Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    No-IP Updating DDNS Address from VPN

    Scheduled Pinned Locked Moved General pfSense Questions
    27 Posts 3 Posters 2.8k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • D
      DeathGrin
      last edited by DeathGrin

      Hi All,

      I have No-IP DDNS configured on my PFSense box. The issue is, it updates both my WAN IP Address and VPN IP Address. After looking through the logs I see:

      Sep 12 09:46:33 check_reload_status 398 updating dyndns vpn_inter
      Sep 12 09:46:35 check_reload_status 398 updating dyndns WAN_DHCP

      The Dynamic DNS Widget shows the correct IP but when I perform an nslookup for my domain it has the vpn public ip. Does anyone know what setting or how I can disable Dynamic DNS from updating from the vpn interface? I only want my WAN Public IP to be configured with DDNS.

      Further setup information:
      I have a wireguard vpn setup and have most traffic routed through the vpn. The only other setup I have is specific NAT rules and lan rules for my xbox and specific streaming sites (netflix, hbo max, etc.) to go out my WAN instead of the vpn.

      Thank you!

      Bob.DigB 1 Reply Last reply Reply Quote 0
      • Bob.DigB
        Bob.Dig LAYER 8 @DeathGrin
        last edited by

        @deathgrin Then show the first two "tabs" in >Services>Dynamic DNS>Dynamic DNS Clients.

        1 Reply Last reply Reply Quote 0
        • stephenw10S
          stephenw10 Netgate Administrator
          last edited by

          Yes, is the dyndns client configured to use WAN directly? Or a gateway group?

          D 1 Reply Last reply Reply Quote 0
          • D
            DeathGrin @stephenw10
            last edited by

            @stephenw10, It is configured only for the WAN.

            @Bob-Dig, I am not sure what you mean? Did I miss the first part of a reply?

            1 Reply Last reply Reply Quote 0
            • stephenw10S
              stephenw10 Netgate Administrator
              last edited by

              He means show us your config so we can see what might be wrong there.

              Does your WAN have a private IP and uses external discovery to find the real IP?

              Steve

              D 1 Reply Last reply Reply Quote 1
              • D
                DeathGrin @stephenw10
                last edited by DeathGrin

                @stephenw10 Here you go and I have nothing configured for RFC 2136 Clients. And for my WAN, I have broadband through xfinity, so I just have DHCP setup and my modem in bridge mode:
                Screen Shot 2022-09-13 at 9.32.28 AM.png

                1 Reply Last reply Reply Quote 0
                • stephenw10S
                  stephenw10 Netgate Administrator
                  last edited by

                  Hmm, and when it does the wrong thing the cached IP there shows the Wireguard interface address? Or the remote public IP?

                  D 1 Reply Last reply Reply Quote 0
                  • D
                    DeathGrin @stephenw10
                    last edited by

                    @stephenw10 No see that is what is weird, it shows the correct IP (my WAN Public IP from Xfinity, the 73.229.x.x) and so does the DDNS widget on the main status dashboard but when I perform an nslookup for my domain, it has the VPN Public IP (37.19.x.x). That is why I am confused as to why No-IP is caching the wrong Public IP....

                    1 Reply Last reply Reply Quote 0
                    • stephenw10S
                      stephenw10 Netgate Administrator
                      last edited by

                      If it resolves to that then something must have updated it. If pfSense isn't logging any dyndns updates with that IP is it possible you have another client behind the firewall sending updates?

                      Steve

                      D 1 Reply Last reply Reply Quote 0
                      • D
                        DeathGrin @stephenw10
                        last edited by

                        @stephenw10 or anyone else that might have an idea. Below is the output from logs. For some reason, Dynamic DNS is pulling from my Mullvad VPN gateway (connecting to Denver). I have Dynamic DNS set to monitor WAN interface only so I am not sure why it's pulling from the VPN gateway...

                        2022-09-27 17:58:20.642801-06:00 	check_reload_status 	398 	updating dyndns mullvad_vpn_denver
2022-09-27 17:54:53.084818-06:00 	check_reload_status 	398 	updating dyndns mullvad_vpn_denver
2022-09-27 13:22:12.444495-06:00 	php-fpm 	22139 	/services_dyndns_edit.php: phpDynDNS (xxxxxxx.ddns.net): (Success) IP Address Changed Successfully!
2022-09-27 13:22:12.444432-06:00 	php-fpm 	22139 	/services_dyndns_edit.php: phpDynDNS: updating cache file /conf/dyndns_wannoip-free'xxxxxxx.ddns.net'0.cache: 73.xxx.xxx.xxx
2022-09-27 13:22:12.443438-06:00 	php-fpm 	22139 	/services_dyndns_edit.php: Dynamic DNS noip-free (xxxxxxx.ddns.net): 73.xxx.xxx.xxx extracted from local system.
2022-09-27 13:22:12.362510-06:00 	php-fpm 	22139 	/services_dyndns_edit.php: Dynamic DNS noip-free (xxxxxxxx.ddns.net): _checkStatus() starting.
2022-09-27 13:22:12.362491-06:00 	php-fpm 	22139 	/services_dyndns_edit.php: Response Data: good 73.xxx.xxx.xxx\x0d
                        1 Reply Last reply Reply Quote 0
                        • stephenw10S
                          stephenw10 Netgate Administrator
                          last edited by

                          But the 73.x.x.x IP there is the correct one?

                          You have a different dyndns client that's running on mullvad_vpn_denver?

                          Are you sure there is not another client running somewhere else that might be updating the ddns.net entry?

