In brief
Failover is the modem/router's job; the box keeps collecting records through an outage. Why CGNAT is fine, how the pending timestamp queue works, and what "pending days" in the panel means.
The fibre line dropped one afternoon. The modem switched to the 4.5G backup; guests did not even notice. But did the box notice? What happened to the records? Could the timestamp be obtained? This post walks through what the box does during and after an outage.
Whose job is failover?
Hotspot-Box has no multi-WAN, and that is a deliberate design choice. The box has one WAN connection: the cable to the modem/router. Managing two lines and switching to the second when the first fails is the job of the modem/router (or a dual-WAN router). So:
- If you want a backup line, use a dual-WAN router or define the 4.5G modem as a backup on your existing router.
- The box does not know which line is active and does not need to. For the box, the internet is either there or it is not.
This split makes maintenance easier: line problems are solved on the router, record problems on the box.
What happens on the box during an outage?
If the internet is completely gone (no backup line either), three things are assessed separately.
Guest logins. SMS codes cannot reach the provider; new guests cannot verify by SMS. Coupon login keeps working, because the box validates coupons itself. That is one more reason to keep a stack of coupons at the till. Guests who already logged in keep their session; there is simply no internet.
Record collection. The box keeps the internal IP assignment records locally. With no internet, every device's MAC, assigned internal IP, session start and end keep being written. Collection does not depend on connectivity.
Timestamping. This is the only part affected, and it is explained below.
If the backup line kicks in, none of these three is affected; the box sees a brief blip and carries on.
The timestamp and the pending queue
The box links each day's records to the previous day with a SHA-256 digest and obtains an RFC 3161 timestamp for that day's digest. Only the digest goes to the timestamp service, never the records. Obtaining a timestamp needs internet.
Without internet, the box does this:
- It computes the day's digest and adds it to the chain. The chain does not break; the digest is local.
- It places the timestamp request in a queue.
- When connectivity returns, it requests a timestamp for every queued day and adds the file to the archive.
In the panel this queue appears as "pending days". Zero is normal. If several days are pending, either there is no internet or access to the timestamp service is blocked somewhere (a router rule or a DNS problem, for example). There is also a separate alarm for timestamp service reachability, delivered by e-mail, Telegram or webhook.
An honest note: a late timestamp proves the moment of stamping, not the day itself. But because the day's digest is chained to the previous day's stamped digest, integrity is preserved and the delay is plainly visible in the verification report. The queue exists to close the gap properly, not to hide it.
Why CGNAT is not a problem
Most 4.5G lines, and some fibre lines, sit behind CGNAT: you do not get a real public IP but a shared address from the operator's pool. Nobody can connect to you from outside. For many devices that is an obstacle; for the box it is not.
All of the box's connections go from inside to outside:
- Timestamp requests: box to service.
- SMS sending: box to provider.
- Platform health reports and licence checks: box to platform.
- Alarm notifications: box to mail server, Telegram or webhook address.
- Optional archive copy: box to an SFTP/FTPS server.
Nothing needs to connect in to the box. No static IP, no port forwarding. So the backup line can be a CGNAT 4.5G connection; the box sees no difference.
A power cut is not an internet outage
Do not confuse the two. During an internet outage the box runs, records and defers the timestamp. During a power cut the box is off; there are no records for that period. Usually the APs and modem are off too, so no guest gets online and there is nothing to record anyway. The dangerous case is the modem and APs staying up on another socket: guests get online, the box is absent. That is why the box, switch, APs and modem must share one UPS.
When power returns, the box starts on its own, syncs its clock over NTP and carries on. If the cut coincided with the stamping hour around midnight, the previous day shows as a "pending day" and gets stamped as soon as connectivity allows. That is normal; the number in the panel drops to zero within a few hours.
Post-outage check
| Check | Where | Expected |
|---|---|---|
| Box online | Panel health screen | Online; the "offline" alarm has cleared |
| Pending days | Panel records screen | Zero or decreasing |
| Timestamp service | Panel alarm list | No alarm |
| Last stamp date | Archive list | Days after the outage are stamped |
| SMS sending | Try with your own phone | Code arrives |
Recommended setup
- A dual-WAN router or a backup 4.5G modem; failover on the router.
- Box, switch and APs on the same UPS, so the chain keeps collecting through a power cut.
- A stack of coupons at the till, so guests are not left offline when the SMS path is down.
- The offline alarm routed to Telegram, so you hear about an outage before your guests do.
See the box page for the box's network requirements and the FAQ for other outage questions.
This is a technical guide, not legal advice.