Best Dual Wan Routers (Best Business Firewall VPN Routers in 2024)

Choosing the best dual-WAN router may prove to be a bit difficult considering that this type of devices weren’t created for home use, their functionality and complexity being far beyond the needs of the usual user (setting up a multi WAN router can be tedious), and, while the emergence of the DOCSIS 3.1 could have helped seeing more dual WAN routers within the consumer market, it didn’t really go that route.

Even so, the dual-WAN routers (or multi-WAN routers) are needed by businesses (no matter their size) and were created to give your organization an edge over the competition by maintaining a stable Internet connection, without relying on a single ISP. This is extremely important because running a business successfully can’t allow any downtime period (and nowadays, being connected to the Internet is a vital point for ensuring the survival of a company).

UPDATE 01.08.2024: The Zyxel USG Flex 200HP Dual-WAN VPN Router has been added to the best dual WAN routers list.

Zyxel USG Flex 200HP	Zyxel USG Flex 100	DrayTek Vigor2926	TP-Link TL-ER7206
Read More	Read More	Read More	Read More

Mikrotik CCR1009-7G-1C-1S+PC	Peplink Balance Two	Ubiquiti EdgeMAX EdgeRouter Lite ERLite-3	Synology RT2600ac
Read More	Read More	Read More	Read More

 

Of course, the Dual (or Multi) WAN router can also help get a better throughput and uniformly balance the handling of the data packets between the two (or more) separate connections (to avoid bandwidth throttling). This desirable feature is called load balancing (or multi-homing) and, besides balancing the network usage, it will also provide network redundancy, meaning that, if one of the WAN links fails, you still get access to your network resources using the secondary WAN link.

Best 3 dual WAN routers brief comparison

Now, you may wonder why not simply go for multiple routers instead of a multi-WAN single router? The price is an answer, but other aspects, such as the aforementioned load balancing is going to become more complicated, so there is little to no gain.
Since we saw how important it is to have a multi-port router when running a successful business let’s look at the best dual WAN VPN router solutions that the market has to offer.

1. Zyxel USG Flex 200HP

Read the full review of Zyxel USG Flex 200HP

Just like the Flex 100, the Zyxel USG Flex 200HP deserves to be a part of this article, moreso considering the improvements that the manufacturer has made and which are reflected in the new gateway series. The Flex 200HP is quite a bit more than just a reliable dual WAN router, sporting two multi-Gigabit WAN ports, from which one is PoE, there’s the throughput over SPI firewall, UTM, VPN and the ISP is far more optimized.

Also, software-wise, we get a robust package of security features (including the aforementioned IPS). There is more because the dual WAN gateway comes with uOS and it can be managed both locally, as well as on the Cloud (Nebula Cloud Center). Design-wise, the device is rectangular, completely made of metal and the color palette of choice is gray with red accents on the front. The router is a bit wider than the FLEX 100, so it’s easier to mount it in a rack, but do be aware that the Power connector is on the rear side.

On the front, besides the two 2.5GbE ports that I already mentioned, there are six other regular Gigabit LAN ports, a USB-A port and a Console port. There are, of course, some LEDs to show the status of the device and of each port. Zyxel has been very confident that the USG Flex 200HP is optimized well enough as to handle a lot of stress without having to rely on active cooling. Instead, there are two large heatsink plates inside the dual-WAN router which should properly dissipate the heat.

I have attached some photos to see how well it fared while I was running the multi-client stress tests. So it pretty much can’t get hotter than that.

It’s worth mentioning that the device does use a quad-core 1.4GHz CPU (Marvell ARMADA 7050 CAT72) CPU, it has 8GB of RAM, 8GB of storage memory and it also relies on a couple of Marvell 88E2111-BWS4 switch chips for the two 2.5GbE ports. In terms of security, the firewall gateway offers the standard DoS protection and a SPI firewall (set the number of access rules and block requests). Also, you get bandwidth management (set up the upstream and downstream speeds), IPS (needs to either be set on Prevention or Detection), Anti-Malware and Content Filtering.

The Zyxel USG Flex 200HP also has some VPN-related features, including the support for SecuExtender, IPsec, L2TP and SSL connections. Now let’s talk about the two WAN connections. As I mentioned, they’re both 2.5GbE and the supported trunk is Weighted Round Robin. This is the only type available at the moment and I did test how quickly the dual WAN router switches between connections.

And the result is about one second which is a good performance. I didn’t run the usual iperf tests where you check how fast a single connection to a single client is since it would pretty much be pointless and instead, I decided that it’s better to put some stress on the device and run various types of traffic simulations on multiple client devices at the same time. Obviously, this is just a sneak peak and you will have to read the full review to see all the results that I got. Of course, the dual WAN router did handle the clients well.

