Interfaces in this example:

  • WAN1 = ether1 (DHCP CLIENT)
  • WAN2 = ppp-usb-lte (PPP CLIENT)

Netwatch settings:

/tool netwatch
add comment="WAN1 failover" down-script=":log info \"Failover WAN1: DOWN\"\r\
    \n\r\
    \n/ip dhcp-client set [find interface=\"ether1\"] default-route-distance=11\r\
    \n\r\
    \n/ip dhcp-client release ether1\r\
    \n" host=1.1.1.1 interval=10s up-script=":log info \"Failover WAN1: UP\"\r\
    \n\r\
    \n/ip dhcp-client set [find interface=\"ether1\"] default-route-distance=1"
add comment="WAN2 failover" down-script=\
    ":log info \"Failover WAN2: DOWN\"\r\
    \n\r\
    \n/interface ppp-client set [find interface=\"ppp-usb-lte\"] default-route-distance=12\r\
    \n\r\
    \n/interface ppp-client disable ppp-usb-lte\r\
    \n\r\
    \n/interface ppp-client enable ppp-usb-lte" host=1.0.0.1 interval=10s up-script=":log info \"Failover WAN2: UP\"\r\
    \n\r\
    \n/interface ppp-client set [find interface=\"ppp-usb-lte\"] default-route-distance=2"

Firewall filter rules:

/ip firewall filter
add action=drop chain=output comment="Block WAN2 Access to WAN1 Failover" dst-address=1.1.1.1 out-interface=ppp-usb-lte
add action=drop chain=output comment="Block WAN1 Access to WAN2 Failover" dst-address=1.0.0.1 out-interface=ether1