Backup WAN: Useful, but Not a Second Network

What it is for

The backup-WAN design adds a mobile connectivity path for a primary broadband outage without pretending it is a second home network.

How it fits in

The router remains the gateway, DHCP and Wi-Fi authority. A dedicated virtual-machine component, mobile modem and secondary network interface provide the alternate uplink path. Routing policy prefers the primary connection and can select the backup path when tracking identifies a primary failure.

That boundary matters. The backup path is not a replacement router and cannot provide the whole home-network service set if the primary router itself has failed.

What needs checking in an outage

The documented recovery process separates diagnosing a primary-WAN fault from forcing a failover. It calls for checking the router policy, the virtual-machine component and the attached mobile hardware, then verifying real outbound connectivity only when appropriate. Hardware enumeration and mobile-network edge cases are treated as risks, not assumed successes.

What the live test proved

On 16 September 2026 I ran a live fibre → mobile backup → fibre failover/failback cycle. It completed automatically with no manual intervention. Continuous IPv4 ping lost 2 packets across the full cycle, while continuous DNS lookups recorded 0 failures. There was a brief transition delay of roughly 3–4 seconds, but name resolution still completed successfully.

The Proxmox host stayed online throughout the test, so this proves the WAN transition path rather than every possible outage combination. A separate Proxmox/AdGuard outage and client DNS-fallback test is still outstanding. Mobile IPv6 and inbound public access are also outside the scope of this validation.

The point

Resilience is more than a second link. It is a clear ownership model, a recovery procedure that avoids making an outage worse, and actually exercising the failure path instead of assuming the configuration will work when it matters.