I need to mention that you can configure the Zyxel USG Flex 200HP locally, where you get the bulk of settings and options, but it is also possible to add the gateway to a larger site with multiple other types of devices. This way, it’s easier to configure them together and monitor them remotely.

2. Zyxel USG Flex 100

Read the full review of Zyxel USG Flex 100

The USG Flex series has been a long favorite of SMBs that needed a reliable security gateway that could balance at least a couple of Internet connection and Zyxel has refreshed the series last year to include the USG Flex 100 which, despite being the entry-level model, it has proven capable of handling a fairly demanding network, while also maintaining the security of your network. And the good news is that not very long ago, the manufacturer has added the USG series under Cloud platform management. And this is a huge step since besides being able to work perfectly fine as a stand-alone device (with only a few APs), it can be integrated in a far larger network, offering an easier way to control multiple access points, Ethernet switches and working alongside other gateways.

While the Zyxel USG Flex 100 will work as a router, its design is nothing like the regular home-suitable wireless routers. Instead, we get an old-school rectangular case made of metal with lots of heat vents on top and the sides and two red front parts for the logo and model. And yes, it does remind me of the USG40 which has been a part of the best dual wan router list for a long time. Size-wise, the USG 100 Flex is slightly bit larger than the USG40, measuring 11.18 x 7.48 x 3.94 inches and both devices do rely on passive cooling (there are no fans).
On the front, in between the red accents, there are the LED status lights responsible for Power (PWR), System (SYS), six Ethernet ports (P1 to P6) and there’s also a USB 3.0 port. The rear side of the USG Flex 100 is home to the Power connector, an On/Off button, an SFP port (Gigabit), a Console port (used for managing the router using CLI commands), a WAN port and four LAN/DMZ Ethernet Gigabit ports.

The case is definitely far more rugged than your regular router, but let’s also see what’s inside the USG Flex 100. The tear-down process has revealed a Qualcomm QCA8337 Ethernet switch chip, 8GB of flash memory from Kingston, an Intel ALTERA 5M160ZE64C5N CPLD and a Qualcomm Atheros AR8033 PHY. In terms of wireless connectivity, you will have to purchase a separate wireless access point since this device lacks any WiFi capabilities (check out the excellent WAX650S).
The USG Flex 100 was initially designed to work as a sort of stand-alone device since it did have the means to monitor and configure multiple APs at the same time, and the user interface was (and still is) feature-rich, covering everything one may expect from a security gateway (including URL Threat Filter, the Anti-Malware, IDP, App Patrol and more). But, since the point of this article is to cover the best dual WAN routers, the Zyxel USG Flex 100 does have the means to balance two Internet connection and more.

I know that it has a single WAN port, but you can make use of either the SFP or the OPT port to add a secondary connection. So, if you want to balance the traffic load, you can rely on trunks (System Default WAN Trunk with the Least Load First algorithm) and, in my test, after disconnecting one link, the router would immediately switch to the secondary available Internet connection. The mode for each trunk interface can either be Active or Passive and you can enable the Disconnect Connections Before Falling Back, so, in case the interface that was set to Active regains the link, it will automatically switch back from the secondary connection. The Zyxel USG Flex 100 can also rely on the Weighted Round Robin algorithm for load balancing, ensuring that in case the two links have different bandwidths, the device will distribute the clients on a rotating basis.

There is also the Spillover algorithm where the traffic is first sent to the first WAN interface and, when it reaches the maximum allowed load, the device will send the ‘excess traffic’ to the secondary link. Trunking is not the only way to handle a dual-WAN connection since you can simply set a policy route for the Incoming Interface to the first WAN and the Next-Hop to the secondary interface; don’t forget to create a Policy Route the other way around. Using this method, I noticed that the USG Flex 100 required about 5 seconds to switch from one link to the other.
If you decide to move to the Cloud, the Zyxel USG Flex 100 will keep its features, but they will be distributed differently and don’t forget to check out the changed system for the security-related licenses – you can see a more detailed analysis on how Zyxel has added the USG Flex 100 to the Cloud management platform.

3. DrayTek Vigor2926

Read the full review of DrayTek Vigor2926

DrayTek is a Taiwanese manufacturer of (mostly) enterprise-grade networking products, including VPN devices, firewalls, routers and other types of wireless LAN devices (mainly with a focus towards the SMBs). DrayTek is known as being one of the first manufacturers to implement the VPN technology into less expensive routers and, right now, it basically is the go-to-company if you don’t want to purchase very expensive equipment from Cisco, Arista or Juniper (therefore being a godsend to start-up companies that don’t have a large budget). One of its more interesting products is the DrayTek Vigor2926, a dual WAN router created to replace the popular Vigor2925.

