Dual WAN failover for a gaming cafe: two lines, one steady address per PC

Your cafe runs on fibre. There is a second line now too, cable from another provider or a mobile router on the shelf behind the counter. Somewhere you read that the answer is multi-WAN gateway groups with load balancing: both lines busy all the time and no dead evening when the fibre drops. Before you copy that setup, look at what a game server and a bank see when a PC's traffic jumps from one line to the other. That one detail decides most of the configuration.

What changes when traffic moves to another line

Each line has its own public address. The PCs behind your gateway do not have one of their own. They borrow the address of whichever line their traffic leaves by. Move the traffic and the PC appears to the outside world from somewhere new.

A game server reads that as a connection that went away. The match drops and the client reconnects if the game lets it. Bank and payment sites tend to be stricter: a login that started on one address and continues from another often gets thrown out, sometimes with a security warning that makes the customer wonder what your network is doing.

So in a cafe the rule for a second line is simple. Change a device's address as rarely as possible and only when its line is really gone.

Per device sharing beats per connection balancing

Classic load balancing decides per connection. Every new connection picks a line by weight or in turn. For web browsing in an office that is fine. In a gaming cafe it means one player's launcher might sign in over fibre while the match traffic leaves over cable. Plenty of services cope. The ones that do not are exactly the ones your customers complain about at the counter.

Per device sharing works differently. Each device gets one line and keeps it while it is on. Twenty stations get split across two lines and each of them looks like one steady address to every game and every bank. You give up a little efficiency: a station that landed on the slower line stays there even when the faster one is quiet for a minute. In a cafe I would make that trade every time.

Here is the limit that disappoints people. One download never gets the speed of two lines. A 90 GB update on station 7 runs at the speed of station 7's line. What goes up is the total the cafe can carry at once, not the speed of any single PC. If you are deciding how big that total should be, our piece on internet speed for a gaming cafe does the arithmetic.

Failover or sharing

Pick the mode by what the second line costs you.

Failover alone has a cost people miss. When the main line comes back, traffic moves back to it. Every device changes address twice per outage, once on the way out and once on the way home. With per device sharing only the devices that were on the failed line move at all.

Setting it up on the WAN tab

In HandyCafe Gateway, which we make, the lines live on the WAN tab of the Internet page in HandyCafe Server. Press Add WAN for each one. Every line needs its own network card on the gateway PC and a connection type: DHCP when the modem hands out the address (most cafes), Static IP when the provider gave you one to type in or PPPoE when the provider gave you a user name and password, common with a modem in bridge mode.

The Sharing between lines card has two settings. Split traffic set to Per device turns sharing on. It needs at least two lines. Split automatically decides how devices are spread: on, the gateway splits them by each line's measured speed or evenly. Off, each shared line gets a slider in the Share column and you set the percentage yourself. Use the sliders when the measured speed misleads you. A cable line that tests fast at noon and sags every evening is the usual suspect.

Each line's row menu sets its role: Share traffic on this line or Use as failover. With sharing off you get Make this the main interface, Move up and Move down instead.

Turning sharing on can make online devices lose their connection once while each one is given a line. Do it in the morning before the first customer sits down, not at 20:00 on a Friday.

Nothing on this tab goes live until you press Apply. A line setting that cuts Server off from the gateway rolls itself back after a minute.

pfSense can do multi-WAN too. Its gateway groups and load balancing are very capable and give a network person finer control than we offer. Someone has to build those groups by hand and maintain them as lines and providers change though. If you have that person and they enjoy the work, pfSense is a fine choice. Whether to keep pfSense at all is a separate question, answered in our pfSense alternative piece.

Monitor IP: a backup without one can lie

A line can be plugged in with the link light green and the modem answering, while the provider's side is dead. Nothing gets out. Without something to test against, the gateway can believe that line is up.

That is the worst kind of backup. It looks fine on every quiet day and on the bad night the cafe fails over to nothing.

Give every line a Monitor IP. The gateway pings that address through the line to decide whether the line really reaches the internet. Use a different public address for each line. Do not use your modem's own address, since the modem answers even when everything behind it is down.

