Dual WAN Router with 4G/5G Failover: Setting Up Automatic Backup for a Business Site

Most business sites that bought a backup SIM never installed it. The dual WAN router has a second WAN port, the SIM sits in a drawer, and the first real outage is also the first test. Card payments stop, the phone system goes quiet and the team works from personal hotspots. A dual WAN router with 4G/5G failover switches automatically within tens of seconds, once the second connection is installed, configured and tested before the line goes down.

Most failover set-ups fail on details: a health check that watches the wrong thing, a backup that tries to carry a full cloud backup job, a failback that flips the connection back and forth every few minutes. This guide explains how dual WAN failover works, which hardware options exist, and how to set up automatic backup step by step so the switch happens when it matters. For the service behind it, see our copia de seguridad en internet solution.

What is a dual WAN router?

A dual WAN router is a router with two internet connections, usually a fixed line and a 4G or 5G mobile connection, that can switch traffic to the second connection when the first fails, spread traffic across both, or send specific traffic over a chosen connection.

Dual WAN is the practical form of internet failover for a single site. The concept of failover, what it protects and why a separate path matters, is covered in our article on 4G/5G failover explained. This article focuses on the router and the set-up.

Dual WAN modes: failover, load balancing and policy routing

For a site with a fixed line and a cellular backup, failover mode is the starting point. Load balancing across a metered 4G connection uses mobile data all day, which rarely makes sense for a backup. Policy routing is useful on top of failover, to decide what may use the backup while it is active.

Hardware options for 4G/5G failover

There are four common ways to add a cellular backup to a site:

• Router with a built-in 4G/5G modem. One device with a fibre or DSL WAN port and a SIM slot. Simple, and the most common choice for small and medium sites.
• Dual WAN router plus a separate 4G/5G router or outdoor unit. The mobile unit connects to the second WAN port over Ethernet. This allows the cellular unit to be placed where the signal is best, such as near a window or on the roof.
• Firewall with an LTE module or USB modem. Common in environments that already run a business firewall. Check that the vendor supports the module in failover mode.
• SD-WAN appliance. Handles multiple links with application-aware routing. Covered in its own section below.

A 4G failover router with external antenna connectors is worth the small extra cost. Server rooms and meter cupboards are often in basements or behind thick walls, where signal is weakest.

How failover detection works

The router has to decide that WAN1 is down. There are two ways to do that, and the difference matters.

Link detection only checks whether the cable or modem on WAN1 is connected. If the fibre modem is still powered but the provider’s network has failed, the link looks fine and the router never switches. This is the most common reason why a failover set-up does nothing during an outage.

Health checks test whether the internet is actually reachable through WAN1. The router sends pings or DNS queries to several external targets at a set interval. When a defined number of checks fail in a row, the router marks WAN1 as down and switches.

Good health check settings:

• At least two independent targets, for example two public DNS services, so one unreachable server cannot trigger a false failover.
• An interval of a few seconds and a failure threshold of three to five checks, so the switch happens within tens of seconds and a single lost packet is ignored.
• A failback delay. When WAN1 returns, wait several minutes of stable checks before switching back, to avoid flapping when a line is unstable.

What happens to traffic during a switch

A failover changes the path and the public IP address the site uses, and that has consequences:

• Existing sessions drop. VoIP calls in progress, video meetings and file transfers usually disconnect and need to reconnect. New calls work on the backup.
• VPN tunnels restart. Site-to-site tunnels re-establish over WAN2, provided the other side accepts the new address.
• Inbound services stop working if they depend on the fixed line’s public IP, for example remote access to a camera system or a server.
• Many mobile connections sit behind carrier-grade NAT, which blocks inbound connections entirely.

Both inbound problems are solved on the SIM side.

Fixed public IP on the backup SIM

A fixed public IP is a permanent, publicly routable address assigned to the SIM. It is the common solution for any site that has to stay reachable from outside during an outage.

Carrier-grade NAT (CGNAT) is the reason it matters. On a standard mobile subscription, the operator places many devices behind one shared address and blocks unsolicited incoming traffic, so a monitoring centre or remote engineer has nothing to connect to. A fixed public IP gives the site its own address, so camera systems, access control, alarm panels and router management stay reachable while the site runs on 4G or 5G. Register the backup SIM’s fixed IP in firewall rules or the monitoring platform next to the fixed line’s address, and inbound services keep working on either path.

VPN and private APN as additional layers

A dedicated VPN from the provider makes the backup connection part of the corporate network, so the same security rules apply on both paths. A private APN routes traffic through an encrypted tunnel to the organisation’s own infrastructure. Both combine well with a fixed public IP and are chosen per site.