The Dual WAN routers aren’t known to be very aesthetically pleasing and most have a plain, industrial look (begging you to hide it in some corner or in a closet), but DrayTek, despite having kept the same design approach for almost a decade, it has made its broadband routers feel surprisingly fresh even in 2019. So, the case of the Vigor2926 remains rectangular, but the top has a wave-like form, covered by a black matte finish and lots of small longitudinal canals which slightly expose the internal hardware. While some other dual WAN routers are metallic, the case of Vigor2925AC is entirely made of plastic but, despite that, the device has the element of uniqueness and it doesn’t look as the other routers on the market (some consumer-type routers could learn a thing or two).

The Vigor2926 is not really a compact device, but its footprint is smaller than some consumer-type routers, measuring 9.48 x 6.50 x 1.73 inches and because the device weighs about 1.1 pounds, the Vigor2926 will feel sturdy and stable, even if you connect lots of cables to it. Another important aspect is the fact that the manufacturer has covered the bottom side almost entirely with ventilation cut-outs which do have an impact into how the heat management is handled: even under stress, the router did not overheat, but there were some warm spots on the top and bottom of the device.

On the front of the Vigor2926, you can find a series of LED lights which show the status of ACTivity, WAN1 and WAN2 (if any of the three aforementioned LED is blinking, it means that the data is being transmitted or received), QoS (if it’s on, then the QoS function is active), USB1 and USB 2 (if any of the two LEDs blinks, then data is being transmitted / received), WCF (it’s on when the Web Content Filter feature is active), VPN and DMZ. On the left of the LED lights, you can find a single recessed button for returning the device to the factory default settings (press and hold the button for more than 5 seconds).

On the right side of the LED lights, there are four 10/100/1000Mbps Base-TX Ethernet LAN RJ-45 LAN ports (each port has two LED lights – if the left LED is blinking, it means that data is being transmitted; if the right LED is enabled, then the port is connected at 1000Mbps, otherwise, if it’s off, then the connection is at 10/100Mbps), a 1000Base-TX RJ-45 WAN1 port, a 1000Base-TX RJ-45 WAN2/LAN port (can be used for the dual WAN feature if you need two Internet connections at the same time or simply as a LAN port) and further to the right, there are two USB 2.0 ports (useful if you want to connect printers, storage devices, environmental thermometers or 3G/4G/LTE modems). The rear side is populated by a PWR connector (for the adapter) and an On/Off switch (there are no antenna connectors).

Inside the case, the DrayTek Vigor2925AC is equipped with a Qualcomm Atheros AR8035-A Ethernet PHY Chip, 128 MB Toshiba TC58NVG0S3ETA00 flash memory, 128MB of RAM (WINBOND W971GG6SB-25) – the main chip is clocked at 720MHz (couldn’t access it because DrayTek covered the area with a non-removable plate).

In terms of software features, DrayTek Vigor2925AC doesn’t lack anything important. You get the dual WAN port used for FailOver and Load-Balancing (if you connect 3G/4G/LTE modems to the two USB ports, it will be added to the load balancing pool). The Failover feature works like this: if the first Internet connection fails, the router automatically switches to the other WAN port (the process doesn’t take more than 2-3 seconds) and, when the primary WAN regains its connection, the router will switch you back from the secondary WAN connection (this time, the process takes about 5 seconds); the Load Balancing feature keeps both Internet connections active at the same time, creating a ratio for the number of sessions that will be connected to either of the two WANs – furthermore, you can also use a single WAN port for certain websites or aggregate the ports to increase the total available bandwidth.

The Vigor2926 also supports multiple types of VPN, such as IPsec, L2TP with IPsec, PPTP, SSL and Open VPN; there’s also VLAN tagging, Smart Monitor Traffic Analyser, Bandwidth Management (set bandwidth limits by number of simultaneous sessions or IP; QoS) and a lot more. In terms of security, the Vigor2925AC features an Object-based SPI Firewall, DoS Defence (Ports Scan detection, SYN, UDP, ICMP defences and the ability to block IP options, Ping of death, trace route and so on), Spoofing Defence (IP and ARP Spoofing) and more. The Vigor2926 features a Central Management utility, allowing you to locally manage additional DrayTek devices connected to the network (switches, access points), but the manufacturer also allows you to adopt the Vigor2926 within a controller (VigorACS 2).

