{"id":10494,"date":"2026-09-23T07:20:00","date_gmt":"2026-09-23T05:20:00","guid":{"rendered":"https:\/\/www.lukaswojcik.com\/blog\/?p=10494"},"modified":"2026-10-26T11:53:17","modified_gmt":"2026-10-26T10:53:17","slug":"wan-failover-what-happens-to-open-connections-when-the-line-switches","status":"publish","type":"post","link":"https:\/\/www.lukaswojcik.com\/blog\/en\/it-networks\/wan-failover-what-happens-to-open-connections-when-the-line-switches\/","title":{"rendered":"WAN Failover: What Happens to Open Connections When the Line Switches"},"content":{"rendered":"

WAN failover switches to another internet connection after a fault. A usable route does not automatically preserve open connections. The externally visible addresses, router state, transport protocol and application recovery determine the outcome.<\/p>\n

The typical case considered here is two independent uplinks with different public IPv4 addresses and NAT. NAT translates local addresses into the public address used on the internet. The router stores which internal connection belongs to each external address and port mapping. A design retaining a stable external address or using a suitable tunnel has different conditions. A claim that every session ends at the switch would therefore be incorrect.<\/p>\n

\"Route,
Detection model: I = 5 s, T = 1 s, N = 3. Route switching and application recovery add separate delays.<\/figcaption><\/figure>\n

Why an address change interrupts ordinary TCP<\/h2>\n

An ordinary TCP connection is identified by source and destination addresses and ports. If traffic is translated to a different public source address after failover, the server cannot treat that traffic as the original connection. A new route alone does not transfer TCP state to a new address.<\/p>\n

The failure need not become visible at the exact switching instant. NAT state may initially remain pinned to WAN1; applications may wait for retransmissions or abort earlier through separate deadlines. If the original path returns in time with its state intact, a connection can resume. A normal switch to a different source address generally requires a new SSH or database connection.<\/p>\n

Detection, route switching and application recovery<\/h2>\n

No formula based only on an interval and a failure count covers every router. A simple model can nevertheless be derived explicitly: probes start every I<\/code>, each failed probe completes after T<\/code>, and exactly N<\/code> consecutive failures trigger the decision. Here T < I<\/code>, and the last probe before the outage succeeded. d<\/code> is the delay until the first probe starts after the outage; D<\/code> is the detection time.<\/p>\n

Text<\/span>