When the internet connection goes down, a phone plugged into the firewall with its USB or USB-C cable can take over. The firewall uses the phone only while the main connection is down, and switches back by itself when the main connection answers again. While the main connection works, the phone's data plan is not used.

Android phones and iPhones both work. The phone shares its mobile data with the firewall the same way it would with a laptop: USB tethering on Android, Personal Hotspot on an iPhone.

At a glance:

The firewall does the rest. It checks the main connection every 5 seconds and, after about 15 seconds without an answer, sends the traffic through the phone. About 30 seconds after the main connection answers again, it switches back.

Step 1: Connect the phone

Use the phone's own charging cable (a charge-only cable carries no data). Any USB port on the firewall works, and the firewall charges the phone while it is plugged in.

Android:

1. Plug the phone in.
2. On the phone, open Settings › Network & internet › Hotspot & tethering (on Samsung: Settings › Connections › Mobile Hotspot and Tethering).
3. Turn on USB tethering. The switch is only shown while the cable is plugged in.

iPhone:

1. Plug the iPhone in and unlock it.
2. The first time, the iPhone asks Trust This Computer? Tap Trust and enter the passcode. The firewall keeps the pairing, so the iPhone asks only once.
3. Open Settings › Personal Hotspot and turn on Allow Others to Join. Leave the screen open the first time, until the firewall shows the iPhone as sharing its connection.

Some phones turn tethering off after a restart or after some time unplugged. If the phone is to stay connected as a permanent backup, check after a restart of the phone that USB tethering or Personal Hotspot is still on.

Step 2: Turn on backup internet

Go to Network › Interfaces, zones & routes and find Backup internet (phone).

• The phone shows with its name (for example Samsung Galaxy S24 or Apple iPhone) and sharing its connection.
• If it shows not sharing yet, the line below tells you what to do on the phone.
• No phone plugged in means the firewall does not see the phone. Check the cable and unlock the phone.

Press Use a phone as backup internet. This puts into the pending changes:

• the port phone0 (the name the firewall gives every phone), getting its addresses from the phone (DHCP and IPv6 SLAAC), marked as the backup;
• phone0 in the same zone as your main internet port, so your firewall rules for the internet apply to it too;
• source NAT on phone0 for IPv4 and IPv6, named Backup internet (phone). The phone's network does not know your networks, so their traffic leaves with the phone's address.

Step 3: Commit

Open the pending changes, review them, and commit. Use the safety rollback and press Keep these settings when the page comes back.

After the commit, the panel shows Standby: ready to take over, and for IPv4 (and IPv6, if both your internet provider and the phone have it) the phone's route under Backup route.

After the commit the panel shows Standby: ready to take over: the main connection answers, and the phone's route waits. (The picture is from a test firewall with a simulated phone, so no phone model is listed.)

What happens during an outage

• The switch. The main connection stops answering. After 3 checks in a row without an answer (about 15 seconds), the panel shows In use, the bell shows the alert The main internet connection is down: the backup (phone0) carries the traffic, and new connections go out through the phone.
• Open connections. Downloads, calls and video streams that were open at the switch stop and must start again: their address changes.
• The firewall's own DNS. While the phone is in use, the firewall also asks the phone's DNS servers.
• IPv4 and IPv6 separately. Each switches on its own. If your internet provider gives no IPv6, the phone's IPv6 is never used.
• Coming back. When the main connection answers again 6 times in a row (about 30 seconds), the traffic goes back to it and the alert closes.
• The audit log. Every switch is recorded (System › Audit log, actions internet.backup.on and internet.backup.off).

From the command line, show backup-internet shows the same state.

Turning it off

• Turn off keeps the settings but stops using the phone. Use a phone as backup internet turns it on again.
• Remove takes the port, its zone membership and its source NAT out of the configuration.
• Both go into the pending changes. Commit to apply.

Unplugging the phone needs no change: the firewall notices it, and uses it again when it is plugged back in with tethering on.

Good to know

• Only one phone is used at a time. If two are plugged in, the second one is listed but not used; unplug the first one to use it.
• Use the cable. The phone's Wi-Fi hotspot is not used: the firewall connects to the phone by cable only.
• Data use. Watch your phone plan: everything your networks send goes through the phone during an outage, including updates and streaming. For a permanent mobile backup with a data cap, a cellular modem (Network › Cellular WAN) is the better choice.
• Failover pairs. The phone belongs to the firewall it is plugged into. Plug a phone into the active firewall; it is used while that firewall is active.
• USB network adapters are not mistaken for phones: they keep their own names and are not used as backup.

Screenshots pending

These pictures are taken on real hardware (an iPhone on the NUC) and are added when the phone has been tested there:

• the Backup internet panel with an Android phone sharing its connection;
• an iPhone waiting for Trust (the hint shown);
• the pending changes after Use a phone as backup internet;
• the panel In use during an outage, with the bell alert;
• show backup-internet on the command line.