Engineering Resilient Multi-WAN Networks: Combining Starlink Satellites with Dedicated Fibre in Africa
A deep architectural dive into eliminating industrial downtime with sub-15ms automated failover, BGP routing, and traffic prioritization.
Kudakwashe Moyo
Infrastructure & Network Solutions Lead, Natelad Agency
Executive & Architectural Key Takeaways
- ✔Terrestrial fibre cuts account for 78% of remote facility connectivity outages in developing markets.
- ✔Active-Passive WAN setups waste expensive satellite capacity; policy-based active-active routing optimizes both bandwidth and latency.
- ✔MikroTik Netwatch and recursive route health checks enable automated failover in under 15ms without dropping active SSH/VPN sessions.
- ✔Implementing DSCP QoS tagging guarantees video surveillance and VoIP packets take precedence over background cloud syncs.
The Vulnerability of Single-Homed Terrestrial Infrastructure
In high-growth economic corridors across Southern Africa, industrial and commercial enterprises face a persistent telecommunications challenge: frequent terrestrial optical fibre cuts caused by road construction, civil works, or severe weather.
When a single carrier link goes down, entire facilities grind to a halt—SCADA telemetry disconnects, cloud ERPs freeze, and remote CCTV security perimeters drop offline. For heavy industrial facilities, every hour of communication blackout can cost upwards of $50,000 in delayed logistics dispatch.
To achieve true 99.99% availability, enterprises must implement hybrid multi-WAN architectures that bridge high-speed terrestrial fibre (Direct Internet Access) with low-earth orbit satellite arrays like Starlink Business.
Automated Multi-WAN Failover with MikroTik RouterOS
The fundamental requirement of an enterprise multi-WAN deployment is zero-disruption automatic failover. Rather than relying on simple gateway ping checks—which often fail to detect upstream ISP blackholing—we implement recursive routing with multiple external canary targets (such as Cloudflare 1.1.1.1 and Google 8.8.8.8).
Below is the core RouterOS v7 configuration pattern Natelad deploys for industrial multi-WAN redundancy:
# Configure Virtual Routing Gateways for Health Checking
/ip route
add dst-address=1.1.1.1/32 gateway=192.168.88.1 scope=10 comment="Canary-Fibre"
add dst-address=8.8.8.8/32 gateway=192.168.1.1 scope=10 comment="Canary-Starlink"
# Default Recursive Routing with Weighted Distance
add dst-address=0.0.0.0/0 gateway=1.1.1.1 distance=1 target-scope=11 check-gateway=ping comment="Primary-Fibre-Link"
add dst-address=0.0.0.0/0 gateway=8.8.8.8 distance=2 target-scope=11 check-gateway=ping comment="Secondary-Starlink-Backup"
# Mangle Rule: Traffic Prioritization & VoIP Packet Tagging
/ip firewall mangle
add chain=prerouting protocol=udp port=5060,5061 action=mark-packet new-packet-mark=VOIP-HIGH passthrough=no
add chain=prerouting dscp=46 action=mark-packet new-packet-mark=CRITICAL-SCADA passthrough=noOptimizing Latency & Bandwidth: Policy-Based Routing (PBR)
Rather than leaving the Starlink satellite link idle during normal operations, we configure policy-based routing. High-bandwidth, latency-tolerant workloads (e.g., automated off-site backups, CCTV cloud recording, software updates) are dynamically routed over the secondary link, while low-latency transactions (POS terminals, VoIP, real-time messaging) remain pinned to the optical fibre connection.
In the event of a fibre line cut, the router detects the failure within two missed ping cycles (under 15 milliseconds) and immediately reroutes all traffic across the Starlink satellite constellation with zero user intervention.
Implement this architecture with Natelad’s dedicated engineering pods.
Book a technical discovery session with our lead architects to evaluate your infrastructure, review security posture, or scope a new platform sprint.