Dual-WAN failover for a small office in Pakistan

Nobody buys a second internet connection because their first one is slow. They buy it because a contractor cut a fibre two streets away and fourteen people sat doing nothing until the evening.

That is the honest case for dual-WAN. It is not a speed upgrade. It is the difference between an outage being an inconvenience and an outage being a day.

The problem is not bandwidth, it is the single line

Almost every small office in Faisalabad runs on one connection. Fibre from a local provider, or DSL over copper, or in some buildings a 4G router because nothing else reaches.

Each of those fails in its own way, and none of them fail rarely:

• Fibre gets cut. Roadworks, a building site, someone hanging a sign. When it is cut, you are down until a splice team gets there, and that is hours, not minutes.
• Copper degrades and drops in the wet, and the fault is often somewhere in the street rather than in your office, which makes it slow to fix.
• 4G congests. It rarely goes fully dark, but it can slow to the point where calls break up in the evening.

The useful insight is that these failure modes are mostly independent. A digger that cuts fibre does not affect the mobile network. That independence is what you are actually buying, and it is why the second link should be a different technology and ideally a different provider, not a second fibre from the same company down the same duct.

What a dual-WAN router actually does

A dual-WAN router has two internet-facing ports and a rule about how to use them. Two modes matter.

Failover. One link is primary, the other sits idle. The router watches the primary, usually by pinging something out on the internet every few seconds. When the pings stop, it switches all traffic to the backup. When the primary comes back, it switches back. Simple, predictable, and what most offices should choose.

Load balancing. Both links carry traffic at once, with new connections distributed between them by some ratio. You get more total throughput, and you still get failover if one dies. The catch is that different connections leave by different paths, so your public IP changes depending on which link a session took. Anything that pins to an IP address, some banking portals, some VPNs, some government sites, will complain. Most routers let you pin specific traffic to one WAN to work around this.

Our default advice for a small office: run failover, not load balancing, unless you have a specific bandwidth reason. It behaves the same way every day, and predictable is worth more than clever when something breaks at 3 p.m.

What failover feels like when it happens

This is the part sales pages skip, so be clear about it with your staff.

Failover is not seamless. When the router switches links, your public IP address changes, and every connection that was already open dies with the old link.

For ordinary browsing, nobody notices much. The page you were loading fails, you press refresh, it works.

For VoIP, the call in progress drops. Detection plus switchover typically takes somewhere between five and thirty seconds depending on how aggressively you set the health check, and your phones then need to re-register with the PBX or the provider, which takes a few more seconds. So a call cuts off and you ring back. That is a much better outcome than an hour with no phones, but it is not invisible, and staff should know to just redial rather than assume the system is broken.

For CCTV remote viewing, the same. Your app loses the stream and reconnects. If you view cameras from outside using a dynamic DNS name, the DNS record has to catch up with the new IP first, which adds anywhere from under a minute to several minutes depending on the record’s TTL. Recording to the NVR carries on regardless, because that never touched the internet. Only the remote view is affected.

Two things worth knowing: some routers can run VoIP-friendly failover where SIP traffic is pinned to the more reliable link, and if remote camera access matters to you, a P2P or cloud-relay NVR handles an IP change more gracefully than a dynamic DNS setup does.

Mixing fibre with a 4G backup

For most small offices, the practical pairing is fibre as primary and 4G/LTE as backup.

You have two ways to attach the 4G. A router with a built-in SIM slot is neater and there is one less box to power. A separate 4G router or dongle plugged into the second WAN port is more flexible, easier to replace, and lets you put the 4G unit near a window where the signal is better. If your office is deep inside a concrete building, that flexibility matters more than the tidiness.

Two practical points. First, put the backup SIM on a data package that stays active. A SIM that has been idle for months is often a SIM that has stopped working, and you find out on the day you need it. Second, test the failover deliberately, once a quarter, by unplugging the primary WAN during working hours. An untested backup is a guess.

What to look for when buying

• Two real WAN ports, or one WAN plus a port that can be reassigned as WAN. Many routers advertise dual-WAN but only in software on a fixed port pair, which is fine, just confirm it before ordering.
• Throughput at your price point. A router’s quoted throughput usually assumes plain routing with nothing switched on. Turn on deep inspection, filtering or VPN and the real figure can be a fraction of that. If you are buying 200 Mbps of fibre, buy a router comfortably above 200 Mbps of routed throughput, not exactly at it.
• VPN, if you have branches. IPsec site-to-site for linking offices, something like OpenVPN or WireGuard for staff working from home. Check whether the VPN survives a WAN failover: many implementations will re-establish on the backup link within a minute, but only if the far end is reachable by name rather than by a fixed IP.
• Health-check configuration. You want to choose what the router pings and how often. A router that only checks whether the physical port has link will not notice that your fibre is up but your provider’s upstream is dead, which is a common failure.
• A serviceable box. Fanless, sensible operating temperature, and on the same UPS as your switch. A dual-WAN router that reboots during load-shedding has defeated its own purpose.

Worked example: a 15-person office

Fifteen staff, cloud accounting, a shared drive, a small IP-PBX with eight handsets, and four cameras that management look at from their phones.

• Primary: fibre from whichever provider actually serves the building well. Ask neighbouring offices in the same plaza rather than the salesman.
• Backup: a 4G router on a different network’s SIM, positioned near a window, feeding WAN2.
• Router: a small business dual-WAN unit set to failover, health check pinging two public addresses rather than one, so a single unreachable target does not trigger a pointless switchover.
• SIP traffic pinned to the fibre while it is up, so calls only move when they have to.
• Everything, router and switch and PBX, on one UPS.

The result: a fibre cut turns into a dropped call and a slower afternoon instead of a stopped office. Fifteen people cannot work at full 4G speed, so nobody should promise that. What they can do is keep taking calls, keep answering email, and keep the accounts system open.

Tell us on WhatsApp what your current connection is and roughly how many people depend on it, and we will tell you which router fits.