Most business routers can hold two connections and swap between them on their own. The hard part is not plugging in the SIM, it is configuring the bit that decides the main line has actually failed. Get that wrong and the backup either never kicks in, or kicks in every time somebody sneezes. Here is how to do it on DrayTek, TP-Link Omada and UniFi.
The 30-second version
- You need a router that holds two connections and decides between them. A spare dongle in a drawer is not failover.
- All three platforms can do it. They just call it different things: Active Mode on DrayTek, link backup on Omada, WAN2 failover on UniFi.
- The health check is the whole job. If the router pings your own provider's gateway, it will miss most real outages.
- Put the mobile router where the signal is, not in the comms cupboard with everything else.
- Live calls drop on the switch. Everything else reconnects within seconds to a couple of minutes.
- Size the SIM for a full outage, not for an hour. A two day fault on a 5GB SIM is its own emergency.
On this page
What you need first
Before touching any settings, three things need to be true, and the third one catches people out more than the other two together.
- A router that takes two connections. Either two WAN ports, or one WAN port and a SIM slot, or a USB port that accepts a mobile dongle.
- A data SIM with a sensible allowance. Failover is not a few megabytes. A whole office on 4G for two days will move serious data.
- Decent mobile signal where the router actually lives. Comms cupboards are usually the worst spot in the building for signal. If the backup is a separate 4G or 5G router, it goes where the signal is and runs back on a cable.
Check the signal before you buy the SIM
Stand in the comms room with a phone and look at the actual signal, then do the same at a window or external wall. If there is a difference, that difference is your plan. An external antenna or a router mounted somewhere sensible will do more for your backup than paying for a bigger data bundle.
Three ways to wire the backup in
How the mobile connection reaches the router changes what you can expect from it.
| Method | How it works | Worth knowing |
|---|---|---|
| USB dongle | A mobile dongle plugged into the router's USB port and treated as another WAN | Cheapest and tidiest, but throughput is modest and dongle compatibility is fussy. Check the router's supported list rather than assuming. |
| Separate 4G or 5G router into WAN2 | A standalone mobile router placed where the signal is good, feeding the main router over Ethernet | The most reliable of the three, because you can site the mobile unit for signal. Also the easiest to swap or upgrade later. |
| Built in SIM slot | A router with mobile built in, so one box does both | Neatest and nothing extra to power. The catch is that the router has to live where the signal is, which is rarely where you want the router. |
DrayTek
DrayTek Vigor routers handle this through Active Mode. Each WAN is either always on or acts as a failover for another.
- Set up the backup connection under WAN, Internet Access, whether that is WAN2 on Ethernet, the USB WAN or the built in LTE on models that have it.
- In WAN, General Setup, open the backup WAN and set Active Mode to Failover rather than Always On, then choose which WAN it is backing up.
- On the primary WAN, set WAN Connection Detection to Ping Detect and give it a ping target. This is the important one, covered below.
- Check Online Status to confirm the backup shows as connected or standing by rather than as an error.
TP-Link Omada
On Omada gateways such as the ER605 or ER7206, one of the LAN ports is converted to a second WAN, and the behaviour is set as link backup rather than load balancing.
- Convert a port to WAN. In the Omada controller this is under the wired network and internet settings; on a standalone gateway it is in the WAN configuration.
- Configure the second WAN for the mobile connection, usually DHCP if it is fed from a separate 4G or 5G router.
- Find the link backup setting and enable it, choosing the primary WAN and the backup. If you leave it on load balancing instead, traffic will use both lines all the time, which is a different thing entirely and will burn your data allowance.
- Set online detection for the primary WAN, with your own detection targets rather than the defaults.
UniFi
UniFi gateways with a second WAN, such as the Dream Machine Pro or the Dream Machine SE, treat failover as a role you give WAN2.
- In the internet settings, enable the second WAN on the port that supports it, then connect the mobile router to it.
- Set WAN2's role to failover rather than load balancing, and confirm WAN1 is the primary.
- Set the internet health check targets for each WAN. UniFi will use its own defaults otherwise, which are fine until the day they are not.
- Watch the WAN status page while you test, so you can see the switch happen rather than guessing from whether a web page loads.
Menu names move, the settings do not
Firmware updates rearrange menus on all three platforms regularly, so treat the above as the settings to look for rather than a click by click path. The concepts are stable: a second WAN, a role that says failover rather than load balance, and a detection method that decides when to switch.
The setting that decides whether it works
This is the part that separates failover that works from failover that only looks configured. The router needs a way to decide the main line is down, and the default is often to watch whether the physical link is up.
That is not good enough. If your fibre box stays powered and the fault is further upstream, the cable between the router and the box is still live, the link light is still on, and as far as the router is concerned everything is fine. Meanwhile nothing is reaching the internet.
- Use a ping or health check, not just link state. Every platform above supports this. It is the difference between testing the cable and testing the internet.
- Do not point it at your own provider's gateway. It is the nearest thing that answers, so it keeps answering during exactly the faults you care about.
- Pick two targets well beyond your provider, such as two different public DNS resolvers run by different companies. One target means one outage at that target triggers a pointless failover.
- Tune how many failures count. Too sensitive and the line flaps on a brief blip. Too relaxed and you are offline for several minutes before the backup moves.
What breaks during the switch
Failover is not seamless and nobody should sell it as such. Your public address changes, because you are now on somebody else's network.
| What | What happens |
|---|---|
| Calls in progress | Usually drop. New calls connect on the backup within seconds. If calls matter, see the note on phones below. |
| VPN tunnels | Drop and re-establish, generally without anyone doing anything, though some site to site tunnels pinned to a fixed address will not come back on their own. |
| Inbound access | Stops. Anything reached from outside on your fixed address, including remote access to CCTV and some card systems, will not be reachable on the mobile connection. |
| Anything expecting a fixed IP | Breaks for the duration. Mobile connections are usually behind carrier grade NAT, so you do not get a public address at all unless you have specifically bought a fixed IP SIM. |
| Browsing, email, cloud apps, card payments | Carry on. This is the majority of what most businesses actually need, which is why failover is worth having. |
Failing back without flapping
When the main line returns, you want the router to move back, but not the instant the line twitches. A line that is recovering often comes up, drops again and comes back, and a router that follows it exactly will drag everyone through several outages instead of one.
Where the platform allows it, set a hold timer so the primary has to stay healthy for a period before traffic moves back. A couple of minutes is usually plenty. Where there is no timer, make the detection slightly less sensitive on failback than on failover.
Keeping the data bill sane
- Size for a full outage. Think in days, not hours. A serious fibre fault can take several working days.
- Make sure it is actually standing by. If the backup is configured as load balancing rather than failover, it is carrying traffic all day, every day, and the first you will know is the bill.
- Watch for backups and updates. Cloud backup and large updates do not know they are on a metered connection and will happily consume the allowance during an outage.
- Set an alert. Knowing on day one that the backup has been running for sixteen hours is worth more than finding out at the end of the month.
Testing it properly
- Unplug the WAN cable, do not power off the router. Powering the router off tests nothing, because the thing that performs the failover is the thing you just turned off.
- Time it. Note how long until traffic flows again. That number is what you should be planning around.
- Test what matters, not just a web page. Make a call, take a card payment, open the system people actually use.
- Plug it back in and time the failback. Confirm it moves back, and that it does not sit on the mobile connection quietly costing money.
- Do it again in six months. SIMs expire, allowances change and firmware updates reset settings. An untested backup is a guess.
Not sure your backup would actually take over?
We can check how yours is configured, test it properly and tell you what would really happen on the day. If it turns out the backup was never going to work, better to find out now.