Firebrick config

Are there any firebrick experts here? (Maybe not even expert... semi-competent would do! )

My setup:
Port 1 connects to my LAN.
Port 3 connects to a router that does 4G backup.
Port 4 connects to a fibre router.
And I have an AAISP L2TP tunnel.

My preferred routing would be:
1. L2TP over fibre connection when everything is working
2. NAT over fibre when L2TP is down
3. L2TP over 4G if fibre is down
4. NAT over 4G when everything else is broken

but I can't really get my ahead around how to configure it like this. Currently, my L2TP doesn't attempt to work over 4G backup. Is anyone able to help?

Here's an extract from my current config

<port name="WAN3"
       ports="3"
       comment="4G router"/>
 <port name="WAN4"
       ports="4"
       comment="3TL fibre modem"/>
 <port name="WAN5"
       ports="5"/>
 <port name="USB"
       ports=""
       dongle="Example"/>
 <port name="LAN"
       ports="1 2"/>
 <interface name="WAN4"
            port="WAN4"
            wan="true"
            table="1"
            comment="3TL fibre">
  <subnet name="WAN-DHCP"
          localpref="1000"/>
 </interface>
 <interface name="LAN"
            port="LAN"
            ra-client="false">
  <subnet name="LAN"
          ip="10.0.0.1/24 ****/64"
          ra="true"
          ra-max="120"
          nat="true"/>
  <dhcp name="LAN"/>
 </interface>
 <interface name="WAN3"
            port="WAN3"
            graph="LTE-Gateway"
            wan="true"
            ping="81.187.81.187"
            comment="4G router for backup connectivity">
  <subnet name="WAN-DHCP-4G"
          localpref="100"/>
 </interface>
 <usb>
  <dongle name="Example"
          comment="Default USB config, does not usually require any more settings"/>
 </usb>
 <cqm/>
 <l2tp>
  <outgoing name="AA-L2TP"
            local-hostname="firebrick"
            server="l2tp.aa.net.uk"
            graph="AA-L2TP"
            table="1"
            payload-table="0"
            username="******"
            password="secret"
            localpref="4294967295"
            log="default"
            log-error="email"/>
 </l2tp>
 <ping name="Google"
       graph="Google"
       ip="8.8.8.8"/>
 <ping name="Cloudflare"
       graph="Cloudflare"
       ip="1.1.1.1"/>
 <rule-set name="Firewall: LAN"
           target-interface="LAN"
           no-match-action="reject"
           comment="Default firewall rule for traffic to LAN">
  <rule name="Allow from FireBrick"
        source-interface="self"/>
  <rule name="Allow NAT-PMP/PCP"
        pcp="true"
        profile="disabled"
        comment="NAT-PMP/PCP allow in (example)"/>
 </rule-set>

Edited by xela (Thu 21-Sep-23 11:50:49)

Now working - big thanks to A&A support for sending an example config file

I get the impression that there are several ways to do what I want, but I seem to have it working by using profiles to determine fibre up/down, 4g up/down, l2tp up/down.

Then I've duplicated my l2tp tunnel config. One is active when fibre is online, one is active when 4g is online but fibre is offline.

Finally, if no l2tp is active, a firewall rule routes everything via NAT.