Remote access with a dynamic IP: a practical DDNS guide
Find out whether you are behind CGNAT and set up a fixed name for your network, with ready-made commands for Linux, Windows and routers.
· Josué Juca
- Most connections' public IP changes on its own. A DDNS name follows that change.
- Before configuring anything, find out whether your provider uses CGNAT: in that case no DDNS works on its own.
- After the CGNAT check (step 0), setup takes 4 steps: name, IP update, test and safe access, preferably over a VPN.
Cameras, file server, NAS, internal system, VPN: all of it lives on your company's or home network, and reaching it from outside is usually simple until the day your provider changes your IP address. This guide shows how to build access that survives that change, step by step.
Why the IP changes
Most providers hand out a dynamic public IP: it can change when the router restarts, when the power drops or simply from time to time. If you set up remote access using that number, it stops working without warning. A fixed IP solves it, but it usually costs more and is not always available.
The alternative is dynamic DNS (DDNS): you always connect by the same name and a small program tells the service when the IP changes.
Step 0: find out whether DDNS will work
Some providers use CGNAT, where several customers share the same public IP. In that case the IP your router receives is not reachable from outside and port forwarding does not work. To find out, compare two numbers:
- Open your router's status page and note the WAN interface IP.
- See which IP the internet sees, using a "what is my IP" site or the terminal:
curl -fsS https://api.ipify.org
If the two differ, or if the WAN IP starts between 100.64 and 100.127 (the range reserved for CGNAT), you are behind CGNAT. The ways out are asking the provider for a public IP, using IPv6 when available, or setting up a tunnel backed by an external server.
Step 1: create the name
Use a DDNS service and create a host, which is your network's fixed name, such as minhaloja.ip.juk.re. In this guide we use JUK.re DDNS as the example, but the logic is the same on other services of this kind.
In the Connection step you choose how the device will report the new IP. The dashboard shows the right tutorial for each choice.At the end, the service generates a token for the host. It works like a password: do not publish it, and regenerate it if you think it leaked.
Step 2: set up who reports the new IP
Someone has to tell the service the current IP. It can be an always-on computer, a server or the router itself. Pick your case.
Linux and NAS (cron)
This command creates a task that checks the IP every 15 minutes and sends it to the service. Replace YOUR_TOKEN with the host's token:
(crontab -l 2>/dev/null | grep -v '/v1/update/'; echo '*/15 * * * * curl -fsS "https://gateway.juk.re/v1/update/YOUR_TOKEN?myip=$(curl -fsS https://api.ipify.org)" >/dev/null') | crontab -
Understanding the parts: grep -v removes an old entry of the same service so it does not get duplicated; /15 * * * schedules the run every 15 minutes; the inner curl finds your IP and ?myip= sends it.
Windows (PowerShell)
In PowerShell as administrator, this block registers a scheduled task that repeats the check every 15 minutes:
$action = New-ScheduledTaskAction -Execute 'powershell.exe' -Argument '-NoProfile -Command "$ip = Invoke-RestMethod https://api.ipify.org; Invoke-RestMethod (''https://gateway.juk.re/v1/update/YOUR_TOKEN?myip='' + $ip)"'
$trigger = New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -Minutes 15) -RepetitionDuration (New-TimeSpan -Days 3650)
Register-ScheduledTask -TaskName 'JUKre DDNS' -Action $action -Trigger $trigger -Force
Routers
MikroTik, UniFi and pfSense/OPNsense have their own dynamic DNS support, and the menu path changes with the firmware version. Keep in mind that not every router accepts a custom service: many TP-Link models, for example, only accept No-IP or DynDNS. In that case, run one of the scripts above on another device in the network.
What about IPv6?
ipify has two addresses: api.ipify.org returns your IPv4 and api6.ipify.org returns your IPv6. If you use both, send each record (A and AAAA) the right address: mixing them makes the record point to the wrong place.
The 15-minute interval is a good balance. Since the device only sends an update when the IP changes, there is no harm in checking often.
Step 3: test
- Open the host page in the dashboard and check that the IPv4 (and IPv6, if you use it) are filled in and that the last check was updated.
- Ask DNS which IP the name returns:
nslookup minhaloja.ip.juk.re
- Compare it with the IP you noted in Step 0. If they match, it is working.
After the first check, the host page shows the records, the last check and the last IP change.Step 4: access it safely
A fixed name makes life easier, and it also makes things easier for anyone who wants to attack you. Before opening ports, think about what you are exposing:
| Service | Expose directly to the internet? | Better alternative |
|---|
| Windows remote access (RDP) | No | VPN |
| Router admin panel | No | VPN |
| NAS and cameras | Avoid | VPN or tunnel |
| Public HTTPS website | Yes, with updates up to date | Firewall and monitoring |
A VPN, such as WireGuard, lets you use everything as if you were inside the network, with a single exposed port. Keep firmware up to date, use strong passwords and two-factor authentication.
Common problems
| What happens | Likely cause | What to do |
|---|
| The name points to the old IP | The update is not running | Check the cron job or scheduled task and that the token is correct |
| The name resolves the right IP but will not connect | CGNAT or closed port | Redo Step 0 and check port forwarding |
| It works from outside but not inside the network | The router does not do "NAT loopback" | Use the local IP or an internal DNS while on the network |
| The record shows the wrong IP on a PC with IPv6 | IPv4 and IPv6 mixed up | Update each record with its own address (api and api6) |
Need help?
If you would rather not touch the router or want a secure VPN, our infrastructure team configures everything and leaves it documented. And if you want to know the service used in this guide, see the JUK.re DDNS announcement.