Redundant Internet Setup Guide for Israel
January 25, 2026 · View on GitHub
A guide to setting up highly available multi-WAN internet in Israel with dual fiber + cellular configuration using OPNsense for automatic failover.
Download the PDF Guide for a printable version with all diagrams and screenshots.
Overview
This guide provides a practical walkthrough for setting up failover internet in Israel, designed for consumers, small businesses, and work-from-home professionals.
The Problem
In Israel, internet connectivity can be disrupted by:
- Road construction cutting fiber/DSL cables
- ISP outages
- Infrastructure maintenance
For remote workers and small businesses, even brief outages can be costly.
The Solution
A fiber + cellular failover configuration using OPNsense provides automatic, reliable backup:
- When your primary fiber connection fails, traffic seamlessly switches to cellular
- When fiber recovers, traffic returns automatically
- No manual intervention required
Why Fiber + Cellular?
- True Redundancy: Fiber and cellular use completely separate infrastructure
- Cost-Effective: Cellular data-only SIMs in Israel cost as little as ~20 NIS/month
- Reliable Failover: OPNsense handles both failover and fail-back reliably
Network Architecture
Network Topology
Key elements:
- Two separate WAN connections enter OPNsense through different interfaces
- OPNsense monitors both gateways by pinging external DNS servers
- Traffic routes through fiber (primary) under normal conditions
- Automatic failover to cellular when fiber fails
- Automatic fail-back to fiber when it recovers
Physical Wiring
Important notes:
- Connect the LAN port of each gateway to OPNsense WAN ports
- Use the blue 2.5Gbps port on the Bezeq gateway for full speed
- Use Cat 6a/7 cables for 2.5Gbps connections
- All equipment should be powered through the UPS
Failover Behavior
The failover process:
- OPNsense continuously pings monitoring IPs (e.g., 8.8.8.8 for WAN1, 1.1.1.1 for WAN2)
- When pings to WAN1 fail, OPNsense marks the gateway as down
- After ~30 seconds, traffic switches to WAN2 (cellular)
- When WAN1 pings succeed again, traffic returns to the primary connection
Hardware Requirements
Shopping List
| Component | Description | Est. Cost |
|---|---|---|
| Mini PC Router | 4-port 2.5GbE NICs for OPNsense | 400-600 NIS |
| Cellular Gateway | 4G/5G modem with SMA antenna support | 150-800 NIS |
| 2.5G Switch | Managed or unmanaged 2.5GbE switch | 200-400 NIS |
| UPS | Basic UPS for network equipment | 300-500 NIS |
| Network Cabinet | Optional but recommended | 200-400 NIS |
| Cat 7 Cables | 2.5Gbps capable Ethernet cables | 50-100 NIS |
| Cellular Antennas | External SMA antennas (optional) | 50-150 NIS |
| SFP+ Transceivers | For internal fiber runs (optional) | 50-150 NIS each |
| Fiber Patch Cables | LC-LC multimode OM3/OM4 (optional) | 30-80 NIS |
Mini PC with OPNsense
The heart of this setup is a mini PC running OPNsense:
- Minimum 3 Ethernet ports (2 WAN + 1 LAN), preferably 4
- 2.5GbE ports to utilize faster fiber plans
- Low power consumption for 24/7 operation
Available on AliExpress (~$100) or locally at Ivory/KSP.
Bezeq Fiber Gateway
Bezeq provides a fiber gateway (Heights Telecom hardware, branded "B Fiber"). The current common model is the Heights Telecom HT-360AX:
- One blue 2.5Gbps port — use this for your OPNsense connection
- Yellow ports are limited to 1Gbps
- Default IP:
192.168.1.1 - Password: last 6 digits of serial number (found on bottom label)
Cellular Gateway Options
You need a true gateway/modem, not a router. OPNsense handles all routing.
Budget Option: Generic 4G LTE Gateway
Available on AliExpress. Look for:
- "CPE Gateway" or "Industrial LTE Modem"
- External SMA antenna support
- LAN port output
Gold Standard: Teltonika Industrial Gateways
For professional-grade reliability:
- Teltonika RUT240 (4G LTE)
- Teltonika RUTX50 (5G)
SFP Transceivers and Fiber Cabling (Optional)
For longer internal runs or a cleaner backbone between your router and switches, consider using SFP+ fiber instead of copper Ethernet.
