Internet uplinks and speed limits

The Network tab's Internet group has two sections:

• Uplinks: use two internet connections for failover or load balancing, and monitor each one.
• Speed limits: cap what an uplink, a network, or a single device can use.

Both need ReadyView plugin 1.11 or later. Changing them needs Allow uplink changes from ReadyView and Allow speed limit changes from ReadyView on the firewall. See How changes work.

#Uplinks

With two internet connections, the firewall can keep traffic on a main uplink and move it to a backup when the main one fails (Failover), or share traffic across both (Load balancing).

The top of the section says what's happening right now, for example:

• "Traffic is on the main uplink, WAN."
• "Traffic is on the backup uplink, WAN2, because the main uplink isn't working."
• "Traffic is shared across WAN and WAN2."
• "Dual uplinks are off. Traffic uses the firewall's default gateway."

Each uplink shows its status:

#Before you start

You need a second internet connection on the firewall. If you don't have one, ReadyView says so and offers Go to VLANs and DHCP, where you can add one on a free port or a VLAN.

#Set up failover or load balancing

1. Open Network > Uplinks.
2. Under Use two uplinks, choose Failover or Load balancing.
3. Choose the Main uplink and Backup uplink (for load balancing, the First uplink and Second uplink).
4. Under Count an uplink as failing when it is, choose Down (the default), Losing packets, Slow, or Slow or losing packets.
5. Keep Move the firewall's default route too ticked, so the firewall's own traffic and every network on Automatic follow the working uplink.
6. Choose the connection options:
   • Failover: Move connections back when the main uplink returns.
   • Load balancing: Keep each device on one uplink (on by default, recommended for websites that tie a login to an address) and Reset connections on an uplink that fails.
7. Under Checking each uplink, set the Address to ping and the thresholds (see Gateway monitoring). For load balancing, Share of traffic sets each uplink's weight, 1 to 10.
8. Optionally, under Preferred uplink per network, choose Prefer an uplink for a network, for example to keep guest Wi-Fi on the cheaper connection. Automatic follows the main uplink.
9. Click Save.

To turn dual uplinks off, choose Off and save. ReadyView removes its uplink group and network rules, and traffic uses the firewall's default gateway.

#Gateway monitoring

The firewall decides an uplink is failing by pinging an address through it every second and measuring loss and delay. Monitoring is off by default on a new firewall, and it's forced on for both uplinks while dual uplinks are on.

Monitoring also feeds the WAN loss and latency charts, the security report's uplink uptime, and gateway alerts. Without it, those show Not monitored.

For each uplink, under Checking:

• Address to ping: by default the uplink's gateway. A public address tests the whole path. Give each uplink a different one.
• Slow from (ms) and Failing from (ms): delay thresholds.
• Losing packets from (%) and Failing from (% lost): loss thresholds.

Each threshold must be higher than the one before it.

#How fast failover is

With the default thresholds:

• Cable unplugged or link down: about 10 seconds. The routes go away as soon as the link drops.
• Upstream outage with the link still up: about 15–20 seconds of lost pings before the uplink is marked down. Outages shorter than that don't fail over. Lowering Failing from (% lost) detects faster but fails over on shorter blips too.
• Failing back: after the main uplink has answered for about a minute, plus the time to get a DHCP lease after a replug.

Connections that were open on the failed uplink, such as a running ping or a video call, keep trying it until they time out unless you tick the option to move or reset connections. New connections use the working uplink right away.

#Uplinks warnings

Uplinks are IPv4 only.

#Speed limits

Speed limits use the firewall's traffic shaper to cap bandwidth. The status reads Limits on or No limits.

#Set limits

1. Open Network > Speed limits.
2. Under Internet uplinks, set Download and Upload in Mbit/s for each uplink. Set these a little below the speed your provider delivers, so the firewall, not the modem, decides who waits when the line is busy. That keeps calls and games smooth under load. Traffic is shared fairly between devices.
3. Under Networks, set a network's limit to Whole network (one cap for everyone on it) or Each device (the same cap for every device), and enter the speeds.
4. Under Single devices, enter a MAC or IP address, an optional name, and the speeds, then click Add. Up to 200 devices.
5. Click Save.

Network and device limits apply to internet traffic only, not traffic between your own networks. Each limit shows how much it has carried and how many packets it dropped. The counters start again each time you save.

Remove all limits removes every limit ReadyView set. Limits set up in the firewall's own interface stay.

#Things to know

• An uplink limit can't go below 2 Mbit/s, and the firewall's own link to ReadyView always gets through ahead of the limits, so a limit can't cut the firewall off.
• Limits from group policies show read-only under Set by group policies.
• A device limit by MAC is tied to the device's address when you save. If the device later gets a new address, ReadyView warns you; click Use the new address to move the limit.
• A device limit by MAC needs the device to be connected, or to have a DHCP lease, when you save. Otherwise add it by IP address.
• If ReadyView warns that the firewall's link to ReadyView isn't kept ahead of the limits, click Save uplink limits again.
• At most 50 changes per save.