Considering that the Vigor2926 comes with two USB ports, I decided to test the storage performance of the router: using a Samsung T5 SSD drive (FAT32), I moved a 3GB multimedia folder and the writing speed was 10.13 MBps and the reading speed was 10.26 MBps. Afterwards, I decided to test the wired performance of the router using two computers, one as the server and the other as the client: from the client to the server, I got an average of 949 Mbps and, from the server to the client, I measured an average of 921Mbps.
Note: The DrayTek Vigor2926 is also available in other variations: with integrated VoIP and wireless capabilities (the Vigor2926Vac), using only the wireless N technology (Vigor2926n) and with both the 2.4GHz and 5GHz radio bands (Vigor2926ac).

4. TP-Link TL-ER7206 Dual-WAN VPN Router

Read the full review of TP-Link TL-ER7206

The TP-Link TL-ER7206 is one of the most inexpensive multi-WAN routers available on the market and, while not as powerful as some of the other dual WAN routers in this list, it can definitely hold its own against its main competitors. And this includes the inexpensive option from Ubiquiti, the EdgeRouter-X. But can it be a reliable replacement for the Cisco RV340 and RV345 as well?

After hearing that Cisco will discontinue the series after already reaching EOL, there are some big shoes to fill and, after testing the TP-Link TL-ER7206, I can say that it can handle a small to medium network (SMBs, basically), but you will have the best performance if you switch to a full Omada ecosystem.

The TP-Link TL-ER7206 uses a compact all-metal case covered by a black matte finish and, while I do appreciate having to deal with smaller networking devices, there is a shortcoming. And that’s the difficulty of using it in a rack – you will need a tray.

Then, TP-Link made the uninspired decision to not add mounting holes on the bottom of the dual-WAN router, which means that it can only be positioned on a flat surface. I did check the TP-Link TL-ER7206 temperature while I was running some tests and it didn’t show any signs of overheating (I included a thermal photo in the full review as well).

As for the available ports, you get a WAN SFP port, followed by one dedicated Ethernet Gigabit port, two WAN/LAN ports (can work in either mode) and two Ethernet Gigabit LAN ports. This means that you get a large variety of options to choose from in case you need to run load-balancing or to rely on failover / failback techniques. The TP-Link TL-ER7206 does offer a standalone mode where you can configure the router to function the way you want it to, but you do lose on some important aspects.

For example, I could not find how to set the ratio using load balancing in standalone mode, but the most important loss is that you can’t configure and monitor multiple devices at the same time using the Omada SDN.

This software has grown quite a bit the last few years and it resembles in many aspects the UniFi controller. So, to set up the features related to the dual-WAN functions, I adopted the router to the Omada SDN.
This way, I was finally able to set the ratio for the bandwidth when using two or more concurrent Internet connections.

Then, I decided to check out just how quick the TP-Link TL-ER7206 is when disconnecting the primary WAN and switching to the secondary one. To do so, I pinged two websites and simply checked how many packets would be lost. Both pings were paused for a brief moment, with only a single packet loss, so the dual WAN router is quite fast in this regard. This is not all because I also need to see the LAN-to-LAN performance which, as expected, it was good. I saw an average of 945Mbps upstream and an average of 887Mbps downstream.

But, the TP-Link TL-ER7206 is also a VPN gateway, so I decided to check out a couple of the available ones.
The router will allow you to set up 50 OPenVPM connections, 100 LAN o LAN IPSec connections, 50 PPTP VPN connections (careful because it’s not the most secure protocol) and 50 L2TP connections.

I did configure an L2TP VPN policy and Client (which was a very simple process) and then I used an iPhone to connect to the router in a secure manner. And it worked wonderfully well, even if the throughput wasn’t as high as I hoped. Then, I also used a laptop for a PPTP connections (the iPhone no longer supports PPTP) and again, it worked fine, but the throughput is not that great (19Mbps up and 12Mbps downstream).

The TP-Link TL-ER7206 has some security-related features implemented, as expected, and it offers URL Filtering, Access Control and the Firewall, where I liked to set the State Timeout. In terms of hardware, TP-Link TL-ER7206 was not completely transparent to me because I was unable to remove the heatsink which hides the main chip, but I do know that we’re dealing with a dual-core CPU clocked at 880MHz.

I have encountered this configuration before and it was a Mediatek CPU – maybe this is what we’re dealing with here as well. Besides the CPU, there are 512MB of RAM from Samsung, 128MB of flash memory from ESMT and the Realtek RTL8365 as the switching chip.