Step-by-step: setting up a dual WAN router with 4G/5G failover

1. Measure the signal. Test 4G and 5G reception at the router’s position, and at a better position if needed. Plan an external antenna if the signal is weak.
2. Choose the backup SIM. Use a multi-network SIM that connects to the strongest available network, and make sure the backup runs on a different network from the fixed line’s provider, so a single operator outage cannot take down both paths. For critical sites, combine plans for extra redundancy, such as two SIMs on different networks. Add a fixed public IP if inbound services must keep working, and a VPN where the security policy requires it. A back-up SIM billed on actual usage keeps costs low while the line is healthy.
3. Install and configure WAN2. Insert the SIM, enter the APN settings from the provider, and confirm that WAN2 connects and passes traffic on its own.
4. Set the failover mode. WAN1 as primary, WAN2 as backup, in active/standby mode.
5. Configure health checks. At least two targets, a short interval, a failure threshold and a failback delay.
6. Set traffic rules for the backup. Keep payments, VoIP and business applications on the backup. Block or limit cloud backups, software updates and streaming while WAN2 is active.
7. Set up alerts. Let the router send a notification when it switches, and set data usage alerts on the SIM in the Plataforma de gestión de conectividad.
8. Test the failover. Unplug the fibre modem during working hours, confirm that the switch happens, check payments, calls and remote access via the fixed IP, then reconnect and confirm the failback.
9. Schedule regular tests. Repeat the test every quarter and after every router firmware update or line change.

Keeping data usage and cost under control

A healthy backup uses almost no data. The risk lies in what happens during a long outage, when every device on the site tries to use the mobile connection as if it were the fibre line. Cloud backup jobs, operating system updates and video streaming can consume more data in a few hours than the whole site needs for payments and calls in a month.

Three measures prevent that. Traffic rules on the router keep heavy background traffic off the backup. Data usage alerts warn when consumption rises during an outage. And a limit on the SIM stops usage at a set point. With Weconnect internet backup, the site pays for the backup subscription and for data only when it is actually used, and alerts and usage blocks are set per SIM.

Plans can also be combined for redundancy: a usage-based backup SIM paired with a second SIM on a different network, or with a high-volume SIM for longer outages. Organisations with many sites share one data pool across all backup SIMs, so a long outage at one location draws on the pool.

4G or 5G failover?

5G adds capacity and lower latency where coverage is available, which helps sites that need to keep video meetings and cloud applications running during an outage. 4G has wider coverage, especially indoors, and is sufficient for payments, VoIP and email. A router with a 5G modem that falls back to 4G covers both cases. Weconnect SIMs support 4G and 5G on networks where these are available, across 700+ networks in 195 countries with multiple operators per country. The same router and SIM can also serve as the primary connection at a site without a line yet, as described in our article on temporary internet.

Upload during an outage

During a failover the backup also carries outgoing traffic: video calls, cloud applications and, at many sites, cameras sending footage to a recorder. Weconnect profiles are built for upload. Speeds are symmetric, so a 100 Mbit link delivers 100 down and 100 up, where most consumer or shared mobile connections deliver something like 100 down and 10 up. Routing is fixed, the APN is dedicated and the uplink runs without shaping or a fair-use throttle, so what is provisioned on day one is what the site gets in month twelve.

Common mistakes

• Only link detection, no health checks, so the router never notices a provider outage.
• The backup SIM on the same operator as the fixed line, so a single operator outage takes down both paths.
• No fixed public IP on the backup, so remote access fails the moment the site switches.
• No failback delay, causing the connection to flip between WAN1 and WAN2.
• No traffic rules, so a backup job consumes the data plan in the first hour.
• Router and fibre modem on the same power socket without a UPS, so a short power cut takes down both.
• Never tested, so the first real outage is also the first test.

When to move to SD-WAN

A dual WAN router works well for a single site with one line and one backup. Organisations with many sites, several connections per site or a need for application-aware routing often move to SD-WAN, where a central controller manages all links and policies. How 4G and 5G fit into that model is covered in our article on SD-WAN with 4G/5G failover. For retail chains and branch networks, see our article on always-on connectivity for branch offices. For branch networks across several countries, Weconnect SIMs and eSIMs support permanent roaming by default, as part of how the service is designed and contracted.

Preguntas frecuentes

What is a dual WAN router?

A dual WAN router is a router with two internet connections, usually a fixed line and a 4G or 5G connection. It can switch traffic to the second connection when the first fails, spread traffic across both, or route specific traffic over a chosen connection.

How does 4G failover work on a router?

The router checks whether the internet is reachable through the fixed line by sending pings or DNS queries to external targets. When several checks fail in a row, it switches traffic to the 4G connection, and switches back after the fixed line has been stable for a set period.

How fast does a dual WAN router switch to 4G?

With health checks every few seconds and a threshold of three to five failed checks, the switch typically happens within tens of seconds. Calls and sessions that were active at the moment of the switch usually need to reconnect.

Do I need a special SIM for a 4G failover router?

A multi-network SIM designed for backup use is the best choice, because it connects to the strongest available network and is billed on actual usage. Add a fixed public IP if cameras or remote management must stay reachable during a failover.

Is 5G failover better than 4G failover?

5G offers more capacity and lower latency where it is available, which helps with video calls and cloud applications during an outage. 4G has wider coverage and is enough for payments, VoIP and email. A 5G router that falls back to 4G covers both.

How much data does a failover connection use?

Almost none while the fixed line works. During an outage, usage depends on what the site runs over the backup. Traffic rules that block cloud backups, updates and streaming, combined with usage alerts, keep consumption predictable.

Próximos pasos

Weconnect provides 4G and 5G backup SIMs with multi-network access, fixed public IP and VPN options, and usage-based pricing, managed from one platform. Whether you protect one office or a network of sites, we help you set up failover that switches when the line goes down. More on our approach is on our page for copia de seguridad en internet. Challenge us with your connectivity requirements. Respuesta directa dentro de 4 horas hábiles.