hEX Dual WAN failover in front of Orbi RBR760 primary without double-NAT

[valuemaster]

I want to use a new hEX to failover from dynamic-IP broadband to dynamic-IP LTE whenever Comcast goes down BUT I want to keep the Orbi RBR760 as primary because Netgear ARMOR will not work with Orbi in AP mode. How to config the hEX to avoid double-NAT? a VLAN or 3?

Broadband comes into an Arris Surfboard S33 DOCSIS3.1 and Verizon LTE comes into a Netgear LM1200. I tried using the built-in failover (with ping) in the LM1200 but it refused to fall back after broadband restored.

I’ve watched the Dual-WAN failover videos and read the posts/blogs, but none of them use another router AFTER the failover device. And I know that the “best” way is to put the Orbi in AP mode but that curtails the ARMOR operation. Being a lightweight RoS user, I know enough to know that I don’t know enough…

[TheCat12]

Double NAT in your case is unavoidable. However, if configured properly, it shouldn’t be a problem at all

[anav]

Draw a network diagram as it will help understand your setup.

[valuemaster]

[valuemaster]

@TheCat12 “configured properly” is my question. Thanks.

[jaclaz]

It seems to me like you could apply this simple method:

Simpler Failover for two Gateways I found working

Hey, like many others I was wondering how to accomplish a simple failover with two Gateways (here: DSL and LTE) with MikroTik involved. Searching the Internet and this Board, all I was able to find was “Recursive Routes” with checking e.g. 8.8.8.8 as a “Gateway”. This was not working at first and I wasn’t happy with recursion in the routes so I managed to get the task done with another way I was not able to find anywhere while searching, so I’m sharing this: Done this on RB5009 yesterday - i…

further simplified:

Simpler Failover for two Gateways I found working

Only to keep things as together as possible I just “sold” this Filo’s approach to a new user, with a few changes. I got rid of the separate routing table and of the mangle by adding a “narrow” /32 route to the “canary” ip address in “main” table. And I didn’t use the “comment” as selector in the Netwatch script (this is a pet peeve of mine, comments may be changed accidentally six months or a year later, the setup would stop working and finding out what happened would be more difficult). Be…

[valuemaster]

As far as the failover config itself, I was planning on using the following scenario:
Mikrotik Failover Guide for High Availability & Business Continuity

I’m mainly seeking advice on minimizing any negative double-NAT effects from plugging the Orbi (in router mode) into the LAN port of the Mikrotik hEX. Thanks.

[jaclaz]

Yep, that one is very similar to the simple ones I posted a link to.
Double NAT is double NAT, you either have it or have it not, in your setup you need to have it.
In theory it will increase a little latency, but in practice you won’t likely notice it.