5. Peplink Balance Two

The Peplink Balance One has been a long time favorite for both small businesses and home (power) users due to its excellent ability to offer a seamless balance between more than one Internet connection; furthermore, beside featuring a couple of WAN ports (for dual WAN balancing), the router also offered LTE connectivity (through a USB port – it supported 4G LTE / 3G modems) and I know that it’s now a common occurrence in the SMB networking market, but it was less so about five years ago, when the dual WAN router was released. The Peplink Balance One is still supported, but it may actually be nearing the end of its life cycle considering that the manufacturer decided to refresh a few of its dual WAN routers – yes, there’s even a Balance 20X available now, but we’re going to focus on the Peplink Balance Two.

The name does suggest that we may see some radical improvements over the last generation and indeed, the Balance Two is a completely different device on the inside and on the outside as well when put next to the Balance One. Both dual WAN routers have rectangular metallic cases, but the Balance Two is significantly more compact than its predecessor (measures 7.4 x 6.9 x 1.7 inches vs 10.7 x 6.3 x 1.2 inches) and, while the Balance One was all black, the newer router has the yellow band on the front along with the Peplink logo (the rest of the case of the remains covered by a black matte finish).

And that’s where the similarities end since the Peplink Balance Two features a very plain front area, with only two LEDs populating it, the first responsible for the Status of the device (solid red indicates that the device is booting up, flashing red shows that there is a boot-up error and green means that everything is working properly – if it’s off, it means that it is upgrading the firmware) and the other LED shows the status of the Power (when it’s green, it means that the dual WAN router is powered on). The rear side of the Peplink Balance Two is populated by a Reset button, 12V DC Power connector, a Console port and next to it, there are four Ethernet Gigabit LAN ports and two Ethernet Gigabit WAN ports.

I know that the Peplink Balance 20X is compatible with some expansion slots, but, unfortunately, the excellent cellular capabilities of the 20X have not been ported on the Balance Two. This does allow it to remain very compact (you need space for the expansion slot) and yes, it does not have any internal fan, the Balance Two relies solely on passive cooling. I have seen a similar approach on a PoE switch from ZyXel (GS1920-8HP) which was also very compact and powerful, but it did run a bit hot regardless of the amount of ventilation cut-outs.

The Peplink Balance Two does have ventilation holes on the lateral sides, as well as on the bottom and it does help to a certain degree to keep the temperature low, but then device will get warmer when under a heavier load – I do appreciate that it runs quiet (due to the fanless design) which makes it easy to be positioned pretty much anywhere in the room. That being said, you can mount the Peplink Balance Two on the wall (using the two dedicated mounting holes on the bottom) and there are holes on the lateral sides if you decide to mount the router into a rack. If you want to keep it horizontally, there are four silicone feet to maintain the device into position and not move around when you add more than a couple of cables (the weight is also an important factor to its stability – it weighs 2.2 pounds).

The Peplink Balance Two has been very recently released, so there isn’t that much info about its internal hardware, but it does seem to be using a Broadcom chipset and in terms of RAM, the dual-WAN router makes use of 4GB DDR3L 1600 SODIMM from Innodisk; it also seems like you should be able to replace it for something better (the process looks identical to how you would do on a laptop). While the Peplink Balance One had WiFi capabilities, featuring both the 2.4 and the 5GHz WiFi radio bands (the 802.11ac/a/b/g/n standard) and the antennas were internal, the Peplink Balance Two does not have built-in WiFi, so you will have to rely on a wireless access point to connect your clients to a WiFi network. I wasn’t really impressed by the wireless performance of the Balance One, so I do find the necessity to use an AP to be the better choice especially in a SMB environment.

By default, the stateful firewall throughput of the Peplink Balance Two is 1Gbps and that’s quite something for a device in its price range – for example, its predecessor, the Balance One could only go up to 600Mbps and it would suffer a cut to 400 Mbps when activating the BPL-ONE-LC-5WAN license, thus converting the LAN 1, 2 and 3 into WAN 3, 4 and 5, so, you could get five WAN ports available.
The Peplink Balance Two does not have this possibility (for now), but you still do get two WAN ports to take advantage of the load balancing feature, which can be customized by defining specific traffic types and prioritize them (supports Failback and SpeedFusion Hot Failover, which ensures that the secondary link instantaneously gets enabled after the main link is down) and, there is bandwidth aggregation (LACP) in case you want to bond the two Internet links together.

Additionally, thanks to the USB 2.0 port, the router supports WWAN connectivity (a wireless form of connecting to the Internet, using cellular tower technology). Other important features are the PPTP VPN Server and IPsec VPN, the Advanced QoS (includes Bandwidth Reservation and Individual Bandwidth Limit per User Groups; there’s also Application Prioritization), an Access Point controller (which works best with Peplink’s AP One and the AP Pro), there’s also Captive Portal support (RADIUS authentication + customizable splash page) and PepVPN, which creates a secure Ethernet tunnel over any IP connection (L2/L3) and it is fully compatible with any dynamic IP environment and NAT (it will also work along with SpeedFusion).

