Failover vs Load Balancing vs Bonding for 5G and Starlink

Adding a second WAN link does not automatically deliver uninterrupted internet. A remote site may have fiber plus 5G, Starlink plus 5G, or two cellular operators and still lose active sessions, keep routing through a dead upstream path, or become unreachable after its public IP changes.

The design starts with one question: what must survive a WAN failure? If new connections only need a working backup path, use failover. If many users or devices should share traffic across available links, use load balancing. If one connection must use multiple links or retain a stable tunnel endpoint while an underlay changes, evaluate bonding or an overlay tunnel.

These mechanisms solve different problems. Choosing the wrong one creates cost and complexity without delivering the uptime the application actually needs.

Key Takeaways

Failover moves traffic to a backup WAN after the primary path is declared unhealthy, but existing sessions commonly break when the source IP, NAT state, or route changes. Load balancing distributes different sessions across multiple WANs and can increase total site capacity, but it normally does not combine links for one ordinary TCP flow. Bonding or multipath overlays coordinate traffic across multiple links through compatible endpoints and may provide single-flow aggregation or better session continuity, although they also add an aggregation endpoint, encapsulation overhead, cost, and operational complexity. A link marked “up” can still have no usable internet, so health checks must detect upstream blackholes, DNS failures, and cellular registration without a working data plane. An ISP-assigned static IP also usually belongs to that ISP path and does not automatically move to a 5G or Starlink backup.

Define the Availability Goal Before Choosing the Technology

“No downtime” is not a testable requirement until it is translated into recovery time, session-loss tolerance, public-IP behavior, minimum bandwidth, and budget. Failover is normally enough when new connections only need to recover after the primary path fails. Load balancing fits sites where many clients should share several links. Bonding, MPTCP, or an overlay tunnel becomes relevant when one connection must use multiple paths or retain a stable endpoint and better continuity as the underlay changes.

Path diversity must also be judged by real failure domains. Two nominally separate WANs may still share a tower, conduit, power supply, or DNS dependency, so interface count alone is not a resilience design. The application’s ability to reconnect and the business impact of interruption should drive the architecture.

How Multi-WAN Failover Works

In a typical priority design, the router sends traffic through WAN 1 and monitors the path. After enough consecutive failures, WAN 1 is removed from service and new traffic uses WAN 2; the router may fail back after the primary remains healthy for a defined period. This is a practical design for remote monitoring, branch connectivity, and cellular backup, but automatic switching is not necessarily seamless.

A TCP connection is identified by endpoint addresses, ports, and protocol state; for connectionless UDP, routers and firewalls still maintain flow and NAT mappings based on addresses, ports, and protocol. If a WAN change alters the public source address or invalidates that state, existing communication often needs to reconnect, and a port forward or public address on the primary ISP does not automatically exist on the backup carrier. Failover therefore restores service for reconnecting applications more readily than it preserves every active session.

How Load Balancing Differs

Load balancing keeps multiple WANs active and assigns new sessions according to capacity, source device, application, destination, latency, or current utilization. It can let different clients use Starlink, 5G, and wired links at the same time, increasing total site capacity, but one ordinary TCP flow normally remains on its selected WAN rather than adding the advertised rates of two links.

A stable policy preserves the egress path for each session, avoiding source-IP changes, packet reordering, and invalid NAT state. Load balancing is therefore well suited to many users, cameras, devices, and cloud connections sharing capacity; a single session that must span paths or aggregate throughput requires a different multipath architecture.

What Bonding Actually Adds

Bonding coordinates multiple paths and reassembles traffic at a compatible endpoint. Multipath TCP (MPTCP) allows an MPTCP-capable TCP connection to use multiple subflows while presenting one reliable byte stream to the application. Transparent site-wide aggregation for ordinary endpoints usually still requires compatible proxies or tunnel endpoints at both sides. Other designs may encapsulate traffic into tunnels that terminate at a cloud service, VPS, data center, or second appliance.

Under suitable traffic and path conditions, this architecture may improve single-flow throughput, provide a stable public IP at the aggregation endpoint, and improve continuity when an underlay path fails. Actual gains depend on latency, jitter, loss, and congestion control across links such as 5G and Starlink. Endpoint cost, encapsulation overhead, processing capacity, and the aggregation service’s own failure domain should be justified by a measurable business requirement.

Health Checks Decide Whether Failover Works

Ethernet carrier state or cellular registration proves only that a local interface or radio attachment exists; it does not prove that the business endpoint is reachable. A reliable health policy should cover interface state, the next-hop gateway, multiple independent internet targets, DNS resolution, and the actual cloud, VPN, API, or monitoring endpoint. Relying on one ICMP target can miss DNS and application-specific failures.

Check interval, timeout, consecutive failures before switchover, consecutive successes before failback, and hold-down time must be tuned together. Aggressive thresholds can cause flapping on variable 5G or satellite links, while slow thresholds extend the outage, so final values should come from measurements on the deployed paths.

