Culmen Failover Engine

Automatic multi-carrier failover for MikroTik routers. Keeps subscribers online when an upstream provider fails.

What it does

• Independent health engine per uplink — real path testing to targets beyond the carrier's own edge
• Asymmetric hysteresis — fast to fail away from a broken link, slow and deliberate to fail back
• Policy-based reroute per subscriber tier, so you choose who moves first
• Fallback routes with gateway checking, and automatic return when the carrier recovers
• Backup routes on every pinned path — dedicated customer lines, the router's own default route and its DNS forwarding, so one dead modem cannot blackhole anyone
• Scheduled carrier windows — switch upstreams by time of day where your carriers price or perform differently at night
• PCC load balancing across multiple lines, with per-connection classification and an upload cap — and per-subscriber hashing where a service needs one public IP
• Quota-aware balancing — when a line spends its daily allowance, its share moves to the least-loaded healthy line and comes home when the window closes. Moved shares are spread across lines, never stacked on one
• Standby server hand-off — when a standby PPPoE/RADIUS server takes over a tier, the main router releases that tier's sessions so customers redial onto it, then takes them back once it is healthy. In a live drill a 13-subscriber tier was on the standby in 20 seconds and home again within a minute
• Cache failover — if the carrier whose caches you use goes down, cache lookups move to a second carrier's caches, and only what that carrier really caches stays unlimited
• Link-state uplink swap — for a layer-2 uplink with a spare path: one port at a time, confirmed over two checks, restored the moment the primary returns
• Every move reported to your phone in one plain sentence; the technical detail stays in the router log

Why not netwatch

Netwatch pings one address and flips one flag. It has no hysteresis, so a carrier that drops two packets triggers a failover, and a carrier that half-recovers triggers a flap. It also cannot tell the difference between a dead uplink and a dead ping target — this engine was built after a probe address that had never existed reported a working carrier as down every morning at three. Probe targets are validated, and loss is measured over a window rather than a single packet.

What it will not do

Fail over on a fault that follows you to every link. An unpaid upstream account or a dead RADIUS peer fails the same way on the backup path, so a session-based trigger just swaps links every cycle and fixes nothing. Triggers are link and path conditions only. The window scripts apply rates before they flush connections and guard every step, so a script that dies halfway cannot leave customers on the wrong rates for an evening.