Mikrotik automatic failover using netwatch

Mikrotik automatic failover is one of those topics with lots of materials on the internet. However, most of these materials, created by inexperienced network engineers, do not address the users’ requirements. In this article, I will not only simplify the configuration of Mikrotik automatic failover using netwatch, I will ensure that this solution will address your end.

Why Mikrotik Automatic failover?

If you have a dual-ISP connection where one is preferred over the other, you need a system that will route all user traffics out of the primary link but with the ability to automatically switch control to the secondary whenever a failure is detected on the primary link. Also, the system must be able to return control to the primary link immediately the failure is resolved.

Mikrotik automatic failover configuration

On my router, Ether1 is connected to ISP1 while Ether2 is connected to ISP2. The bridge port is used for the LAN. The static address is used for ISP1 on ether1. was statically assigned to Ether2 for connection to ISP2, and was assigned to the LAN interface. All these are shown in the image below.

Mikrotik automatic failover

Next, create an interface list and add Ether1 and Ether2 to the WAN interface. The bridge port or whatever interface you are using for your LAN should be added to the LAN interface list. After that, go to IP > firewall > NAT and create a masquerade rule. Choose WAN (the one created earlier) as your out interface list. The reason I created the WAN interfece list was to simplify the NAT configuration. Otherwise, two nat rules will be created for both out interfaces.

Mikrotik automatic failover

The next step is the configuration of static default routes for both links. The preferred link should have the administrative distance of 1 while the backup link should have a higher AD, e.g. 10. The lower the AD, the better the link. At this point, connected users should have internet access via the primary link. The backup link, though in the routing table, is inactive and can only become active when the primary link has its cable unplugged or the its static default route disabled or removed from the routing table. That is not efficient.

You may also like: How to configure automatic failover with load balancing on a Cisco router

To efficiently automate the path selection process, we need to do three things: firstly, mark the connection and packets for all traffics originating from the router and destined to a relaible internet IP address like or Secondly, create a routing rule that uses the routing mark created in step one above to ensure that traffics to the listed address are routed out the primary ISP link at all time. What does this do? Simple! As long as the address is reachble, we can ask Netwatch to do something. Netwatch will enable the primary ISP’s static default route in the routing table. Otherwise, the primary route will be disabled to allow the secondary become active.

Mikrotik automatic failover
Mikrotik automatic failover

In the images above, the connection mark was first created, it was then used to create the routing mark. With the routing mark, a static route is created for all traffics from the router to to go through the primary link at all times. See the image below for guide on static defualt route with routing mark.

Mikrotik automatic failover

Finnally, netwatch is enabled to track reachability to and enable the default route to the primary link when the IP is up and disable the same default route when the IP is down (unreachable).

Mikrotik automatic failover

With the Mikrotik automatic failover setup above, netwatch will continue to test reachability to every 5 seconds. As long as that IP is reachable, the primary link will be in use. Otherwise, the secondary link becomes active. This solution has been tested and found efficient.

If you enjoyed this tutorial, please subscribe to this blog to receive my posts via email. Also subscibe to my YouTube channel, like my Facebook page and follow me on Twitter

Spread the love

Leave a Reply

Your email address will not be published. Required fields are marked *