Internet uplinks and failover¶
Where: Connectivity > Interfaces & network > Internet tab.
This tab decides which interfaces reach the internet, and in what order they take over. The gateway uses one uplink at a time: the lowest-numbered uplink with a live link carries all traffic, and the others stay configured but idle. A metered 4G or 5G backup costs nothing while the main link is up.
Declaring uplinks¶
Give each candidate interface a Role:
| Role | Meaning |
|---|---|
| Not an uplink | Never carries internet traffic |
| Primary | Carries traffic whenever its link is live |
| Backup 1, Backup 2, … | Takes over, in order, when everything above it is down |
In the interface list, uplinks are tagged WAN, WAN 2, … and a cellular uplink also shows 4G.
With a single internet connection you do not need to declare anything: the gateway uses whichever interface holds a default route.
The tab refuses a configuration when:
- two uplinks share a priority;
- an uplink has a fixed address and no gateway, so it can never obtain a default route (use DHCP, or set a gateway address);
- a cellular uplink has no APN, or both sets an APN and asks to read one from the module.
A port with no address must be given one before it can be an uplink.
Applying restarts DHCP on the affected ports
Traffic on those ports drops briefly while the lease is renewed. On the uplink currently carrying traffic, that is a short outage for everyone behind the gateway.
Reading the current state¶
The header says which uplink is carrying traffic, or No uplink has a live link. Each uplink shows a state:
| State | Meaning |
|---|---|
| carrying | The default route leaves through this interface |
| standby | Usable and probed, no default route — ready to take over |
| down | The device's own probe has marked it unusable |
If a backup is down, the tab warns that traffic will not move to it when the main link fails.
When the gateway does not report which uplink is carrying, the tab infers it from link state and says so. Update the agent to get the device's own answer.
Reliability¶
When an uplink has been unstable, the tab says so in one sentence, for example WAN dropped 4 times in the last 24 hours — typically 2 min each, longest 6 min, or that it went down at a given time and has not come back.
How failover works¶
Failover runs on the device. Every uplink except the one in use is told to ignore the default route its provider offers, so only one default route is installed at a time. The device probes each uplink rather than trusting the cable, so a provider that hands out a lease but drops traffic is detected.
Because the decision is local, a switch takes seconds and does not depend on the platform. The device moves the default route, DNS and outbound NAT together. For NAT to follow, rules must be written against the egress group rather than a specific port — see Outbound NAT.
Testing a backup¶
Unplug the main uplink and test from a client behind the gateway, not from the gateway itself. The gateway's own traffic always takes the new uplink, so it looks healthy even when the networks behind it have lost the internet.
Seeing a switch afterwards¶
Failovers appear in History as Internet uplink switched, e.g. Switched to WAN 2 — WAN stopped answering. The device records them locally and sends them with its next report, so a failover that happened while the gateway was cut off from the platform still appears.