How to Use Starlink as Backup Internet for Fiber or Cable: A Dual-WAN Failover Guide

Starlink can be a useful backup for a home office, small business, or rural property that normally uses fiber or cable. The reliable way to do it is to make the Starlink connection a second WAN on one router, then let that router move traffic to Starlink only when the primary connection fails.

This guide covers a failover-only setup. It keeps the network name, devices, DHCP leases, and firewall rules in one place, while avoiding the complexity of load balancing.

The recommended layout

Use a dual-WAN router or firewall as the only device routing your home or office network:

WAN1 remains the preferred connection. WAN2 is configured as a backup. Your switch, access points, computers, cameras, and smart-home devices stay behind the dual-WAN router.

Do not connect Starlink and your primary router to the same unmanaged LAN and expect automatic failover. Both connections need to terminate on separate WAN ports.

Check the Starlink handoff before changing anything

The physical connection depends on the Starlink kit:

• Some kits provide Ethernet directly from the power supply or router.
• A Standard Actuated kit may require the official Starlink Ethernet Adapter.
• Starlink's current third-party-router guidance says the external router WAN interface should normally use DHCP.
• If your kit supports Bypass Mode and the dual-WAN router will manage all routing and Wi-Fi, Bypass Mode turns off the Starlink router's Wi-Fi and hands the connection to the third-party router.

Check your exact kit and cable path in the Starlink app before unplugging a working connection. Starlink's instructions vary by hardware generation. On supported routers, Bypass Mode is under Settings. Plan carefully: Starlink says leaving Bypass Mode normally requires a factory reset.

If your kit does not use Bypass Mode, connect its Ethernet handoff to WAN2 and leave the Starlink router in its normal mode. That creates an additional NAT layer on the Starlink path, but it is usually acceptable for outbound backup internet. It is less suitable for inbound hosting, port forwarding, or services that need a predictable public address.

Configure WAN1 and WAN2

The exact labels depend on the router, but the logic is the same.

1. Set the fiber or cable connection as WAN1 and keep it as the preferred route.
2. Set Starlink as WAN2.
3. Set the Starlink WAN type to DHCP unless your equipment specifically requires another setting.
4. Select failover or primary/backup mode instead of load balancing for the first test.
5. Leave the LAN subnet and DHCP server on the dual-WAN router. Do not let the fiber router, Starlink router, and dual-WAN router all serve the same LAN.
6. Give WAN1 and WAN2 different upstream subnets if either provider's router is not in bridge or bypass mode. For example, avoid using the same private range on both upstream routers.
7. Keep the dual-WAN router's LAN subnet separate from both upstream networks.

A common mistake is to test by pinging a provider's DNS server. Starlink's own router guidance recommends health checks against a public IP such as 1.1.1.1 or 8.8.8.8, because Starlink DNS servers may not respond to ping. Start with a check every 10 seconds and mark a WAN down after five consecutive failures, then adjust only if your router or use case needs a different balance between speed and false positives.

Keep the network simple during the first test

Failover is easier to diagnose when the first version has one LAN, one DHCP server, and one set of DNS settings.

Use the dual-WAN router for:

• DHCP reservations
• DNS forwarding or filtering
• firewall rules
• VPN client and server settings
• port forwarding
• Wi-Fi access point routing

If you use Bypass Mode, turn off the old Starlink Wi-Fi network so nearby devices cannot accidentally join the wrong LAN. If you keep the Starlink router in normal mode, give its Wi-Fi a different name and use it only for temporary diagnostics.

IPv6 needs its own check. If your dual-WAN router advertises IPv6 from WAN1 but cannot obtain a usable IPv6 path from Starlink during failover, some applications can appear partially broken. Either configure IPv6 failover deliberately or disable LAN IPv6 advertisements until you have tested both WANs. Do not assume an IPv4 failover test proves IPv6 is healthy.

Test failover before you need it

Run the test when nobody is in a critical video call or upload.

1. Confirm that WAN1 is active and record the public IP shown by a trusted IP-check page.
2. Open a few normal sites, start a video call test, and confirm that devices use the dual-WAN router's LAN address.
3. Disconnect only the fiber or cable modem's WAN link, or disable WAN1 in the router. Do not unplug the dual-WAN router itself.
4. Wait for the health-check threshold to expire. The change may take from a few seconds to about a minute depending on the router.
5. Confirm that the public IP has changed and that a new web page loads through Starlink.
6. Test the applications that matter to you: work VPN, video calls, remote desktop, cameras, and any cloud backup.
7. Reconnect WAN1 and confirm that the router returns to the preferred path.
8. Check the event log. A clean failover should show WAN1 down, WAN2 active, and WAN1 restored, rather than repeated route flapping.

Existing TCP sessions may not survive the WAN change. That is normal: a session tied to the old public IP often has to reconnect. The goal is to restore useful connectivity quickly, not to make every session invisible to the switch.

Common problems and fixes

The router never selects Starlink. Confirm that WAN2 receives a DHCP address, then check that the health probe targets a public IP rather than a DNS hostname. Verify that the Starlink Ethernet path is connected to the correct WAN port.

The router keeps switching back and forth. Increase the failure and recovery thresholds, or use a slower health-check interval. Check for a loose Ethernet connector, a failing modem, or an upstream router that is still reachable while the wider internet is not.

Everything works except inbound access. Starlink may use CGNAT, and an extra Starlink router layer can add another NAT boundary. Use an outbound overlay such as a managed remote-access service, or keep inbound services on the primary WAN if your provider supports them.

Devices lose the internet after failover. Renew the client lease, reconnect Wi-Fi, and check whether DNS or IPv6 is tied to WAN1. A stable dual-WAN setup should keep the same LAN gateway while changing only the upstream path.

The Starlink app cannot see the dish. Third-party routing and Bypass Mode can change which app features work. Keep the Starlink app available for diagnostics, and follow the app's model-specific instructions if the dish or router appears unreachable.

A sensible maintenance routine

Test the backup path once a month and after any router, firmware, modem, or cable change. Label WAN1 and WAN2 at the router, save a backup of the dual-WAN configuration, and keep a short note with the Starlink kit model and Ethernet adapter requirement.

Start with failover only. Add load balancing, policy routing, or automatic VPN changes only after the basic path has passed several controlled tests.

For model-specific details, use Starlink's current support pages for using your own router and Bypass Mode.