A second internet connection is only a useful backup when the important workflows actually work over it. OPNsense can manage multiple WAN paths. Whether an outage is bridged successfully also depends on DNS, addresses, sessions and the applications’ requirements.
Define the required behaviour first
Failover uses a backup path when the preferred connection fails or its quality becomes inadequate. Load balancing distributes connections according to defined rules. Neither automatically combines bandwidth for every individual download. Before configuration, establish which applications should use which connection.
The contracts also matter: does the backup have a data allowance? Is the mobile connection behind additional address translation? Which public address do remote systems or allowlists use? A working general internet session does not prove that inbound services and site-to-site tunnels can use the same backup path.
The gateway test must detect the relevant failure
The OPNsense documentation describes monitored gateways and gateway groups as building blocks. Cable link status alone does not detect every failure beyond the connection. The monitoring target must be reachable through the intended path and provide a meaningful indication of whether that path remains usable.
Choose and observe suitable thresholds and test targets. One poorly reachable remote host should not cause constant connection switching. Conversely, a provider’s router that still responds locally must not make an interrupted internet path appear healthy indefinitely. Monitoring is part of the operating concept.
DNS and connection states belong in the backup design
Gateway groups and suitable routing rules handle workstation traffic; traffic generated by the firewall itself and its name resolution must also be considered. DNS is therefore tested during an outage. A previously visited website may load from cache while new name lookups already fail.
Active sessions may disconnect when the public address changes. The OPNsense documentation covers state handling and sticky connections, among other topics. Such settings are not enabled indiscriminately: one application may need a stable outbound path, while another should deliberately reconnect after a failure.
Four tests demonstrate the benefit
The acceptance plan covers an actual primary-path outage, a failure beyond the still-connected provider router, new and already active application sessions, and the return to the primary connection. A planned test takes place in a suitable maintenance window with a reachable administration path.
Observe telephony, VPN, business applications, DNS and any limited mobile data allowance, for example. Record the measured interruptions instead of promising uninterrupted operation. DAXS combines connection selection, routing and application testing into a backup concept whose behaviour the business understands.
Communications and providers · Plan infrastructure · Discuss a backup connection
Sources: OPNsense: Multi-WAN, failover and load balancing (external link) · OPNsense: gateways and monitoring (external link)
