Internet Backup
Dual-WAN Failover: Why Calls And VPNs Can Still Drop
Your backup internet is online, but a video call or VPN still disconnects. Separate outage detection, traffic routing and application recovery before replacing the gateway.
Dual-WAN failover can restore internet access without preserving every call or VPN session. The gateway must detect the failure, move traffic to a usable backup and allow each application to recover. Check those three stages separately, then test the return to the primary line.
The office has two internet connections. One fails, the backup indicator turns green and websites load again. Yet the meeting freezes, a remote desktop disconnects or a file transfer stops. It is easy to conclude that the second line was a waste of money.
A better starting point is to ask what recovered, and what did not. A working backup route and an uninterrupted application session are different outcomes. Knowing which one the business needs makes the configuration, equipment choice and acceptance test much clearer.
First, Separate Internet Recovery From Application Recovery
Keep the gateway’s event times alongside the user’s experience. “The internet was down for a while” does not show whether the delay came from detecting the fault, switching routes or waiting for a particular application.
| Stage | What To Check | What It Does Not Prove |
|---|---|---|
| Failure detection | The gateway recognises that the primary path is unusable. | A lit Ethernet port does not establish that the wider internet is reachable. |
| Route recovery | A new browser request can leave through the backup connection. | An already-established call or VPN has not necessarily survived. |
| Application recovery | The actual call, tunnel or working session resumes acceptably. | One successful application does not establish the behaviour of every other service. |
Start with one affected wired device where practical. If the backup works on that device but not over WiFi, the access network needs investigation too. The meeting-room WiFi troubleshooting guide helps separate radio, wired-network and service-path problems.
Two Internet Paths Do Not Mean One Unchanging Session
A Backup Route For The Same Office
Logical connection paths. The two WANs connect to the same gateway; their public addresses and upstream infrastructure may differ.
A connection can depend on the address and state established on its original path. When traffic moves to another provider, the public IP address may change. The remote service may then require a new connection, authentication or tunnel negotiation. A conventional TCP connection, for example, is identified by its endpoints; a replacement path is not automatically the same connection.
Different applications handle that change differently. A browser may quietly retry a request while a meeting shows a reconnect message. A remote-access client may recover its session, or it may require the user to reconnect. Neither the WAN status light nor a single speed test answers that question.
Prefer the main line and use a backup when the selected failure conditions are met.
Distribute connections across available WANs. A single connection is not automatically the sum of both lines.
If the requirement is that a critical session continues without rejoining, state that explicitly. Assess a compatible continuity design, its remote endpoints and the application itself. Treat bonding, tunnel redundancy and ordinary WAN failover as separate capabilities rather than interchangeable labels.
Check What The Gateway Treats As A Failure
An internet fault can occur beyond the cable plugged into the gateway. The Ethernet link may stay up while the provider’s upstream service is unavailable. Test what the gateway can actually detect, rather than relying only on the physical port state.
UniFi provides WAN health monitoring and configurable failover conditions. Review the selected checks, targets and thresholds for the installed Network version. A target that does not respond reliably can create misleading results; a check that proves only a nearby hop may miss a wider fault.
Omada Link Backup also depends on online detection. In supported standalone firmware, the shared load-balancing function must be enabled for Link Backup to operate, even when the intended arrangement is a preferred primary line and a standby backup. Controller-managed configuration has its own settings. Use the instructions for the actual model, firmware and management mode.
Aggressive detection is not automatically better. A transient problem can lead to repeated switching if the thresholds do not fit the service. Record detection events and the real application effect before changing several timers at once.
Check Routing Rules When Only Some Devices Recover
If ordinary browsing works but one department, VLAN or application remains offline, inspect its route. A policy can direct that traffic through a specific WAN or a VPN tunnel instead of the general default path.
Some policies deliberately stop traffic when their selected interface is unavailable. That may be the correct behaviour for protected traffic. Decide which alternative paths are permitted, then configure and test that intention. Preserve required VPN and security controls while fixing the recovery path.
Also check the remote service’s permitted source addresses. If access is restricted to the primary ISP’s public IP, a correctly working backup can still be rejected. Record the address requirement with the service owner and arrange any approved alternative before an outage.
VPN And Remote Access Need Their Own Test
There are two different questions: can staff inside the office reach an external VPN, and can someone outside reach a VPN hosted at the office? Success in the first direction does not establish the second.
- For outbound VPNs: check the selected WAN, tunnel re-establishment and the remote endpoint’s requirements.
- For inbound VPNs: check whether the backup service provides suitable reachable addressing and whether the particular VPN mode can use that WAN.
- For site-to-site tunnels: review the tunnel’s own redundancy and recovery configuration at both ends. A general internet failover rule is not a complete tunnel-recovery plan.
Carrier-grade NAT on a backup service can prevent the traditional inbound connection expected by an office-hosted VPN. A dynamic-DNS change also does not preserve an existing session or guarantee that every client immediately uses the replacement address.
Vendor support is specific to the VPN feature. Ubiquiti documents a WAN-failover limitation for UID Enterprise One-Click WireGuard VPN; that should not be generalised to every UniFi VPN product. Omada documents IPsec failover groups separately from WAN Link Backup. Check the exact implementation rather than assuming all VPNs behave alike.
