WAN Failover, Untangle, and Wireguard

Depends on how fast you want something to fail over, you could setup a DNS entry with a low TTL so you only have to have one tunnel, but you are then relying on end points to update their DNS if their is a failure.