Asuswrt-Merlin - Failover Only for Specific Devices

[lijoppans]

I have a primary high speed connection and a 4G as secondary connection. But I need it to use the secondary connection only for some specific devices. Is there any way to do so ? When the primary WAN goes down, some devices should be able to access internet via secondary WAN. And let other non-critical devices have no internet connection.

 

[a2handyman]

Did you ever devise a solution? I want to do the same failover to limited devices only. I have CradlePoint LTE, Asus WiFi router and a Netgear switch. Happy to purchase another device for simplicity.

I am wondering if VLAN can help.

 

[RandomUser777]

I am sorry I did not see this post back in 2022.

Pretty much the same requirements for my needs: fast primary wan, slow cell secondary.

If you want to COMPLETELY stop certain devices from accessing your secondary wan under any circumstance, you add something like this into your firewall-start script: In my case, I want to allow devices that have an ip address between .1 and .15, and block anything else. The devices which I want to have access during wan failover are assigned an IP within the .1 to .15 range.

PLEASE NOTE that I am using eth0 (normal wan port) as my secondary wan, since I am using eth5 as my primary


iptables -I OUTPUT 1 -s 192.168.50.16/28 -o eth0 -j DROP
iptables -I FORWARD 1 -s 192.168.50.16/28 -o eth0 -j DROP

iptables -I OUTPUT 1 -s 192.168.50.32/27 -o eth0 -j DROP
iptables -I FORWARD 1 -s 192.168.50.32/27 -o eth0 -j DROP

iptables -I OUTPUT 1 -s 192.168.50.64/26 -o eth0 -j DROP
iptables -I FORWARD 1 -s 192.168.50.64/26 -o eth0 -j DROP

iptables -I OUTPUT 1 -s 192.168.50.128/25 -o eth0 -j DROP
iptables -I FORWARD 1 -s 192.168.50.128/25 -o eth0 -j DROP

I chose to use CIDR to keep things short and sweet by blocking entire ranges at once. But you could enter specific IPs to ban.

When eth5 (primary wan) goes down, traffic from 192.168.50.1 to 192.168.50.15 is allowed through eth0 (secondary wan) while every other device on my network is blackholed.