6. Mikrotik CCR1009-7G-1C-1S+PC

Mikrotik is a well known networking company in the enterprise market, while it’s less popular in the consumer market for the same reason: the great, but very complex RouterOS which has a steep learning curve, but it does offer an incredible amount of customization and flexibility and, while their competitors often deliver a similar set of features, it usually comes at a vastly higher price tag. Pair the RouterOS software with the large variety of appliances and you get a great solution for small to medium businesses.

Since we have focused on small business dual WAN routers, the device of interest is going to be the Mikrotik CCR1009-7G-1C-PC, which comes with some major improvements over the last generations, such as the no switch-chip, so the Ethernet ports are now completely independent and have a direct connection with the CPU, thus completely removing any possible bottlenecks or any other types of performance loss.

At first glance, the Mikrotik CCR1009-7G-1C-1S+PC features the same metallic rectangular box that we find with most other Dual WAN routers, but, the Latvian-based manufacturer has a (good) habit of adding some design elements that will make their devices more interesting-looking than those from the competition. This time, the case is a bit taller, with some various cut-out patterns all around the body of the router: on the front just above the ports, on both the lateral side, as well as on the bottom side and even if it isn’t immediately obvious, there are some positioned on the rear side, but they’re covered by an unusual heat-sink (the case is entirely covered by a white matte finish which does not retain fingerprints).

The reason for that is because the CCR1009 relies on passive cooling and, since this is a powerful device, it needs as many vent holes as possible, but this are not the only measures Mikrotik took to ensure that the device remains cool, because it has also added a two heat-pipe internal system along with the aforementioned specially designed rear-positioned heat-sink (this way, even if you use the router at its maximum, the case will still remain cool (the heat-sink will naturally be a bit hot) and you won’t hear that annoying fan buzzing – it’s completely silent).

On the front side, underneath the long vent holes, there is a 10G SFP+ port (with two LED lights for Power and Activity), a regular 1G SFP port which, along with the first Gigabit Ethernet port which can create a combo-port, so it allows the user to choose which interface it prefers from the software, as well as having a hardware fail-over feature in case of a disconnect.

Further to the right, there is a set of seven Gigabit Ethernet ports (each with its own set of two LEDs) and be aware that the seventh port can be used for powering the router using passive PoE power (18-56V), while also allowing the user to use Etherboot / Netinstall for reinstalling the RouterOS. Besides the Ethernet ports, there’s also a Reset button (press and hold it during boot time until the LED lights start flashing and then release it to return the device to its default RouterOS configuration), an RS232 serial port with a Smart Card tray directly underneath it (the card must support GlobalPlatform JavaCard and is used to store your private key for features which support the Certificate based authentication), two LED lights, one for USR (User activity) and the other for PWR (Power) and, lastly, there’s a microUSB type AB port which can be used in various ways (such as for connecting a storage device or a 3G/LTE modem).

Turn the device around and on the left side of the heat sink, you’ll notice the DC 18-56V input jack as an alternative to the PoE port (on the left there are three ears to easily manage the cable) and on the right side, there’s a microSd card (inside a carved in area) and a wing nut. On top of the device, there is a small LCD touchscreen display which requires a bit of pressure to register a touch (as opposed to a smartphone display) and, similarly to pretty much every element of this device, it can be configured from the console menu: some of these settings allow you to change the colour scheme, choose the default info to be displayed, select the interface (performance stats, the connected clients, the bandwidth and more), set up an LCD PIN code and others.
Note: The router can be positioned on a flat surface or can be rack mounted.

Inside the case, the Mikrotik CCR1009-7G-1C-1S+PC is equipped with a TILERA TILE-Gx9 TLR4-00980CG-10CE-A3a CPU clocked at 1GHz (the CPU core count is 9), 2 GB of RAM (the lighter version CCR1009-7G-1C-PC only features 1GB of RAM) and 128 MB of NAND storage memory. Additionally, the router also features a PCB and CPU temperature monitor.

As I said in the introduction, every Mikrotik device comes with the RouterOS software (level 6 license) which is a very extensive and complex tool which allows for a great number of configurations for the initiated user (you do need to learn the way it functions and, thankfully, Mikrotik has provided lots of guides and a dedicated wiki page for every new user that want to learn: https://wiki.mikrotik.com). Of course, the object of interest is the dual-WAN capability (which includes load-balancing and the fail-over system) and the Mikrotik CCR1009-7G-1C-1S+PC does deliver a lot more control than expected. The RouterOS allows you to set up a dual-WAN setup using the PCC method (Per Connection Classifier), which is an interesting way of dividing the traffic into equal streams, while also keeping some data (with specific sets of options) in a particular stream, as well as enabling a failover, in case a gateway fails.

