OpenVPN, SSL, and strong encryption (DES, 3DES, AES), reducing risk from external threats in an increasingly digital landscape
- FOLLOWS NDAA & TAA FOR ENHANCED TRUST: Made in Taiwan. Meets government and industry standards, making it well-suited for agencies and businesses under strict regulations, while providing reassurance for any organization seeking elevated data protection
- DUAL WAN FAILOVER FOR CONTINUOUS CONNECTIVITY: Automatically switches to a backup internet source if the primary goes down, minimizing disruptions to crucial tasks like video calls or file sharing. Load balancing ensures optimized bandwidth for smoother, more reliable performance
- SIMPLIFIED MANAGEMENT: Web-based and SNMP tools offer clear visibility and control, reducing complex troubleshooting and making it easier to deploy
Add the cellular WAN
Install the modem, SIM and antennas
- Activate the SIM and verify the plan’s business-router terms before inserting it.
- Place the modem where it receives a strong signal, or connect the carrier-approved external antenna recommended for the device.
- Check that the modem is registered on the intended 4G or 5G band and that it has obtained an Internet address.
- Connect the modem’s Ethernet port to WAN2. If it only offers USB tethering, confirm that the router supports that modem and mode before relying on it.
- Record the carrier portal credentials, data allowance, reset procedure and support number in the runbook.
Cellular backup is only as useful as local tower coverage, antenna placement, plan allowance and power continuity. Monitor consumption because a failover event can exhaust a capped plan faster than normal operations.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchConfigure automatic failover
Set WAN roles and health checks
- In the router’s Internet, Multi-WAN or Link Backup menu, set the satellite interface as WAN1 and cellular as WAN2 (or reverse them if your decision framework favors cellular).
- Choose failover rather than load balancing if preserving cellular data is the priority. Choose weighted or policy-based balancing only when both links should carry traffic routinely.
- Enable health checks that test beyond the local gateway. Use DNS resolution plus an external HTTPS endpoint so a modem that is powered on but cannot reach the Internet is marked failed.
- Set a hold-down or debounce period. This prevents brief packet loss from causing repeated WAN changes. The appropriate interval depends on application tolerance and should be established during testing rather than guessed.
- Define the recovery rule: return to the preferred WAN immediately, after a stability period, or only when an administrator confirms it. A stability period avoids flapping when satellite service is intermittent.
Preserve critical traffic when cellular is metered
Use policy routing to reserve cellular for essential traffic when its allowance is limited. Typical high-priority classes are DNS, authentication, voice, collaboration control traffic, monitoring and the VPN used by administrators. Bulk cloud synchronization, operating-system images and off-site backups can wait for the satellite path or a scheduled high-capacity window.
Document whether the router supports session persistence, connection bonding or only new-session failover. Ordinary failover usually moves new connections; it does not magically preserve every established flow.
Rank #4
- 【Flexible Port Configuration】1 Gigabit SFP WAN Port + 1 Gigabit WAN Port + 2 Gigabit WAN/LAN Ports plus1 Gigabit LAN Port. Up to four WAN ports optimize bandwidth usage through one device.
- 【Increased Network Capacity】Maximum number of associated client devices – 150,000. Maximum number of clients – Up to 700.
- 【Integrated into Omada SDN】Omada’s Software Defined Networking (SDN) platform integrates network devices including gateways, access points & switches with multiple control options offered – Omada Hardware controller, Omada Software Controller or Omada cloud-based controller(Contact TP-Link for Cloud-Based Controller Plan Details). Standalone mode also applies.
- 【Cloud Access】Remote Cloud access and Omada app brings centralized cloud management of the whole network from different sites—all controlled from a single interface anywhere, anytime.
- 【SDN Compatibility】For SDN usage, make sure your devices/controllers are either equipped with or can be upgraded to SDN version. SDN controllers work only with SDN Gateways, Access Points & Switches. Non-SDN controllers work only with non-SDN APs. For devices that are compatible with SDN firmware, please visit TP-Link website.
Understand what users will notice
When the public IP or route changes, active video calls, VPN tunnels, uploads and downloads can stop and reconnect. TCP sessions and applications that pin a connection to an address may need a manual retry. Automatic failover maintains Internet access for new sessions; it is not the same as a seamless, single-session bonded circuit.
Test the design before relying on it
Run a controlled drill during a maintenance window and tell staff what to expect. Record the time to detect failure, time to move new sessions, packet loss, application impact, alerts and cellular data consumed.
- Start with both WANs healthy and confirm that the preferred link carries traffic.
- Have a user conduct a video call, send chat messages, transfer a file and log in to the team VPN.
- Disconnect WAN1 at the router or upstream terminal without powering down the LAN.
- Confirm that new web sessions, chat messages and VPN logins use WAN2. Note whether the active call or file transfer reconnects.
- Check router logs and carrier usage to ensure the alert fired and the expected traffic policy was applied.
- Reconnect WAN1 and verify the configured return policy. Confirm that the router does not oscillate between links.
- Repeat after router firmware updates, SIM or carrier changes, Starlink plan changes and any physical relocation.
