# Sanctum Auto FailOver with Uptime Kuma # Omada Dual-WAN Monitoring Architecture ## Airtel + Canal+ with Uptime Kuma --- # Network Layout | Device | IP | Purpose | |--------------|----------------------|----------------------------| | Kuma-Canal | 10.10.1.50 | Monitor Canal+ | | Kuma-Airtel | 10.10.1.51 | Monitor Airtel | | Omada Gateway| 10.10.1.1 | Policy Routing | | Rackpeek | 10.10.1.70:18080 | Rack/services dashboard | Rackpeek services list: --- # Proxy Hosts / Services Reverse-proxy hosts published via Rackpeek. All `Public` access, all `Online` as of last sync. Service names are the proxy source (`.sanctum` suffix omitted). Entries marked `?` are inferred from the port or still need confirmation. | Service | Destination | SSL | Access | Status | Created | |------------------------|------------------------|--------------------|--------|--------|-------------------------------| | ? | http://10.10.1.78:8181 | Custom Certificate | Public | Online | Nov 20, 2025 at 3:47:23 AM | | Uptime Kuma (Airtel) | http://10.10.1.51:3001 | Custom Certificate | Public | Online | Nov 25, 2025 at 12:18:08 AM | | ? | http://10.10.1.6:8181 | Custom Certificate | Public | Online | Nov 20, 2025 at 3:48:33 AM | | Backup | http://10.10.1.11:8007 | Custom Certificate | Public | Online | Dec 4, 2025 at 1:09:02 PM | | Bazarr | http://10.10.1.70:6767 | Custom Certificate | Public | Online | Nov 25, 2025 at 2:54:35 AM | | ? | http://10.10.1.21:8181 | Custom Certificate | Public | Online | Nov 20, 2025 at 3:49:44 AM | | Uptime Kuma (Canal+) | http://10.10.1.50:3001 | Custom Certificate | Public | Online | Nov 25, 2025 at 12:16:37 AM | | ? | http://10.10.1.21:80 | Custom Certificate | Public | Online | Nov 20, 2025 at 3:51:05 AM | | ? | http://10.10.1.20:80 | Custom Certificate | Public | Online | Nov 20, 2025 at 3:51:50 AM | | Synology DSM ? | http://10.10.1.20:5000 | Custom Certificate | Public | Online | Nov 25, 2025 at 1:19:01 AM | | ? | http://10.10.1.7:8080 | Custom Certificate | Public | Online | Nov 20, 2025 at 3:53:28 AM | | ? | http://10.10.1.70:3030 | Custom Certificate | Public | Online | Nov 20, 2025 at 3:56:57 AM | | Homarr | http://10.10.1.20:7575 | Custom Certificate | Public | Online | Dec 4, 2025 at 1:05:58 PM | | ? | http://10.10.1.70:9080 | Custom Certificate | Public | Online | Nov 21, 2025 at 2:37:33 AM | | ? | http://10.10.1.70:8181 | Custom Certificate | Public | Online | Nov 21, 2025 at 2:41:13 AM | | ? | http://10.10.1.21:3002 | Custom Certificate | Public | Online | Nov 21, 2025 at 2:43:06 AM | | ? | http://10.10.1.70:8080 | Custom Certificate | Public | Online | Nov 21, 2025 at 2:43:56 AM | | ? | http://10.10.1.7:8181 | Custom Certificate | Public | Online | Nov 21, 2025 at 2:45:03 AM | | ? | http://10.10.1.7:8281 | HTTP Only | Public | Online | Nov 25, 2025 at 12:07:57 AM | | Uptime Kuma | http://10.10.1.20:3001 | Custom Certificate | Public | Online | Nov 21, 2025 at 2:50:20 AM | | ? | http://10.10.1.70:6246 | HTTP Only | Public | Online | Nov 24, 2025 at 1:33:47 PM | | Netdata | http://10.10.1.20:19999| Custom Certificate | Public | Online | Nov 30, 2025 at 10:25:35 PM | | ? | http://10.10.1.21:18789| Custom Certificate | Public | Online | Feb 18, 2026 at 7:30:40 PM | | Overseerr/Jellyseerr ? | http://10.10.1.70:5055 | Custom Certificate | Public | Online | Nov 21, 2025 at 2:51:13 AM | | ? | http://10.10.1.70:8212 | Custom Certificate | Public | Online | Nov 25, 2025 at 2:00:57 AM | | Plex | http://10.10.1.70:32400| HTTP Only | Public | Online | Nov 25, 2025 at 3:04:23 AM | | Portainer | http://10.10.1.70:9000 | Custom Certificate | Public | Online | Nov 21, 2025 at 2:52:39 AM | | Prowlarr | http://10.10.1.70:9696 | Custom Certificate | Public | Online | Nov 21, 2025 at 2:53:47 AM | | Proxmox VE | http://10.10.1.44:8006 | Custom Certificate | Public | Online | Nov 21, 2025 at 2:54:29 AM | | Nginx Proxy Manager | http://10.10.1.5:81 | Custom Certificate | Public | Online | Nov 21, 2025 at 2:55:02 AM | | ? | http://10.10.1.10:7655 | Custom Certificate | Public | Online | Nov 21, 2025 at 