There’s also the Firewall marking method, which can be broken up in several applications, such as the Per-Traffic Load Balancing (useful in case you don’t have enough bandwidth for only one connection, therefore you can load-balance multiple Internet connections – this method involves breaking traffic in different types, using the Mangle Tool to mark the traffic, allowing some IP addresses to bypass this type of load-balancing and creating specific routes based on the marked traffic), the Load Balancing over Multiple Gateways, Load balancing multiple same subnet links and others. Other methods that can be used are the ECMP (Equal Cost Multi-Path), OSPF (where multiple links are set up using the dynamic routing protocol OSPF with equal cost) or BGP (to perform load-balancing when there are more than one equal cost links between two BGP routers).

Of course, this is only scratching the surface of what the RouterOS can do with the router’s hardware, but it is enough to put the Mikrotik CCR1009-7G-1C-1S+PC among the best dual-wan routers on the market in 2018.

7. Ubiquiti EdgeMAX EdgeRouter Lite ERLite-3

Ubiquiti is known for making high quality networking devices, with enterprise-like features at a really low cost and the EdgeRouter Lite ERLite-3 is one of the most reliable low-cost VPN routers for a small company. The EdgeMAX EdgeRouter Lite ERLite-3 is not really a Dual WAN router per se, but this function became available after the release of EdgeOS v1.4.0 (you should always download the latest firmware, by accessing the manufacturer’s page), which made possible the addition of the dual WAN load balancing wizard.

As you will see from other router reviews, I appreciate high performance, but I also consider that the design as an important factor often overlooked by networking devices manufacturers. Fortunately, the Ubiquiti agreed with us and the EdgeRouter Lite looks a lot more stylish than other Dual WAN routers. Sure, it features the same rectangular black box (made of plastic), but  the reduced size and the EdgeRouter LITE logo on top, near the hexagonal pattern of the heat vents enhance the overall look and don’t make the router feel cheap (there’s also a variant with chamfered edges).

On the front of the router, you can find the Console port (you will need a DB9 port on your computer to be able to connect to the Console port), three Ethernet ports (marked from 0 to 2) and a recessed RESET button (accessible with a paper clip). There is no array of separate status LED lights, but you do get a LED on the left side of each port (Amber means link established at 10/100 Mbps, Green means link established at 1000 Mbps). The back of the router is mainly occupied by ventilation holes, but there’s also a Power port and a Grounding Hole (with a screw).
As said before, EdgeRouter ERLite-3 is a router of small proportions, measuring 7.7×3.5×1.1 inches and it weighing 10 ounces, meaning, it’s rather light. This isn’t necessarily a good thing, as it doesn’t really feel sturdy and may actually fall of the table. But, if that’s the case you can wall mount it, just make sure you position the router with the Ethernet ports downwards (make sure the logo isn’t upside down) and don’t obstruct the ventilation holes.

Now, let’s have a look on the inside. The ERLite-3 has a dual-core Cavium Octeon CN5020 (based on the MIPS64 architecture – featuring Hardware Acceleration for Packet Processing), 512MB of DDR2 RAM and 2GB of flash storage (built-in mini USB key). Furthermore, there’s also an Atheros AR8035 Gigabit PHY (x3) switch. EdgeMAX EdgeRouter Lite ERLite-3 doesn’t have any WiFi capabilities, so you will need an additional wireless access point if you want to use the 2.4Ghz and/or the 5GHz radio bands.
As said before, the EdgeRouter Lite ERLite-3 uses the EdgeOS, which, from the 1.4.0 version, allows you to choose from three types of configurations Load Balancing, WAN+2LAN and WAN+2LAN2 (from the Wizards tab). The Load Balancing feature is extremely important as it allows you to spread the traffic across both links, increase the bandwidth and not worry about downtime (in case a link fails, it automatically switches the other one).

In terms of applications, the ERLite-3 supports IPv6 routing, IPSec Site-to-Site tunnels, PPTP and L2TP Remote Access, PPTP Client and OpenVPN Site-to-Site tunnels. Security is also paramount and Ubiquiti EdgeMAX EdgeRouter Lite ERLite-3 doesn’t disappoint, featuring an ACL-based Firewall (the access control list is used for traffic filtering), a Zone-based Firewall (a very advanced form of creating security zones and implementing security policies towards the traffic between these zones) and NAT (which blocks unsolicited inbound traffic).
Lastly, I have tested the speed performance of the Ubiquiti ERLite-3 using a 1GB file and we measured 770 Mbps for downloading the file and 745 Mbps for uploading it.