Keep a dated test record with observed switch time, failed applications, recovery actions and data consumption. That record is more useful than a theoretical availability claim when deciding whether the design meets the team’s needs.
Best Value
- Easier-Than-Ever Setup — Convenient and easy router management via web browser or the ASUS ExpertWiFi mobile app through Bluetooth setup.
- VLAN for Added Security —Each of the Ethernet ports can be assigned to one or more VLAN IDs that provides additional security for your business.
- Up to 3 WAN Ethernet Ports – 1 gigabit WAN port and 2 gigabit WAN/LAN ports with load balancing optimize multi-line broadband usage.
- Backup WAN for Stable Connectivity –The USB port can be used as a backup WAN by connecting it to a mobile phone with hotspot to maintain a reliable internet connection.
- Commercial-Grade Network Security and VPN — Secure public WiFi connections with Safe Browsing and VPN features. Enjoy a free-subscription ASUS AiProtection Pro, including robust intrusion prevention system (IPS) features like deep packet inspection (DPI) and virtual patching to block malicious traffic.
Performance, plans and published figures
Starlink’s current business material advertises up to 400+ Mbps download capability for the Performance Kit. This is a hardware or plan capability, not a guarantee of the throughput your site will achieve; obstructions, congestion, weather, network policy and Wi-Fi can reduce it.
Starlink Priority plans publish a 99.9% network-availability SLA on the current support page. Treat that as the stated plan commitment under its terms, not as a promise that every application or local power system will remain available.
The same business material states that, after Global Priority data is exhausted, service may be limited to up to 1 Mbps download and 0.5 Mbps upload. The allowance and post-cap behavior are plan-specific and should be checked for the service address and billing period.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problems| Decision axis | Satellite link | Cellular link | Operational implication |
|---|---|---|---|
| Independent path | Separate space-to-ground path | Separate radio access and carrier core | Use different physical routes and power where possible. |
| Latency and jitter | Variable; sky view and congestion matter | Often lower locally, but tower load varies | Prioritize the steadier path for calls and interactive work. |
| Capacity limits | Plan policy and congestion can affect throughput | Monthly allowance or overage can constrain use | Apply policy routing and monitor both links. |
| Public IP and VPN | Business plans state support for VPNs, public-IP configurations and IPv6 | Carrier NAT or changing addresses may restrict inbound access | Use site-to-site or client VPN and verify required address behavior. |
| Power draw | Terminal plus router equipment | Modem, antenna equipment and router | Measure actual draw and size the UPS for the required outage. |
| Recovery behavior | Router health check determines failover | Router health check determines failover | Existing sessions may reconnect when the public IP changes. |
Secure the remote-team network
Protect the LAN and management plane
- Use WPA2 or WPA3, unique administrator credentials and current firmware on the router, access points and modems.
- Put guests and unmanaged devices on a separate VLAN and SSID with no route to staff systems.
- Restrict router, modem and terminal management interfaces to an administrator network; do not expose them to the guest network or open Internet.
- Log WAN transitions, authentication events and configuration changes, and forward logs if your team operates a central monitoring system.
- Keep an offline copy of Starlink and carrier support contacts, account recovery information and the physical cabling map.
Use VPNs for private services
Starlink Business states support for VPNs, public-IP configurations and IPv6. Use a site-to-site VPN or client VPN for private applications and remote administration rather than opening management ports directly. Test the VPN over each WAN because carrier NAT, address changes and different MTUs can expose configuration assumptions.
Troubleshoot common failures
The router never marks satellite healthy
- Verify the terminal has power and has completed startup.
- Check the app for obstructions, service alerts and a valid account at the current address.
- Confirm the Ethernet handoff, bypass setting and WAN DHCP or static settings expected by the router.
- Test DNS and an external HTTPS endpoint separately; a reachable local gateway does not prove Internet access.
Cellular does not take over
- Check SIM activation, account status, data allowance and whether the modem is registered on a supported band.
- Test the modem directly, then verify the WAN2 interface receives an address and default route.
- Inspect policy rules that may intentionally block noncritical traffic on cellular.
- Move or re-aim the antenna, but retest signal and throughput rather than relying on signal bars alone.
Users remain disconnected during failover
- Confirm that the router is configured for new-session failover; established sessions may not survive.
- Shorten application reconnect timers where safe and provide a documented VPN reconnect procedure.
- Check MTU, DNS and authentication behavior on WAN2.
- Review hold-down and recovery timers if the router is flapping between links.
Cellular data disappears quickly
- Inspect top talkers in the router and carrier portal.
- Block or schedule large updates, backups and media synchronization during cellular-only operation.
- Set alerts before the allowance is exhausted and define who can authorize continued noncritical use.
Operate the backup system as a service
Assign an owner for WAN monitoring, account billing, firmware maintenance and outage decisions. Review health-check destinations, alert recipients and policy-routing rules quarterly. Replace expired SIMs, test the UPS under load and repeat the outage drill after any change that can alter routing, addressing or power.
Keep a one-page outage runbook at the site and in an offline location. It should show which cable is WAN1 or WAN2, how to disable a link for testing, how to read the router’s status, how to reconnect the VPN, how to contact each provider and when to stop using a metered cellular plan.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