Static IPs, NAT, and CGNAT During Failover

A static address on a wired business circuit is normally routed by that provider and usually cannot follow traffic that exits through another carrier. For web, telemetry, and cloud clients that use names, credentials, or outbound connections, the simplest design is to let the application reconnect from the new address. Dynamic DNS can update a hostname, but it does not preserve an existing session and remains subject to caching and update delay.

For most branch and industrial deployments, the practical way to maintain stable egress or inbound reachability across ISPs is an outbound VPN or overlay tunnel to a fixed data-center, cloud, or control-center hub. Both WANs can carry the logical access path, although continuity still depends on the VPN, overlay, and application. Provider-independent address space with BGP is an advanced alternative with higher cost and operational requirements. Cellular and satellite services may also use CGNAT, so confirm the APN, address type, and inbound requirement, then validate tunnel establishment, address changes, and reconnection on the target network.

Four Failure-Injection Tests Every Multi-WAN Site Should Run

A successful speed test does not validate failover. The following is a validation plan to run in the target environment, not a performance result for any particular router model. The first test group should cover physical link loss and an upstream blackhole. During a maintenance window, disconnect the WAN cable, disable the port, or power off the upstream modem to verify interface detection, route change, and alarms. Then keep the Ethernet link up while blocking upstream traffic with a controlled rule to confirm that the router does not confuse local link state with end-to-end availability.

The second group should cover DNS and the cellular data plane. Block the primary resolver while preserving IP connectivity to validate the alternate resolution path. Then create a controlled APN, data-session, or post-modem failure while cellular registration remains visible, confirming that the router changes path based on end-to-end reachability and records the cause. Test failback as well, and record new-session recovery, existing-session reconnection, public-IP changes, inbound access, alarm accuracy, and return-path stability. All timing and performance results should remain scoped to the tested router, firmware, carrier, antenna, and application environment.

Choosing a Wavetel Router for the Deployment

The router should match the WAN architecture and field equipment, not just peak 5G speed. According to the current official product pages, WR575, WR578, and WR677-D cover industrial 5G, VPN, field interfaces, and device-management requirements; the main selection criteria are link design, port mix, and power delivery. The WR575 provides four GE ports, dual SIM, and Ethernet/cellular WAN failover for general 5G gateway and wired/cellular backup deployments. The WR578 provides four 802.3af/at-compliant PoE-PSE Gigabit ports, and its official page lists both WAN failover and load balancing, making it a fit for cameras, access points, or sensors that need direct power.

The WR677-D fits sites that need two simultaneously active 5G modems, greater port density, or fiber integration. Its current official page lists dual 5G modems in active-active mode, WAN failover, load balancing, one 2.5GE port, four GE ports, and one SFP. The exact policy, switchover time, and session behavior should still be confirmed against the relevant firmware, datasheet, and project test. Projects that also require single-flow aggregation, a stable overlay egress IP, or cross-path session continuity can pair the multi-WAN access layer with a validated SD-WAN, MPTCP, or tunnel-aggregation design.

Before ordering, use the current product portfolio and documentation to verify regional bands, SIM and operator diversity, firmware features, VPN throughput, Ethernet and SFP roles, input power, PoE budget, antenna placement, environmental rating, and remote-management requirements.

Select the Simplest Architecture That Meets the Requirement

Choose failover when applications can reconnect and the goal is to restore general connectivity. Choose load balancing when many sessions should share capacity across links. Evaluate bonding or an overlay tunnel only when the project has a defined requirement for single-flow throughput, a stable egress endpoint, or better session continuity. After selecting the mechanism, test failover and failback with the real applications and monitor both WAN state and business-endpoint reachability.

For sites that need industrial 5G, dual-SIM or dual-modem options, Ethernet/cellular failover, VPN, and remote management and monitoring, compare Wavetel’s industrial router portfolio, WR575, WR578, and WR677-D according to primary and backup WAN types, field devices, PoE, port count, operator diversity, recovery-time targets, and session-continuity requirements.

FAQ

Does dual WAN mean zero downtime? 

No. Dual WAN provides another path, but detection time, route change, NAT state, public-IP changes, and application retry behavior determine the interruption. Existing sessions may reset even when new sessions recover quickly.

Can Starlink and 5G be bonded? 

Yes, with a compatible multipath architecture and a remote aggregation endpoint. The design must account for different latency, jitter, packet loss, data cost, and available capacity on the two paths.

Will a static IP remain the same after failover to 5G? 

Usually not if the primary ISP assigned the address. Most sites use an outbound VPN or overlay to a fixed hub for a stable logical access path, while session continuity still requires validation.

Why can a SIM show registered while the internet is down? 

Registration confirms attachment to the mobile network, not successful end-to-end data delivery. APN, authentication, routing, DNS, quota, or upstream faults can still block traffic.

How should I choose between WR575, WR578, and WR677-D? 

Evaluate WR575 for general industrial 5G and dual-SIM operator redundancy, WR578 when cameras, access points, or sensors need direct PoE, and WR677-D when the site needs two simultaneously active 5G modems, 2.5GE, or SFP. Confirm regional bands, firmware, power, and field behavior before final selection.