You have two internet connections — a primary fiber link and a backup 4G or secondary ISP — and you want the router to switch to the backup automatically when the primary drops, then switch back once it recovers. Doing this reliably comes down to how RouterOS decides a gateway is "down," and there are two different tools for it depending on how much logic you actually need.
Add both default routes with different distances
RouterOS prefers the route with the lower administrative distance. Give the primary connection distance 1 and the backup distance 2, so the backup route only gets used when the primary one is removed from the routing table.
/ip route add gateway=1.1.1.1 distance=1 check-gateway=ping
/ip route add gateway=2.2.2.2 distance=2 check-gateway=pingUnderstand what check-gateway=ping actually does
With check-gateway=ping, RouterOS pings the gateway address itself. If it stops responding, the route is marked unreachable and automatically pulled from the routing table — at which point the distance-2 route becomes the active default route. When the primary gateway starts responding again, its route is reinstated and, being lower distance, takes over again automatically.
Confirm the routes are being tracked
Check the status column to see which route is currently active and whether the gateway checks are passing:
/ip route print where dst-address=0.0.0.0/0Reach for Netwatch only if you need custom logic
Route-based failover is the right tool for the common case: switch the default route when the gateway itself goes down. If you need something more specific — checking a host other than the gateway, running a script, sending a notification, or triggering an action unrelated to routing — that's what Netwatch is for:
/tool netwatch add host=8.8.8.8 interval=10s \
up-script=":log info \"WAN1 is back up\"" \
down-script=":log info \"WAN1 is down\""Don't reach for Netwatch as your primary failover mechanism when a plain check-gateway=ping route already does the job — it's more moving parts for the same basic result.
Why do it this way
check-gateway=ping on two routes with different distances is the simplest, most battle-tested way to get failover for the common case, because it lets RouterOS's own routing table decide — there's no script to break, no external process to monitor, and recovery back to the primary link is automatic. Netwatch is a general-purpose "watch a host, run a script" tool, and using it for basic failover means writing and maintaining scripting logic to do what two lines of route configuration already do correctly. Reach for Netwatch when you need it to do something routing can't — not as a replacement for check-gateway.
How MoniTik helps
A failover event on a customer link is exactly the kind of thing you want to know about immediately, not discover after a support call. MoniTik alerts the moment a monitored link changes state, so a failover to backup — and the eventual recovery — shows up in your alert feed in real time even if nobody is staring at the router's route table when it happens.
Camila focuses on routing, VPNs, and hardening MikroTik deployments for small and mid-size networks.