A second uplink with health-checked failover#
You will end up with two internet connections, one carrying traffic and one waiting, and the router moving traffic to the second when the first stops working beyond the modem. That last part is the difference between this and merely having two default routes.
Before you start#
- The operator role and a licence.
- A second connection, on its own interface or VLAN, already connected.
- Health-check targets: two or three addresses on the internet for each uplink that answer ping and that you are happy to ping every ten seconds, indefinitely — public resolvers are the usual choice. All traffic to a target goes through its own uplink (step 2 says why), so no address can serve two uplinks, and none may be something your network depends on — above all, not the DNS servers your router forwards queries to.
The three arrangements#
The Uplinks tile names the one you are in.
Ranked, no health checks — a cold standby. The uplink with the lowest priority carries traffic, and the router falls back only when that interface itself goes down: blind to a provider that is up at the modem and dead beyond it. Two uplinks with the same priority share traffic instead of failing over, and the page says so.
Failover with health checks — this guide. Each uplink's default route is installed while its targets answer through that uplink, and withdrawn when they stop; among the installed ones, the lowest priority wins.
Load balanced — new connections shared between uplinks by weight. See Share load across two uplinks.
Step 1 — Add the second uplink#
Network → High availability → Uplinks → Add uplink. Choose the interface, how it gets its address, and leave Source NAT on Masquerade. The priority the form suggests puts the new uplink behind the ones you have. Add health-check targets here, or in the next step; each gets a route through the new uplink.
Step 2 — Give the first uplink a health check too#
An uplink without a health check is never taken out of use, so there is nothing to fail over from. The page's notices name any uplink in that state.
Click the first uplink, switch Health check on, and add targets other than the backup's: the editor refuses a target another uplink already uses. The defaults — a ping every ten seconds, passing while any target answers — suit an internet connection. Its Priority now orders it among the health-checked uplinks: give the primary the lower number.
Step 3 — Apply with auto-revert#
These changes decide which way your own session with the router leaves. Apply them from the Commit Bar with Apply with auto-revert, and confirm once the page answers again.
Check it worked#
The Uplinks tab shows each uplink's status and health: the primary Carrying traffic and Passing, the backup Standby and Passing. The Measured column shows the agent's own round trip and loss to each, from the router.
Then break it on purpose. Unplug the primary's cable, or shut its switch port. Within the check interval the primary turns Failing and the backup takes over; put the cable back and the primary wins back on its lower priority. That return is what the target routes are for: if the primary stays Failing, click it — a target listed under Target routes as No route is the reason, and Add target routes in its Health check section is the fix.
What the router does not tell you#
The Passing and Failing verdicts are the router's own: whether its health-checked route is installed right now, which is exactly what decides where packets go. This platform keeps no history of the checks, so the agent's own measurements are shown beside the verdict as the evidence.
What else needs to know about the second uplink#
- Source NAT. Each uplink needs its own; see Masquerade behind each uplink.
- The firewall. A second internet interface needs the same input policy as the first. That is the Firewall page's job; A default-drop ruleset is the guide.
- Port forwards. A forward names the interface it arrives on: a service published on the primary is not published on the backup unless you add a second forward. See Publish a service.
Undoing it#
Click the uplink and Stop using as uplink: it removes the uplink's default route, its health check with its targets' routes, and its place in load balancing, and leaves the interface itself alone. Its source NAT stays until you set it to None.