Every service, VPN endpoint, and remote access method covered throughout this series shares one unstated dependency: your home internet connection actually staying up. Multi-WAN failover removes that single point of failure, automatically switching to a secondary internet connection the moment your primary connection drops, keeping self-hosted services genuinely reachable even during an ISP outage.
Why This Matters More As Your Homelab Grows
A single-person hobby project going offline during an ISP outage is a minor inconvenience. A homelab that’s grown to include password management (Vaultwarden), photo backup (Immich), and services other household members actively depend on daily represents a truly different stakes level — exactly the kind of infrastructure where the pfSense/OPNsense router can add real redundancy through multi-WAN support.
What Multi-WAN Failover Actually Provides
Rather than a single internet connection being an absolute dependency, multi-WAN configuration connects two (or more) separate internet sources to your router, automatically detecting when the primary connection fails and rerouting traffic through the secondary connection until the primary recovers — ideally happening quickly enough that active connections barely notice the transition.
Common Secondary WAN Options
- A second wired ISP connection – really diverse infrastructure (different provider, ideally different physical entry point into your home) provides the strongest redundancy, though isn’t available or affordable everywhere
- 4G/5G cellular backup – a dedicated cellular modem or router, providing failover independent of wired infrastructure entirely, useful specifically because wired ISP outages (a damaged line, a local infrastructure failure) generally don’t affect cellular connectivity simultaneously
- Mobile phone tethering as a manual fallback – a lower-effort, non-automated option for occasional outages, though lacking the seamless automatic failover real multi-WAN configuration provides
Setting Up Multi-WAN in pfSense/OPNsense
Building on the router setup :
- Connect your secondary WAN source to an additional network interface on your router hardware.
- Configure the interface under Interfaces, assigning it as a second WAN connection with its own IP configuration (DHCP for most cellular/secondary ISP connections).
- Under System → Gateways, both WAN connections should now appear as available gateways.
Configuring Gateway Groups for Failover
- Go to System → Gateway Groups.
- Create a new group including both WAN gateways.
- Set your primary connection to Tier 1 and your secondary to Tier 2, meaning traffic prefers the primary connection but automatically falls back to Tier 2 if Tier 1 becomes unavailable.
- Configure the gateway monitoring settings (ping targets and thresholds) determining exactly how failure detection actually works.
Understanding Failure Detection
The router continuously monitors each WAN connection’s health, typically via periodic pings to reliable external targets (public DNS servers are common choices). Configure sensible thresholds — too aggressive triggers unnecessary failovers during brief, normal network hiccups; too conservative delays real failover longer than necessary during an actual outage.
Applying the Gateway Group to Firewall Rules
Rather than routing all traffic through a single default gateway, update your firewall rules to reference the gateway group instead of a single specific WAN, enabling the actual automatic failover behavior for traffic governed by those rules.
What Happens to Active Connections During Failover
Failover isn’t entirely seamless — active connections (an in-progress file transfer, an active SSH session) typically drop and need to reconnect once traffic shifts to the secondary gateway, since the external IP address itself changes with the WAN connection. This makes multi-WAN actually valuable for overall availability rather than a guarantee of zero interruption during the actual transition moment.
Considerations for Dynamic DNS
Since your public IP changes when failing over to a secondary WAN connection, ensure your Dynamic DNS setup () is configured to update promptly on both connections, so services relying on DDNS-resolved hostnames correctly follow the failover rather than continuing to point at your now-unreachable primary connection’s stale IP.
Load Balancing as an Alternative Configuration
Beyond pure failover, gateway groups can also be configured for real load balancing — actively splitting traffic across both WAN connections simultaneously rather than treating one purely as backup — though this adds complexity and generally makes more sense when both connections offer comparable performance rather than a fast primary and a slower cellular backup.
Is This Worth It for Your Home Lab?
Multi-WAN failover represents real additional cost (a second connection or cellular data plan) and configuration complexity, worth it specifically for homelabs hosting services others particularly depend on regularly, or where you personally rely on remote access reaching your homelab reliably even during your ISP’s inevitable occasional outages.
Final Thoughts
Setting up multi-WAN failover addresses the one dependency underlying literally every other guide in this series — your home internet connection itself staying up. For a homelab that’s grown to include truly relied-upon services, pairing the pfSense/OPNsense router setup with a properly configured secondary connection closes this remaining single point of failure, keeping your carefully built infrastructure actually reachable during the ISP outages that eventually happen to everyone.
Leave a Reply