2:56:01 AM | | ? | http://10.10.1.70:8888 | Custom Certificate | Public | Online | Nov 21, 2025 at 2:56:35 AM | | Radarr | http://10.10.1.70:7878 | Custom Certificate | Public | Online | Nov 21, 2025 at 2:57:22 AM | | ? | http://10.10.1.5:8181 | Custom Certificate | Public | Online | Nov 21, 2025 at 2:58:12 AM | | ? | http://10.10.1.13:80 | Custom Certificate | Public | Online | Nov 21, 2025 at 3:00:30 AM | | ? | http://10.10.1.78:80 | Custom Certificate | Public | Online | Nov 21, 2025 at 3:01:36 AM | | Sonarr | http://10.10.1.70:8989 | Custom Certificate | Public | Online | Nov 21, 2025 at 3:02:24 AM | | ? | http://10.10.1.20:8888 | Custom Certificate | Public | Online | Nov 21, 2025 at 3:03:28 AM | | ? | http://10.10.1.21:8888 | Custom Certificate | Public | Online | Nov 21, 2025 at 3:04:31 AM | | ? | http://10.10.1.21:8080 | Custom Certificate | Public | Online | Dec 4, 2025 at 1:03:19 PM | | ? | http://10.10.1.70:7476 | HTTP Only | Public | Online | Feb 6, 2026 at 7:53:14 PM | | ? | http://10.10.1.20:9412 | Custom Certificate | Public | Online | Nov 25, 2025 at 1:16:55 AM | --- # Objective Detect ISP failures while maintaining Internet connectivity. Requirements: ``` 10.10.1.50 must always test through Canal+ 10.10.1.51 must always test through Airtel If Canal+ fails: .50 fails If Airtel fails: .51 fails Internet remains available through surviving ISP. ``` --- # Omada Configuration ## Load Balancing Navigate: ``` Settings → Wired Networks → Internet ``` Configure: ``` Load Balancing: Enabled WAN Weight: Airtel = 2 Canal+ = 1 Application Optimized Routing: Disabled Link Backup: Disabled ``` --- # Create IP Groups Navigate: ``` Settings → Profiles → Groups → IP Group ``` --- ## IP Group 1 Name: ``` Canal-Monitor ``` Type: ``` IP Address ``` Members: ``` 10.10.1.50/32 ``` Description: ``` Canal+ Monitoring Host ``` --- ## IP Group 2 Name: ``` Airtel-Monitor ``` Type: ``` IP Address ``` Members: ``` 10.10.1.51/32 ``` Description: ``` Airtel Monitoring Host ``` --- # IMPORTANT Correct: ``` 10.10.1.50/32 10.10.1.51/32 ``` Wrong: ``` 10.10.1.50/24 10.10.1.51/24 ``` A /24 includes the entire subnet. A /32 includes only the specified host. --- # Create Policy Routes Navigate: ``` Settings → Transmission → Routing → Policy Routing ``` --- # Rule 1 - Canal Monitor Name: ``` Canal-Kuma ``` Status: ``` Enabled ``` Protocols: ``` All ``` WAN: ``` Canal+ ``` Use the other WAN port if current WAN is down: ``` Disabled ``` Source Type: ``` IP Group ``` Source: ``` Canal-Monitor ``` Destination Type: ``` IP Group ``` Destination: ``` IPGroup_Any ``` --- # Rule 2 - Airtel Monitor Name: ``` Airtel-Kuma ``` Status: ``` Enabled ``` Protocols: ``` All ``` WAN: ``` Airtel ``` Use the other WAN port if current WAN is down: ``` Disabled ``` Source Type: ``` IP Group ``` Source: ``` Airtel-Monitor ``` Destination Type: ``` IP Group ``` Destination: ``` IPGroup_Any ``` --- # Why Failover Is Disabled Correct: ``` Airtel fails ↓ 10.10.1.51 loses Internet ↓ Kuma reports DOWN ``` Wrong: ``` Airtel fails ↓ Traffic silently moves to Canal+ ↓ Kuma stays UP ↓ Failure hidden ``` Monitoring hosts must fail with their assigned ISP. --- # Uptime Kuma Configuration ## Kuma-Canal Host: ``` 10.10.1.50 ``` Monitor: ``` 1.1.1.1 8.8.8.8 ``` Traffic forced through Canal+. --- ## Kuma-Airtel Host: ``` 10.10.1.51 ``` Monitor: ``` 1.1.1.1 8.8.8.8 ``` Traffic forced through Airtel. --- # Validation Tests ## Test Canal+ Disconnect Canal+. Expected: ``` 10.10.1.50 → DOWN 10.10.1.51 → UP Internet → UP ``` Reconnect Canal+. Expected: ``` 10.10.1.50 → UP 10.10.1.51 → UP ``` --- ## Test Airtel Disconnect Airtel. Expected: ``` 10.10.1.51 → DOWN 10.10.1.50 → UP Internet → UP ``` Reconnect Airtel. Expected: ``` 10.10.1.51 → UP 10.10.1.50 → UP ``` --- # Troubleshooting If both monitors fail together: Check: ``` IP Groups are /32 ``` Check: ``` Destination = IPGroup_Any ``` Check: ``` Use other WAN if down = Disabled ``` Check: ``` Application Optimized Routing = Disabled ``` These four settings are responsible for most routing issues in this design.