                          Steve

                          D 1 Reply Last reply Reply Quote 0
                          • D
                            DeathGrin @stephenw10
                            last edited by

                            @stephenw10 Correct but the most recent events (should have mentioned, I have my log view flipped so newer events are at the top) shows that Dynamic DNS is pulling from my vpn to Mullvad for some reason even though I have it set to only WAN. I will triple check that I don't have any other clients with DDNS enabled but I am 99.99% I don't.

                            D 1 Reply Last reply Reply Quote 0
                            • D
                              DeathGrin @DeathGrin
                              last edited by

                              And here for a more normal view, now most recent logs are at the bottom but you can still see dyndns is updating from all of my vpns for some reason...

                                2022-09-28 09:54:32.591314-06:00	php-fpm	22139	/rc.dyndns.update: phpDynDNS (site.ddns.net): No change in my IP address and/or 25 days has not passed. Not updating dynamic DNS entry.
2022-09-28 09:54:36.269588-06:00	check_reload_status	398	updating dyndns mullvad_vpn_denver
2022-09-28 09:54:40.893574-06:00	check_reload_status	398	updating dyndns site_to_site_site
2022-09-28 09:55:44.500746-06:00	check_reload_status	398	updating dyndns site_to_site_site
2022-09-28 09:55:48.069564-06:00	check_reload_status	398	updating dyndns mullvad_vpn_denver
2022-09-28 09:55:53.212823-06:00	check_reload_status	398	updating dyndns WAN_DHCP
2022-09-28 09:55:54.268282-06:00	php-fpm	19444	/rc.dyndns.update: Dynamic DNS: updatedns() starting
2022-09-28 09:55:54.351864-06:00	php-fpm	19444	/rc.dyndns.update: Dynamic DNS noip-free (site.ddns.net): 73.x.x.x extracted from local system.
2022-09-28 09:55:54.351890-06:00	php-fpm	19444	/rc.dyndns.update: Dynamic DNS (site.ddns.net): running get_failover_interface for wan. found em0
2022-09-28 09:55:54.432583-06:00	php-fpm	19444	/rc.dyndns.update: Dynamic DNS noip-free (site.ddns.net): 73.229.x.x extracted from local system.
2022-09-28 09:55:54.432650-06:00	php-fpm	19444	/rc.dyndns.update: Dynamic Dns (site.ddns.net): Current WAN IP: 73.229.x.x Cached IP: 73.229.x.x
2022-09-28 09:55:54.432669-06:00	php-fpm	19444	/rc.dyndns.update: phpDynDNS (site.ddns.net): No change in my IP address and/or 25 days has not passed. Not updating dynamic DNS entry.
2022-09-28 10:00:55.875749-06:00	php-fpm	360	/services_dyndns.php: Successful login for user 'user' from: 172.20.x.x (Local Database)
                              1 Reply Last reply Reply Quote 0
                              • stephenw10S
                                stephenw10 Netgate Administrator
                                last edited by

                                Those logs indicate it's checking each WAN, that's what the dyndns updater does. But then is shows it find the expected IP against em0 directly and that's the same as the cached IP.
                                Those logs do not appear to show it updating the record with the VPN IP address.

                                Try disabling it entirely and see if it still gets updated by something.
                                Have you ever configured anything else to update that dyndns entry?

                                Steve

                                D 1 Reply Last reply Reply Quote 0
                                • D
                                  DeathGrin @stephenw10
                                  last edited by

                                  @stephenw10 So for whatever reason, if when it's cached correctly in the logs with the 73.x.x.x address (my public WAN IP) it still gets updated with the Mullvad VPN public IP and NO-IP DDNS only seems to get updated with VPN IP when I add the firewall rule for LAN to force traffic from my main LAN out of that interface (VPN). Should I be setting up to force traffic out the VPN a different way?

                                  Bob.DigB 1 Reply Last reply Reply Quote 0
                                  • Bob.DigB
                                    Bob.Dig LAYER 8 @DeathGrin
                                    last edited by Bob.Dig

                                    @deathgrin Maybe show all rules on Floating and all NAT Outbound rules.

                                    Maybe you have another DDNS Client you forgot about on one of your hosts?

                                    D 1 Reply Last reply Reply Quote 0
                                    • D
                                      DeathGrin @Bob.Dig
                                      last edited by

                                      @bob-dig I am 99% positive I don't have anything else updating Dynamic DNS besides my pfsense box. Here are snippets of the rules you asked for. I also have manual rules in outbound NAT where I was trying to force all traffic destined for anything NOIP for DDNS updates out my main WAN and not vpn.
                                      Screen Shot 2022-09-30 at 12.34.28 PM.png
                                      Screen Shot 2022-09-30 at 12.34.51 PM.png
                                      Screen Shot 2022-09-30 at 12.34.28 PM.png
                                      Screen Shot 2022-09-30 at 12.37.44 PM.png

                                      Bob.DigB 2 Replies Last reply Reply Quote 0
                                      • Bob.DigB
                                        Bob.Dig LAYER 8 @DeathGrin
                                        last edited by Bob.Dig

                                        @deathgrin I don't think you need any of the manual outbound rules (other then xbox) but I am no expert.
                                        But the rules seem to be ok.

                                        1 Reply Last reply Reply Quote 0
                                        • Bob.DigB
                                          Bob.Dig LAYER 8 @DeathGrin
                                          last edited by Bob.Dig

                                          @deathgrin Default Gateway (SystemRoutingGateways) should be WAN, if you haven't checked that.

                                          D 1 Reply Last reply Reply Quote 0
                                          • D
                                            DeathGrin @Bob.Dig
                                            last edited by

                                            @bob-dig yeah I have my default WAN manually set to the specific ISP Interface and not set to Automatic.

                                            Bob.DigB 1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.