Multi-WAN Failover with the Ubiquiti UniFi UCG-Fiber: Setup, Grounding and Configuration

Multi-WAN uses more than one internet connection. Failover switches to a backup after a detected fault; load balancing distributes new connections across available links. Neither arrangement guarantees 100% uptime or uninterrupted calls. A common gateway, power supply or cable route can still fail.

Example: fibre, satellite and mobile backup

The example prioritizes Toya fibre, then Starlink, then a ZTE 5G connection. Actual latency, throughput and independence need measurement at the installation site. Starlink reduces dependence on the local access line but still relies on power, a clear view of the sky and the provider network.

Hardware and provider requirements

The UCG-Fiber supports multiple WAN ports; the current specification lists a maximum of six. Three connections therefore require appropriate port assignments and enough remaining LAN connectivity. A fibre subscription does not imply that an arbitrary SFP module can replace the provider ONT: optics, authentication and provider settings must match.

Bridge mode or IP passthrough can remove an extra local NAT layer, but is not essential for every outbound application. Neither mode creates a public IPv4 address or removes provider-side CGNAT. Incoming services require a separate addressing and firewall design.

• Starlink: Router 3 has Ethernet LAN ports and supports bypass mode. The exact kit determines wiring and adapter needs; Performance kits may connect a third-party router at the power supply instead. Bypass does not change the service plan’s IP policy.
• ZTE MC889: an outdoor unit with PoE Ethernet. Bridge or passthrough availability needs checking against the actual firmware and operator documentation. The approved injector and cable arrangement matter; a PoE label alone does not prove compatibility with a particular switch.

Outdoor installation and electrical protection

Roof mounting requires a protection design appropriate to the building and local rules. A qualified electrical or lightning-protection specialist determines earthing, bonding, separation distances, conductor routing and surge-protection placement. A generic instruction to connect every mast directly with 16 mm² copper is insufficient.

Outdoor cable suitability includes UV exposure, moisture, shielding and the equipment manufacturer’s installation requirements. A surge protector at the basement rack alone is not a complete building-entry protection design. PoE compatibility and bonding of protective devices also need verification. Surge protection does not guarantee survival of a direct lightning strike.

Configuration and acceptance test

1. Under Settings > Internet, each provider connection receives a WAN port and the required DHCP, static-address, VLAN or PPPoE settings.
2. Failover uses an explicit priority: fibre, Starlink, mobile. Load balancing is a separate choice and can consume metered backup data during normal operation.
3. Health checks assess the usable route beyond the modem. The documented Auto policy combines ping and DNS probes; custom SLA thresholds can evaluate packet loss, latency and jitter. Menu labels depend on the installed Network version.
4. A maintenance-window test covers loss and restoration of each link, real application traffic, DNS, VPN reconnection and data usage. Monitoring the backup alone does not prove the full switchover works.

Load-balancing weights distribute new connections rather than combining all links into one faster download. A connection normally stays on its chosen WAN. Failover can change the public address and interrupt existing sessions; application recovery needs testing.

Routing selected traffic

Policy-Based Routing can assign a device or VLAN to a WAN. For example, guest traffic can use Starlink while backups use fibre. An enabled Kill Switch stops matching traffic when that route is unavailable; disabled, fallback follows the remaining routing rules. A stopped backup may fail or need restarting rather than pause cleanly.

The documented menu in Network 9.4 is Settings > Policy Table > Create New Policy > Route. Domain-based rules require clients to use the gateway for DNS. A dedicated WAN should follow Ubiquiti’s documented Failover or Backup role rather than remain an active load-balancing member.