Multi-WAN failover, explained
A second internet line only helps if it is set up correctly. Here is what actually makes failover work.
Adding a second internet connection sounds like an obvious way to avoid downtime. It is, but only if the firewall actually knows how to use it. A second line that just sits there is not protecting anything.
What multi-WAN actually means
WAN is the connection out to the internet. Multi-WAN means a firewall with more than one of these connections at once, usually from two different providers, so one provider having an outage does not take your whole business offline.
Having two lines plugged in is the easy part. Making the firewall react correctly when one of them fails is the part that actually matters.
Failover vs load balancing
These two get confused constantly, and they solve different problems.
Failover
Failover keeps a second line in reserve. Under normal conditions, all your traffic uses the main line. If it goes down, traffic switches to the backup line automatically, and switches back once the main line recovers.
Load balancing
Load balancing uses both lines at the same time, sharing the work between them. Nothing sits idle as a spare. This can mean more total bandwidth day to day, but it is a different goal from simply staying online when one line fails.
Why health checks matter more than the plug
A line can be physically connected and still be useless. The cable is fine, the modem's lights are on, but the provider's network beyond it has a fault. A firewall that only checks whether the cable is plugged in will not notice this and will keep sending traffic down a line that goes nowhere.
A proper health check actually tests the line, for example by regularly trying to reach a real address out on the internet and timing how long it takes to answer. If the line stops answering, or answers far too slowly, the firewall treats it as down, even though every light on the modem still looks normal.
- A cable being plugged in is not the same as the line actually working.
- Health checks test the line by using it, not by looking at it.
- Without real health checks, a failing line can sit "active" for hours before anyone notices.
What to actually look for in a second line
A second line from the same underlying network as your first defeats much of the purpose. If both connections run over the same cable into your building, or the same regional network, one fault can take both down together.
A genuinely useful backup line comes from a different provider, ideally arriving over different physical infrastructure, such as a fibre line backed up by a cellular connection. The two should be able to fail independently of each other, otherwise you have paid twice for one point of failure.
What actually breaks during a switchover
A switch from one line to another is not always invisible. A few things are worth knowing before you rely on it.
- Your public IP address usually changes to the backup line’s address, since it belongs to a different provider.
- A live video call or file transfer using that address can drop and need to reconnect.
- Anything depending on a fixed public address, like a port forward for a security camera, needs to be planned for the backup line too, not just the main one.
None of this means multi-WAN is not worth doing. It means the switchover is a real event with real effects, not a magic trick, and a firewall that handles it well will limit how many of these effects a user actually notices.
How Firecradle handles this
Firecradle runs continuous health checks on every WAN line, not just a check that the cable is plugged in, and switches to a backup line automatically when a check genuinely fails. It supports both failover and load balancing, so you can pick whichever matches what you are actually trying to achieve, or combine the two.