Poor quality and why the lines do not flap

Lines rarely just die. More often a line starts losing packets or answering slowly before it gives up. The WAN interfaces list shows each line's status, speed, latency, loss and current traffic. A line that is up but struggling shows Poor quality.

The gateway steers traffic around a poor line as long as a healthy one is left. A poor line is still used before one that is down. Bad fibre beats no fibre. The part that matters for players is the way back. A poor line counts as healthy again only once it is clearly back under its limits. A line sitting right on the edge does not bounce traffic back and forth, which would mean an address change for the affected players every few minutes.

Pinning the streaming PC or a console to the fast line

Some devices should not be spread by percentage. The streaming station that pushes video all night wants the fibre even when it is busy. A console can be the same. Another case is the till or an office PC that needs the address the second line carries.

On the Devices tab open the device's menu and choose Choose internet line. The pin follows the device, not the station it happens to sit at. Stations already appear under their HandyCafe names. Give consoles and other devices a name first so you pin the right one.

Sending a game's ports to a chosen line

Sometimes it is not about who sends the traffic but what it is. Say you want one game off the main line. Open the Firewall tab, choose the Policy routing filter and press Add rule. The Send a port to a line window asks for an outgoing port, a range or the name of a saved list. The gateway comes with port lists for 26 well-known games, among them Steam, CS2, Minecraft, VALORANT, Fortnite, PUBG and Valheim. Ports 80 and 443 are left out of those lists because every web page uses them.

Then pick the line or a gateway group. Rules are checked from the top and the first match wins. The window will not save a rule for traffic another rule already sends to a line.

Know how it works before you lean on it. The gateway learns which addresses the matching traffic goes to and sends those addresses out through the chosen line. That applies to every device in the cafe, not only the one that started it. It returns to the normal line order after 30 minutes without traffic or when the chosen line goes down. The first packet to a new address can also wait a moment while the route is set up.

My rule of thumb: if the reason is a device, pin it. If the reason is a game, write a policy rule.

Gateway groups are tiers, not a balancer

The Gateway groups card on the Firewall tab holds named line orders that a policy rule can use. Think of tiers: fibre in tier 1, cable in tier 2, mobile in tier 3. Traffic uses the lowest tier that has a line up.

People coming from other routers often put two lines in the same tier and expect them to share the load. They will not. Within a tier the first line listed is used.

A Saturday night: the fibre drops at 21:40

Take a cafe with fibre and cable shared per device, a mobile router as backup and a Monitor IP on all three lines. Most stations are in a match.

At 21:40 the fibre provider has a fault. The modem still blinks. The Monitor IP stops answering through the fibre and the gateway counts the line as down. Every device that was on the fibre moves to the cable at once. Those players lose their match connection and reconnect from the cable's address. The players already on cable notice nothing. Sessions and billing in HandyCafe Server carry on and nothing on the cafe side needs a restart. Most downloads survive the move.

The mobile router stays idle because the cable is still up. A backup takes over only when every shared line is down.

The cable now carries the whole cafe. This is the hour when one station pulling a big update can hurt everyone. A speed cap on the stations group keeps the rest playable. Setting it up on the Bandwidth tab in advance beats an evening of lag complaints.

At 22:15 the fibre comes back. It takes new devices after one minute without problems. A device keeps its line while it is on. The players who moved to the cable are not pulled back mid-match. If the fibre returns shaky it shows Poor quality and stays out of the way until it is clearly healthy.

Sunday morning the Overview tab shows the mark the fibre left when it went down and came back. That is where to look when a regular says the internet "went weird" last night.

If the cable had failed too, the mobile router would have taken over. That is the night the backup's Monitor IP earns its place.

What it cannot do

• One download never gets the speed of two lines. Each device uses one line at a time.
• Lines in the same tier of a gateway group are not load balanced. The first one listed is used.
• Turning sharing on can drop online devices once.
• A policy rule sends a learned address over the chosen line for every device in the cafe.
• Line monitoring and gateway groups work only on the Windows gateway.

Planning the room's power and network cabling is covered in how to lay out a gaming cafe. The internet lines guide has every screen.