Keep a name pointed at a changing address#

You will end up with a DNS name that follows your uplink's address as the provider changes it. This is what makes a WireGuard endpoint or a published service usable on a connection without a static address.

Before you start#

The operator role and a licence.
An account with a provider the router supports, and its credentials.
A name at that provider to update.

Step 1 — Add the entry#

Network → DNS → Dynamic DNS → + Add.

set service dns dynamic name home protocol cloudflare
set service dns dynamic name home address interface eth1
set service dns dynamic name home host-name home.example.com
set service dns dynamic name home zone example.com
set service dns dynamic name home username you@example.com
set service dns dynamic name home password <the API token>

Field	Command	Notes
Protocol	`protocol <p>`	36 to choose from, listed below
Host names	`host-name <n>`, one line each	The names to update
Address source	`address interface <if>` or `address web`	See step 2
Zone	`zone <z>`	The root domain; some providers require it
Username	`username <u>`
Password	`password <p>`	Usually an API token rather than an account password
Server	`server <s>`	Only for a provider that needs a non-default endpoint
IP version	`ip-version <4\\|6>`

The protocols the router's own completion lists, and the panel offers: cloudflare, dyndns2, duckdns, noip, freedns, godaddy, namecheap, porkbun, hetzner, digitalocean, gandi, ovh, he.net, nsupdate, zoneedit1, easydns, dnsmadeeasy, changeip, infomaniak, inwx, njalla, nfsn, yandex, regfishde, sitelutions, mythicdyn, keysystems, enom, dondominio, domeneshop, dinahosting, ddns.fm, dnsexit2, dslreports1, dyndns1, freemyip and 1984.

Step 2 — Choose how the router learns its own address#

Two ways, and the right one depends on where the router sits.

address interface <if> — read the address off the interface. Correct when the router holds the public address itself.

set service dns dynamic name home address interface eth1

address web — ask an external service what address the world sees. Correct when the router is behind another NAT, which is common on cable and on 4G.

set service dns dynamic name home address web
set service dns dynamic name home address web url https://ifconfig.me

The URL is optional; without it the router uses its own default.

Step 3 — Commit and watch the first update#

Check it worked#

The record resolves to the right address, from somewhere that is not the router:

bash

dig +short home.example.com @9.9.9.9
curl -s https://ifconfig.co

Those two should match.

On the router:

bash

show dns dynamic status

The DNS page shows the configured entries. It also reads the older configuration layout, so an entry made before the node moved still appears.

Then check it after the address changes. A dynamic DNS entry that has never had to update is untested. Force a renewal on the uplink, or wait.

Things that will bite#

A stale record cached somewhere. Providers publish short TTLs for this purpose; a resolver that ignores them, or a client that caches for its own reasons, still sees the old address for a while.

A hairpin rule with the old address in it. A NAT reflection rule contains the public address as a literal, so it goes stale when the address changes — which is one more reason to use split-horizon DNS inside instead.

The wrong address source. address interface on a router behind another NAT publishes a private address, and everything appears configured and nothing works.

Undoing it#

delete service dns dynamic name home

The page's row action stages that. The record at the provider keeps its last value; delete it there too if you want it gone.