How To Set Up Satellite Internet As Backup During Government

When governments restrict or completely shut down internet access, maintaining connectivity becomes critical for journalists, activists, developers, and organizations operating in high-risk environments. Satellite internet provides an independent communication channel that bypasses terrestrial infrastructure, making it an effective resilience tool against network blackouts. This guide covers the technical implementation of satellite internet as a backup connectivity solution.

Understanding Satellite Internet as a Backup Solution

Satellite internet operates by transmitting data between a dish antenna at your location and satellites orbiting the Earth. Unlike cable or fiber optic connections that depend on ground-level infrastructure, satellite connectivity only requires a clear view of the sky. This independence from local telecommunications infrastructure makes it resilient to government-ordered shutdowns that target terrestrial networks.

There are two primary categories to consider: geostationary (GEO) and low-earth orbit (LEO) satellite systems. GEO satellites sit at approximately 35,786 kilometers above the equator and provide broad coverage but with higher latency (typically 500-700ms). LEO satellite constellations, such as those operated by various providers, orbit closer to Earth (500-1,200 km) and offer significantly lower latency (20-40ms) but require more complex equipment setup.

For developers and power users, LEO-based solutions generally provide a better experience when latency matters, while GEO options may serve as cost-effective alternatives for basic connectivity needs.

Hardware Requirements

Setting up satellite internet as a backup requires specific hardware. The essential components include:

Satellite antenna/disk: The physical dish or flat-panel antenna that communicates with satellites
Modem or terminal: The device that converts satellite signals into usable internet data
Power supply: Reliable power for the entire setup, ideally with battery backup
Router: To distribute the connection to multiple devices

Many modern satellite internet providers offer integrated terminals that combine the antenna and modem into a single unit, simplifying deployment. These terminals typically connect via Ethernet or WiFi to your existing network equipment.

For portable or emergency setups, consider:

Fixed installations: Larger dishes with higher gain for permanent locations
Portable terminals: Compact units designed for mobility and quick deployment
Vehicle-mounted systems: Integrated solutions for mobile operations

Network Configuration for Automatic Failover

Implementing true backup functionality requires configuring your network to automatically switch to satellite internet when your primary connection fails. This section covers the technical implementation using common tools.

Using systemd-networkd for Failover

On Linux systems, you can configure automatic failover using systemd-networkd with routing tables:

# Define the primary interface (e.g., ethernet)
cat > /etc/systemd/network/50-ethernet.network << EOF
[Match]
Name=eth0

[Network]
DHCP=yes
IPv6AcceptRA=yes

[Route]
Gateway=192.168.1.1
Metric=100
EOF

# Define the satellite backup interface
cat > /etc/systemd/network/60-satellite.network << EOF
[Match]
Name=wlan0

[Network]
DHCP=yes
IPv6AcceptRA=yes

[Route]
Gateway=192.168.2.1
Metric=200
EOF

The lower metric value on the primary interface ensures it gets preference. When the primary fails, traffic automatically routes through the satellite interface.

Implementing Gateway Monitoring

You should add monitoring to detect primary connection failures:

#!/bin/bash
# failback-check.sh - Monitor primary gateway and fail over when needed

PRIMARY_GW="192.168.1.1"
CHECK_HOST="8.8.8.8"
SATELLITE_IF="wlan0"
PRIMARY_IF="eth0"

while true; do
    if ! ping -c 1 -W 2 "$CHECK_HOST" > /dev/null 2>&1; then
        # Primary gateway unreachable
        logger "Primary connection failed - switching to satellite"
        ip route change default dev "$SATELLITE_IF" metric 150
    else
        # Check if we should return to primary
        CURRENT_METRIC=$(ip route show default | grep "$PRIMARY_IF" | awk '{print $5}')
        if [ "$CURRENT_METRIC" -gt 100 ]; then
            logger "Primary connection restored - switching back"
            ip route change default dev "$PRIMARY_IF" metric 100
        fi
    fi
    sleep 30
done

Run this script as a systemd service for continuous monitoring:

sudo systemctl enable failback-check.service
sudo systemctl start failback-check.service

Using WireGuard Over Satellite

Satellite connections often have data caps or bandwidth limitations. Using WireGuard with compression and optimized settings improves efficiency:

# /etc/wireguard/wg0.conf
[Interface]
PrivateKey = <your-private-key>
Address = 10.0.0.2/24
MTU = 1280  # Reduce MTU for satellite links
PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -A FORWARD -o wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o %i -j MASQUERADE
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -D FORWARD -o wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o %i -j MASQUERADE

[Peer]
PublicKey = <server-public-key>
Endpoint = your-vpn-server.com:51820
AllowedIPs = 0.0.0.0/0
PersistentKeepalive = 25  # Keep NAT mappings alive over satellite

Setting MTU to 1280 prevents fragmentation over satellite links where the typical path MTU is lower than Ethernet defaults.

Operational Security Considerations

When using satellite internet in potentially monitored environments, consider these security practices:

Traffic Analysis Mitigation

Satellite traffic can be distinguished from terrestrial traffic due to characteristic latencies and routing patterns. To mitigate traffic analysis:

Route all traffic through a VPN or Tor to uniformize traffic patterns
Use obfsproxy or similar tools to disguise VPN signatures
Consider using LEO satellite services which have more variable latency, making timing analysis more difficult

Physical Security

The satellite dish itself can be a liability:

Position antennas to minimize visibility from monitoring points
Use smaller, lower-profile equipment when discretion is necessary
Consider RF shielding for the terminal equipment in high-risk environments

Data Management

Satellite connections typically have lower bandwidth and higher latency:

Implement data compression at the application level
Cache frequently accessed content locally
Use bandwidth-efficient protocols (HTTP/2, gRPC with compression)
Set up offline-first workflows that sync when connectivity is available

Testing Your Configuration

Regular testing ensures your backup system works when needed:

Disconnect your primary connection and verify automatic failover occurs
Test DNS resolution over the satellite link
Verify VPN connectivity works over the satellite connection
Test failback when primary connection returns
Measure actual bandwidth and latency to understand your operational limits

# Simple bandwidth test over satellite
iperf3 -c test-server.example.com -R -V

# Test with reduced MTU
iperf3 -c test-server.example.com -R -V -M 1280

Document your test results to establish baseline expectations during actual emergencies.

Cost and Accessibility

Satellite internet services typically operate on subscription models with varying data allowances. Some providers offer pay-as-you-go options, while others provide monthly plans with priority data. Research providers available in your region and understand their terms of service, including any restrictions that might apply during government emergencies.

For organizations, consider maintaining relationships with multiple satellite providers to ensure service availability during crisis situations when demand spikes.

Built by theluckystrike — More at zovo.one