Configure UniFi backup internet and failover

Outcome and equipment

Keep a primary internet service preferred and use a secondary service during an outage. This example connects an Ethernet-output 4G or 5G router to a supported secondary WAN port. You need a gateway with the required WAN capability, an active cellular service, a wired test computer and a permitted outage window. Check the exact gateway, cellular hardware and regional service compatibility before choosing equipment.

For the example, the cellular router's LAN is 192.168.200.0/24 and supplies an address to UniFi WAN2. It must not overlap Main 192.168.10.0/24 or other internal networks. This arrangement can involve upstream NAT. It can provide outbound backup access without guaranteeing inbound access to a service hosted at the site.

Procedure

  1. Test the backup router independently. Connect the test computer directly, confirm internet access, measure its usable speed and check mobile reception in the intended location. Record the service's data allowance and the applications that must work during an outage. Avoid making the backup test depend on the same failed primary connection.
  2. Back up UniFi and record the existing WAN port assignments, ISP settings and any policy routes. Keep an administrator computer on the local LAN. Confirm which physical port can act as the secondary WAN without removing the only LAN connection.
  3. Connect the backup router to that port. In Settings and Internet, assign the port its WAN role if required. Configure the connection to match the backup router, usually DHCP for this example. Do not copy the primary provider's PPPoE credentials or WAN VLAN tag onto a connection that does not require them. [1]
  4. Configure the primary connection as the preferred WAN and the cellular connection as standby using the installed interface's failover ordering. Do not select an active load-balancing split if the aim is to keep cellular traffic idle until needed. Review any policy-based routes that explicitly force clients through one WAN. [1] [2]
  5. Start with the automatic WAN health policy. A live Ethernet link does not establish that the provider can reach the internet. If a specialised environment requires custom verification, choose appropriate independent targets and sensible thresholds; do not treat a failure of one unrelated server as proof that every internet service is unavailable. [1]
  6. Establish a baseline with the primary WAN working. Browse two sites, run a name lookup and start a representative call or remote session. Record the active WAN and the public address observed by your own chosen IP-checking method. Keep a continuous connectivity test running if useful, but assess application behaviour as well.
  7. Disconnect only the primary WAN cable from the UniFi gateway. Record the time, watch the WAN status and try a new website connection. Verify that the backup WAN carries traffic. Note whether the existing call or session recovers, reconnects or fails. Do not describe ordinary WAN failover as a guarantee that every established session survives a change of public address.
  8. Reconnect the primary WAN and observe recovery. Repeat the application tests and record the return to the preferred connection. Then, if practical on a test installation, simulate an upstream internet failure while keeping the Ethernet link active. This tests health detection, which differs from detecting an unplugged cable.
  9. Review data usage and the applications that consumed it. Decide whether guest access, large downloads or off-site backups should be limited during a cellular outage. If a policy route is involved, inspect its kill-switch behaviour: the chosen setting determines whether matched traffic may use another available route when its preferred interface fails. [2]

Alternative using UniFi cellular backup hardware

Supported UniFi cellular devices can provide a LAN-connected backup workflow: connect and power the device as specified, adopt it and choose which networks may use cellular backup. Standard WAN mode is a different configuration and is supported only by the applicable models. Follow the exact product's instructions instead of assuming every UniFi cellular device connects in the same way. [3]

Verification and troubleshooting

Maintain a four-row record: primary normal, primary cable disconnected, primary upstream unavailable, and primary restored. For each, record active WAN, internet browsing, DNS, call behaviour and elapsed interruption. These are measurements to collect on your own network, not promised recovery times.

If WAN2 never comes online, verify the backup router independently, then its cable, addressing and assigned port. If ordinary browsing fails only for certain clients, inspect policy routes and gateway rules. If a remote server becomes unreachable from outside, investigate the backup service's addressing and NAT separately from outbound connectivity.

To remove the exercise, restore the original routing policies and port role, disconnect the backup connection and repeat the primary baseline tests. Keep the working backup available until a failed production primary service has actually recovered.

Sources

Back to the series

Leave a comment

Please note, comments need to be approved before they are published.