RadiusNest › Guides

MikroTik failover with two internet lines

Last updated: 2 October 2026

Failover keeps you online by switching to a second internet line when the first fails, and back again when it returns. There is a simple way and a more reliable way.

Want it done for you? The free 2 WAN load balancing script generator builds this whole setup for your two ports - download the .rsc and paste it into Winbox.

Before you change a live router: take a backup (how) and turn on Safe Mode in Winbox, so a mistake that locks you out is undone by itself.

The simple way: check the gateway

/ip route add dst-address=0.0.0.0/0 gateway=192.168.1.1 distance=1 check-gateway=ping
/ip route add dst-address=0.0.0.0/0 gateway=192.168.2.1 distance=2

The router pings the first gateway and uses the second route when it stops answering. The weakness: if the gateway is your own modem, it keeps answering even when the internet behind it is down.

The reliable way: check a host on the internet

Here the router checks an address beyond the modem, reached only through line 1.

RouterOS v7:

/ip route add dst-address=1.1.1.1/32 gateway=192.168.1.1 scope=10 target-scope=10
/ip route add dst-address=0.0.0.0/0 gateway=1.1.1.1 distance=1 target-scope=11 check-gateway=ping
/ip route add dst-address=0.0.0.0/0 gateway=192.168.2.1 distance=2

RouterOS v6:

/ip route add dst-address=1.1.1.1/32 gateway=192.168.1.1 scope=10
/ip route add dst-address=0.0.0.0/0 gateway=1.1.1.1 distance=1 check-gateway=ping
/ip route add dst-address=0.0.0.0/0 gateway=192.168.2.1 distance=2

While 1.1.1.1 answers through line 1, line 1 is used. When it stops, the router switches to line 2 within about 20 seconds.

NAT on both lines

/ip firewall nat add chain=srcnat out-interface=ether1 action=masquerade
/ip firewall nat add chain=srcnat out-interface=ether2 action=masquerade

Test it

  1. Start a continuous ping to 8.8.8.8 from a computer.
  2. Unplug the cable between modem 1 and the internet (not between router and modem).
  3. The ping should pause briefly and resume through line 2.
/ip route print where dst-address=0.0.0.0/0

Good to know

  • The checked address (1.1.1.1 here) is always reached through line 1, even during failover. Pick an address you do not otherwise depend on.
  • Open connections drop at the moment of switching and reconnect on the other line.
  • For lines that should both carry traffic, combine this with PCC load balancing.

Questions and answers

How fast does failover switch?

check-gateway tests every 10 seconds and switches after two failures, so about 20 seconds.

Why does the simple method not detect my outage?

Because the gateway it pings is your modem, which still answers. Use the recursive method to test a host on the internet.

Does it switch back automatically?

Yes. When the check succeeds again the lower-distance route becomes active.

Related guides

Start the free trial See pricing