Plan What Must Work On The Backup Line
A backup connection may have enough capacity for essential calls and cloud applications while a large synchronisation task consumes most of its upload capacity. Measure the work that must continue and decide which non-essential traffic can wait.
For a metered mobile service, budget data as well as speed. At an assumed continuous aggregate rate of 8 Mb/s for one hour, the transferred data is about 3.6 GB before protocol overhead. This is planning arithmetic: 8 megabits per second × 3,600 seconds ÷ 8. Actual application traffic varies, so use measured demand and the service’s allowance when sizing the plan.
Ask about signal quality, upload demand, data limits, addressing and service terms. Two subscriptions also do not guarantee independent infrastructure. Check whether the paths share a building entry, upstream access network or a power dependency.
The gateway remains a common point of failure if both lines terminate on the same unit. Include the internet handoffs, gateway, switch and required access points in the power plan. The NAS and PoE UPS planning guide explains how to work from the actual connected load and required runtime.
Test Failover And Failback Before The Next Busy Day
Arrange a maintenance window, keep the current configuration and have a restoration path. Use a planned failure test agreed by the network administrator. Unplugging a primary WAN cable tests one failure condition; it does not prove how the system handles every upstream or partial outage.
- Establish a baseline. Check both internet services independently and record the normal route and working applications.
- Start the work that matters. Include a call, a relevant VPN and a representative cloud task using approved test data.
- Trigger the agreed failure. Record when the gateway detects it and when a new external request succeeds.
- Record application recovery separately. Note whether the call resumes, needs a rejoin or remains unavailable, and whether the VPN and transfer recover.
- Restore the main line. Observe the configured failback behaviour and check for another interruption or repeated switching.
| Record | Why It Matters |
|---|---|
| Failure and route-recovery timestamps | Separate the detection delay from the point at which a new connection works. |
| Call and VPN recovery, including user action | Show whether the business can resume work acceptably, rather than only whether a status is green. |
| Active WAN, public address and routing policy | Identify the actual replacement path and any address-based restriction. |
| Primary-line restoration and failback events | Check the return journey and watch for an unstable primary connection. |
| Backup capacity, quota and power dependencies | Confirm that the usable recovery lasts for the required working period. |
There is no universal recovery time to insert into this worksheet. Record results for the installed hardware, software, providers and applications. If the primary circuit is flapping, investigate its stability and recovery policy rather than treating each automatic switch as an isolated event.
Choose The Gateway Around The Recovery Requirement
For an existing UniFi installation, the UCG-Fiber is a compact gateway to assess alongside the physical WAN handoffs and available port roles. For an Omada-managed network, the ER8411 is another gateway platform to evaluate against the site’s throughput, VPN and management requirements.
Check the complete feature combination, including inspection, VPN use and the number of needed interfaces. A fast Ethernet port does not establish that a particular backup circuit or application will recover acceptably. Keep a healthy existing gateway if its supported configuration can meet the tested requirement.
For the wider UniFi platform decision, the UCG-Fiber and UDM-Beast comparison covers the gateway’s role in the rest of the network. The acceptance test above remains necessary whichever platform is chosen.
Frequently Asked Questions
Why Does My Video Call Drop If Dual-WAN Failover Is Working?
The gateway may restore an internet path while the call still needs to recover its connection. Changing providers can change the public IP address and connection state. Some applications recover automatically; others need a reconnect or rejoin. Measure both internet recovery and the actual call’s recovery.
Does Load Balancing Combine Two Internet Lines Into One Faster Connection?
Ordinary load balancing distributes connections between WANs. It does not automatically combine both lines for a single download or preserve a session when its original WAN fails. Bonding and other continuity architectures need their own compatible design and should be evaluated separately.
Why Is The Backup WAN Online But Some Devices Cannot Use It?
Check the routing rules for those devices, networks and applications. A rule may select one WAN or VPN, or intentionally stop traffic when that path is unavailable. Confirm the intended fallback behaviour while preserving the required security policy.
Will A 4G Or 5G Backup Restore Remote VPN Access Automatically?
Not necessarily. Outbound internet use and inbound VPN access have different requirements. Check the backup service’s addressing, any carrier-grade NAT, the VPN endpoint and the gateway’s support for the particular VPN mode. Test from a genuinely external connection.
Should I Test The Primary WAN Coming Back Too?
Yes. Failback is the return to the preferred connection. Recovery settings can influence when traffic moves back, and an unstable primary line can cause repeated changes. Test restoration as well as failure, recording what happens to existing calls, VPNs and transfers.
Do Two Internet Lines Protect Against Every Office Outage?
No. The gateway, switch, access point, power supply or a shared upstream route can still be a common point of failure. Check the complete path, including the power supporting both internet handoffs and the devices staff need to keep working.
Test The Recovery Your Business Needs
For an office that needs a usable fallback, start with a verified primary/backup arrangement and test the real applications. Check outage detection, permitted routing, backup capacity, VPN reachability, power and the return to the preferred line.
If the requirement is uninterrupted sessions, define that separately and evaluate the appropriate continuity design. Bring the gateway model, firmware, two ISP service details, WAN addressing, current policies and application recovery targets to a Networking Specialist. Those facts support a practical plan and a test the business can sign off.