8. Synology RT2600ac

ALSO CHECK OUT: The Full Review Of Synology RT2600ac

Synology is a popular manufacturer of networking products, well known for its NAS line and, last year I was a little surprised to see that it decided to leave the comfort zone and release its first wireless router, the RT1900ac (which offered a good price-to-features ratio, a more than decent wireless performance and an excellent user interface – possibly one of the best). It seems that Synology grew quite fond of the router market and it has now released a second device, the RT2600ac, which besides offering a superior wireless performance and lots of great features, it also has dual-WAN capabilities, thus making it suitable for this list.

The dual-WAN routers aren’t a common occurrence in the consumer market and even if some would argue that the RT2600ac focuses more towards the tech-savvy, enthusiast audience, you’re not going to get the usual metallic rectangular box, but an attractive, carefully designed plastic case. Synology kept the overall look of the RT1900ac, but it has improved some key elements to make it stand out: the RT2600 looks less dynamic than its predecessor (which looked like it would jump right at you), but it has two antennas on the left and right side that gives it a slightly ominous look. Furthermore, the top side still has that small protruded zone, but there are now four sections with long and narrow cut-outs which ensure a proper airflow and keep the case cool even under a heavy load.

The RT2600ac has also gained a bit in terms of weight and size (weighs 1.54 pounds and measures 3.0 x 11.0 x 6.6 inches, without taking into consideration the antennas, which are detachable). The RT2600ac still has those two characteristic feet that can be used if you don’t like your router to sit flat on the desk (they also help a great deal to dissipate the heat) and, you also get the option of mounting the device on the wall using the two mounting holes on the bottom.
While the RT1900ac had the LED lights on the front, the RT2600ac has them positioned on the protruded top section, along with the Synology logo. The LEDs show the STATUS of the system, the connection status of the 2.4GHz and 5GHz radio bands, the WAN and for the four LAN ports.

Also on the front panel, Synology has equipped the router with an unusual SD card slot, which is a convenient way of easily transferring files with any clients connected to the network. On the rear side of the router, you get access to two of the four antenna bases, the Power button, the Power port, a Reset button (hold it for ten seconds to reset the device to factory default settings or for 4 seconds for a soft reset), a USB 2.0 port, a single WAN port and four Ethernet Gigabit LAN ports.

On the left side, the RT2600ac has a USB 3.0 port and an Eject button (used to eject any USB or SD external storages), while on the right side, there’s a WPS button and a WiFi switch (for turning on or off the WiFi).
Inside the case, Synology has equipped the RT2600ac with a 1.7GHz quad-core Qualcomm IPQ8065 CPU, 512 MB of RAM, 4GB (Toshiba) / 8MB (Macronix) and a Qualcomm Atheros QCA8337 switch chip. Furthermore, each radio bands takes advantage of the Qualcomm Atheros QCA9984, while the 5GHz band also has a RFMD PA5542 power amplifier and the 2.4GHz has a Skyworks SE2623L power amplifier.

The RT2600ac features a maximum theoretical data transfer rate of 1,733Mbps using the 5GHz band and up to 800Mbps using the 2.4GHz band. Of course, in reality, you won’t really get close to these numbers and, using a high-end laptop with a 2×2 wireless adapter, I was able to measure about 605 Mbps, 5 feet away from the router (on the 5GHz band) and about 421 Mbps at 30 feet.
Note: The wired performance of Synology RT2600ac was acceptable, reaching up to 940 Mbps for both WAN to LAN and LAN to WAN tests.

One of the main attractions of the RT1900ac was the uniquely designed, feature-packed user interface (which resembled the Windows OS) and it seems that the RT2600ac also takes advantage of the user-friendly UI, which now incorporates lots of features (such as the Download Station, that includes BitTorrent and usenet, Smart WAN and Smart Connect) and optional add-ons (such as the VPN Plus Server or the Intrusion Prevention).

Of course, the feature I’m going to focus on is the Smart WAN, which ensures Dual WAN load balancing, failover support or policy route. As you can see, the RT2600ac does not have two dedicated WAN ports, so you will use one LAN port as the second WAN interface (this way, you are left with only 3 LAN ports, so a switch may be a necessity). This configuration allows you to set up the Failover (and failback, once the primary interface is back to normal operation status – that can happen when one Internet connection fails), Load Balancing (two interfaces will work together and, in case one fails, it will switch to the failover mode), interface priority, policy route and interface checks.