Two providers at every site

A branch where nothing works once the fibre is cut is a branch with one cable. A second line is the cheapest availability you can buy. Failover, though, is not a tick box: it is a choice between methods that each notice something different.

On the board

On the network board an internet connection is a block of its own. Drop two of them at each location, connect them to ports on the router, and tick backup on the second one.

What the tool does with that:

• Every internet connection cabled to a router becomes an uplink. Main connections come first, backups after them; four per router are set up, and the check tells you when you drew more.
• A main connection gets route distance 1, a backup distance 2, a second backup 3. Two main connections therefore share the load, while a backup waits.
• If the failover method is not already distance, recursive or PCC, the tool sets it to distance.
• Pick a provider on the internet block and the tool fills that uplink in the way that provider wants it: a VLAN on the WAN port, PPPoE, and on the first line the IPv6 prefix. See Provider presets.
• The port gets a comment, and with several lines the name of the block, with (backup) after it. That saves hunting when you are standing at the meter cupboard a year later.

Ports that used to be WAN and are not any more go back into the bridge. That happens by itself, but check it: an old WAN port reappearing as a LAN port is exactly the kind of detail you do not expect.

The three failover methods, honestly

Recursive is the more reliable one and has a practical problem: it needs the gateway address of each line, and on a DHCP uplink that is only known after the router connects. The tool warns about this and puts a placeholder in the route. You replace it with the real address by hand, or you pick the distance method.

PCC switches FastTrack off, because marked traffic bypasses the fast path. On a small router that costs throughput. With two lines of different speeds PCC also splits connections evenly; it is not load balancing in proportion to capacity.

Which traffic goes where

The tool generates failover, not per-network traffic steering. If you want the guest network always on the second line and the office network on the first, that is policy routing, and you set it per device in the Routing section: an extra routing table with its own default gateway, plus a rule sending a source network to that table.

/routing table add name=via-backup fib=yes
/ip route add dst-address=0.0.0.0/0 gateway=192.0.2.1 routing-table=via-backup
/routing rule add src-address=10.10.20.0/24 action=lookup-only-in-table table=via-backup

The rule looks at the source address only. Splitting traffic by port number or by service is not something the tool expresses; that needs mangle rules you write yourself. And mind the words lookup-only-in-table: when that line fails, the source network has no internet at all, because it does not fall back to the main table.

What happens to the tunnel

When a branch moves to its second line, the address it talks to the world from changes. For the tunnel that means:

• WireGuard recovers on its own, as long as the side that switches is the side that dials. The tool fills in the endpoint only on the side whose peer has a public address. The branch therefore calls the head office, and the head office learns the new source address on the next valid handshake. With the 25-second keepalive that takes tens of seconds, not minutes.
• If the side with the public address switches, the configured endpoint no longer matches and the tunnel stays down until you change it. A DNS name with DDNS helps here: turn IP Cloud on under Management access and use the mynetname.net name as the public address.
• GRE, IPIP and EoIP do not recover by themselves. They have a fixed IP address as their destination, and that address is what changes on a switchover. The tunnel stays down.

There is one public address field per router. A branch with two lines therefore has no way to make both addresses known on the far side. If you really need that, it is a second peer you add by hand, or DDNS.

Where it goes wrong

• Both lines on the same modem. Two uplinks behind one provider box is one outage.
• The subscription is faster than the port. The tool works that out and reports it, with a suggestion for a better port.
• A cable to the internet on a device that does not route. That is an error in the checks: give it a router role, or connect the line to the router.
• The backup is never tested. Pull the main cable once, at a moment you can afford it, and see whether it takes over and, above all, whether it goes back afterwards.

Further reading: Several uplinks, Two tunnels between the same locations and Netwatch and monitoring.