Title: WAN↔Cellular failover switch leaves LAN-side connections half-open instead of resetting them (no RST sent)**
Device:** GL-XE3000 (Puli AX)
Architecture: ARMv8 Processor rev 4
OpenWrt Version: OpenWrt 21.02-SNAPSHOT
Kernel Version: 5.4.211
WAN setup: Wired WAN as primary, Cellular (5G) configured as automatic failover.
Steps to reproduce:
-
Router is running normally on WAN (Ethernet), with an active, long-lived TCP/WebSocket connection open from a LAN device to a remote server.
-
Unplug the WAN Ethernet cable. The router correctly detects the outage and fails over to Cellular.
-
Later, plug the WAN Ethernet cable back in. The router correctly switches back from Cellular to Ethernet.
Expected behavior:
I understand that a WAN interface switch changes the public IP/routing path, so existing connections will break — that part is unavoidable and not what I'm reporting. What I'd expect is that when the router tears down the old WAN's NAT sessions during a failover switch (in either direction), it sends a proper TCP RST back to the LAN-side client for each affected session, so the client is notified immediately that the connection is gone.
Actual behavior:
On both transitions (Ethernet→Cellular and Cellular→Ethernet), the old NAT sessions are simply abandoned rather than reset:
-
The remote server sees the connection close normally on its end.
-
The LAN-side client never receives a FIN/RST for the old session. Its socket stays in a "half-open" state, reporting itself as still connected.
-
The LAN device only discovers the connection is dead once its own application-level heartbeat times out — in my case a WebSocket ping/pong watchdog with a 60-second timeout, plus the time to re-establish and handshake a new connection. During that whole window the device believes it's online and functional when it isn't.
I found this with an IoT device (payment terminal) that keeps a persistent WebSocket open to a backend server. Every WAN↔Cellular failover event in either direction reproduces the issue reliably. I had to add a client-side watchdog in the device's own firmware to detect and force-reconnect around this, but it would be much more reliable (and faster) if the router itself closed out the old sessions cleanly at the moment of the interface switch, instead of leaving LAN clients to figure it out via timeouts.
Request:
When switching the active WAN interface (Ethernet→Cellular or Cellular→Ethernet), please have the router send TCP RST to LAN-side clients for NAT sessions that can no longer be routed, instead of silently dropping them from the conntrack table. This would let LAN devices detect and recover from failover events immediately rather than after tens of seconds of undetected half-open state.
Happy to provide further logs/packet captures if useful.