pfSense: 4G LTE Backup WAN with Automatic Failover

• Introduction
• Hardware Overview
• Step 1 – Configure the 4G Router
• Step 2 – Add the 4G Interface in pfSense
• Step 3 – Configure Gateways
• Step 4 – Create a Failover Gateway Group
• Step 5 – Firewall Rules
• Step 6 – Testing Failover
• Step 7 – Email Notifications (optional)
• Step 8 – Final Notes
• Results
• Extra: Notification Emails

Introduction

If your internet comes via DSL, fibre or similar, and you're worried about outages disrupting service, you can set up a reliable backup using a 4G LTE router as a secondary WAN connection for pfSense.

If your main connection fails, pfSense automatically switches to 4G within seconds, then restores the primary WAN once it's back online, all without any intervention.

This setup introduces no new or unusual security concerns. The 4G router simply sits in front of pfSense, just like your existing WAN, and all of pfSense's firewall and security features continue to apply exactly as before.

The goal: automatic failover when the main connection drops, and automatic recovery when it returns. This isn't an exhaustive guide, as some details depend on your existing pfSense configuration.

Hardware Overview

The 4G router needs a mobile phone SIM card for data, and connects to pfSense via Ethernet.

Step 1 – Configure the 4G Router

1. Insert a SIM card into the 4G router.
2. Connect to the router directly with a Cat5 cable and open its default admin login page.
3. Check the APN settings (usually detected automatically).
4. Make sure the router has a static IP, e.g. 192.168.10.1.
5. Disable Wi-Fi, as it isn't needed.
6. Disable the DHCP server. pfSense will handle DHCP.
7. Save and reboot the router.

Then connect the 4G router's LAN port to one of pfSense's spare ports. The 4G router's own WAN port isn't used.

Step 2 – Add the 4G Router's Interface in pfSense

1. Log in to pfSense and go to Interfaces → Assignments.
2. Add the new interface (e.g. igc3, depending on which port the 4G router is plugged into) and name it WAN_4G.
3. Enable it and set IPv4 Configuration Type to DHCP.
4. Save and apply changes.

pfSense should obtain an IP (usually 192.168.10.100) and a gateway (192.168.10.1, the 4G router's static IP).

Step 3 – Configure Gateways

1. Go to System → Routing → Gateways. You should see two gateways: WAN_MAIN and WAN_4G.
2. Edit each gateway and set the thresholds below.
3. Save and apply changes.

Step 4 – Create a Gateway Group for Failover

1. Go to System → Routing → Gateway Groups.
2. Add a group named WAN_GROUP with the settings below.
3. Save and apply.

Then go to System → Routing → Default Gateway and set Default Gateway IPv4 to WAN_GROUP (WAN Failover).

Step 5 – Firewall Rules

Under Firewall → Rules, add:

This lets one specific trusted device reach the 4G router's web interface. You'll need it if your 4G router is on a different subnet from your LAN.

Step 6 – Testing Failover

1. Disconnect the main WAN connection and open Status → Gateways.
2. WAN_MAIN shows Offline, and WAN_4G becomes Active.
3. pfSense automatically reroutes traffic via 4G.
4. When WAN_MAIN comes back, it returns as the primary route.
5. If you've added both gateways to the pfSense dashboard, you'll see the status of each, and the globe symbol shows which one is currently active.

Step 7 – (Optional) Email Notifications

pfSense can send notifications when gateways change state. Go to Status → System Logs → Settings → E-Mail, enter your SMTP details and enable Gateway monitoring events.

Step 8 – Final Notes

• Disable remote management on the 4G router.
• Change the 4G router's admin password.
• In pfSense, the globe icon beside a gateway shows the currently active WAN.
• Back up the new pfSense and 4G router configurations.
• If you use DDNS or external monitoring, remember that failover temporarily changes your public IP.

Results

Extra: Notification Emails

Screenshots of the notification emails I received on a disconnect and the reconnect that followed. This was most likely caused by a poorly placed 4G antenna giving low signal quality and strength.

Disconnect:

Reconnect:

↑ Top