When to use SFP fiber:
- Runs longer than 10 meters
- Reducing electromagnetic interference
- Future-proofing for 10GbE
- Cleaner cable management (thinner cables)
Recommended transceivers:
- 10GbE SFP+: Generic/unbranded 10GBASE-SR transceivers work well (~50-100 NIS each on AliExpress)
- Brand options: FS.com, 10Gtek, or Cisco/Mikrotik compatible modules
- Ensure compatibility with your switch and NIC (most accept generic transceivers)
Recommended cables:
- Short runs (< 5m): DAC (Direct Attach Copper) SFP+ cables — cheapest and simplest
- Longer runs (5-100m): LC-LC multimode fiber patch cables with OM3 (aqua) or OM4 (aqua/violet)
- Very long runs (> 100m): Single-mode fiber with appropriate transceivers
Cable tips:
- OM3/OM4 multimode is sufficient for most home/office distances
- LC connectors are standard for SFP+ modules
- Pre-terminated patch cables are easier than field termination
- Available locally at Ivory, KSP, or from AliExpress/FS.com
Cellular Data Plans
Search for "סים לגלישה בלבד" (data-only SIM):
- Pelephone — Recommended, plans from ~20 NIS/month
- Partner
- Cellcom
- HOT Mobile
Software Configuration
Bezeq Gateway Setup
- Access the gateway at
192.168.1.1 - Login with last 6 digits of serial number
- Disable DHCP Server (OPNsense will handle DHCP)
- Verify LAN4 shows 2500 Mbps speed
OPNsense Interface Configuration
Configure three interfaces:
- WAN — Bezeq Fiber (primary)
- WAN2 — Cellular (backup)
- LAN — Local network
WAN Interface (Bezeq Fiber)
- IPv4 Configuration: Static IPv4
- IPv4 Address:
192.168.1.2/24 - MTU:
1492(required for Bezeq) - IPv4 Gateway Rules: Disabled
WAN2 Interface (Cellular)
- IPv4 Configuration: DHCP or Static
- Use a different subnet (e.g.,
192.168.188.2/24)
LAN Interface
- IPv4 Address:
10.0.0.1/24 - DHCP: Enabled
- DHCP Range:
10.0.0.100to10.0.0.250
Gateway Configuration
Navigate to System → Gateways → Configuration:
Important: Use different monitoring IPs for each gateway (e.g., 8.8.8.8 and 1.1.1.1).
Creating the Failover Group
Navigate to System → Gateways → Group:
Create a group with:
- Group Name:
WAN_Failover - WAN (Bezeq): Tier 1
- Cellular: Tier 2
- Trigger Level: Member Down
- Pool Options: Default
NAT Configuration
Navigate to Firewall → NAT → Outbound:
- Select Hybrid outbound NAT rule generation
- Create manual rules for each WAN interface:
- Interface: WAN (and WAN2)
- Source: LAN net
- Translation: Interface address
Testing
Verify Primary Connection
Run a speed test to confirm full speed on fiber:
Failover Test Procedure
- Start a continuous ping:
ping 8.8.8.8 - Disconnect the primary: Unplug Bezeq or power off the gateway
- Observe failover: After ~30 seconds, traffic switches to cellular
- Run a speed test: Confirm you're on cellular (lower speeds)
- Reconnect the primary: Power on Bezeq
- Verify fail-back: After ~30 seconds, traffic returns to fiber
The fail-back test is critical. Some systems fail to return to primary after recovery. OPNsense handles this reliably.
Troubleshooting
No Internet After Configuration
- Verify DHCP is disabled on upstream gateways
- Check OPNsense WAN interfaces have correct static IPs
- Ensure firewall rules allow LAN to WAN traffic
Slow Speeds on 2.5Gbps Plan
- Use the blue 2.5Gbps port on Bezeq gateway
- Check interface speed settings in OPNsense
- Use Cat 6a/7/8 cables throughout
Failover Not Working
- Verify both gateways show "Online" in OPNsense
- Check monitoring IPs are different for each gateway
- Ensure gateway group is applied to firewall rules
- Check NAT rules exist for both WAN interfaces
Cellular Connection Issues
- Verify SIM is recognized in gateway web interface
- Check APN settings (usually auto-configured)
- Try external antennas if signal is weak
Why Not TP-Link Multi-WAN Routers?
From experience with the TP-Link ER605:
- Failover to cellular works
- Fail-back to primary often doesn't work
- Results in staying on expensive cellular when fiber is available
OPNsense provides reliable bidirectional failover.
Summary
| Component | Configuration |
|---|---|
| Primary Connection | Bezeq Fiber (2.5Gbps capable) |
| Backup Connection | Pelephone cellular data (~20 NIS/month) |
| Router/Firewall | OPNsense on mini PC |
| Key Settings | MTU 1492, Gateway groups with tiers, Hybrid NAT |
The result is automatic, reliable failover that:
- Switches to cellular when fiber fails
- Returns to fiber when it recovers
- Requires minimal ongoing maintenance
Resources
- PDF Guide — Printable version with all screenshots
- OPNsense Documentation
- Teltonika Products
Author
Daniel Rosehill January 2026