Share load across two uplinks — Wheelhouse documentation

You will end up with new connections shared between two uplinks by weight, and an uplink taken out of use when its tests fail.

It balances connections, not packets. One download uses one uplink. Two 100 Mbit/s uplinks do not make one 200 Mbit/s connection; they make two people's downloads independent.

Before you start#

The operator role and a licence.
Two uplinks already working, each with an address and a route out. If you have not got that far, A second uplink with health-checked failover first.
A test target for each uplink: an address on the internet that answers ping.

Step 1 — Add a rule#

Network → High availability → Uplinks, Load balancing → Add rule.

Arriving on: the interface the traffic comes in on, usually your LAN, or any interface.
Uplinks: tick each uplink and give it a weight. New connections are shared in proportion: weights of 2 and 1 send two in three connections through the first. An uplink with no load-balancing test yet gets one against the target you give beside it.
Move connections off a failed uplink: on unless you have a reason.
Traffic: leave empty to balance everything arriving on the interface, or narrow it by protocol, address and port.

Step 2 — Decide about source NAT#

Load balancing masquerades behind each uplink itself unless told not to. If you already have source NAT for each uplink that you want to keep, open Settings and turn on Keep my own source NAT — two sets of rules eventually disagree. See Masquerade behind each uplink.

Step 3 — The other settings#

In Settings:

Setting	Does
Sticky inbound connections	Replies leave through the uplink the connection arrived on
Balance the router's own traffic	Off by default: only traffic passing through is balanced
Move connections when an uplink fails	Existing connections are cleared, so they reconnect through a working uplink straight away
Default-route traffic only	Traffic with a more specific route is not balanced

Step 4 — Apply with auto-revert#

Balancing decides which uplink your own session leaves by, so apply it from the Commit Bar with Apply with auto-revert, and confirm once the page answers again.

Check it worked#

The tiles now say Load balanced, or Failover and load balancing if some uplinks also have health checks — a supported combination. Each member's Health check column shows load balancing's own verdict.

Connections actually spread. From two clients, look up your public address on a what-is-my-address site a few times each: over enough attempts you see both uplinks' addresses, in the ratio of the weights. One address every time means the rule is not matching — check Arriving on — or an exception rule is taking the traffic first.

Then fail an uplink and confirm traffic keeps flowing, as in the failover guide.

Things that will bite#

Anything that authenticates by source address breaks — banks, some VPN endpoints, some APIs. Give them a rule with Leave this traffic out of load balancing, matching their address, so they follow the main routing table.

A resumed TLS session can fail across uplinks. Sticky inbound connections helps inbound; outbound, a client that opens a new connection may leave by the other uplink.

Undoing it#

Delete the rules one by one, or Settings → Remove load balancing to take all of it away; deleting the last rule does the same. The uplinks' own priorities then decide which carries traffic — the Uplinks tab shows which one wins.

Share load across two uplinks#